diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json new file mode 100644 index 000000000..a6dd646db --- /dev/null +++ b/.devcontainer/devcontainer.json @@ -0,0 +1,11 @@ +{ + "name": "devcontainer", + "image": "ghcr.io/kubefirst/devcontainers/full:latest", + "features": {}, + "customizations": { + "vscode": { + "extensions": [], + "settings": {} + } + } +} diff --git a/.editorconfig b/.editorconfig new file mode 100644 index 000000000..8de40a7b5 --- /dev/null +++ b/.editorconfig @@ -0,0 +1,18 @@ +# editorconfig.org +root = true + +[*] +indent_style = space +indent_size = 2 +end_of_line = lf +charset = utf-8 +trim_trailing_whitespace = true +insert_final_newline = true + +[*.go] +indent_style = tab +indent_size = 4 + +[Makefile] +indent_style = tab +indent_size = 4 diff --git a/akamai-github/templates/mgmt/components/argo-workflows/vault-wait.yaml b/akamai-github/templates/mgmt/components/argo-workflows/vault-wait.yaml index 47beecc62..bde31a201 100644 --- a/akamai-github/templates/mgmt/components/argo-workflows/vault-wait.yaml +++ b/akamai-github/templates/mgmt/components/argo-workflows/vault-wait.yaml @@ -22,4 +22,3 @@ spec: selfHeal: true syncOptions: - CreateNamespace=true - - Replace=true diff --git a/akamai-github/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml b/akamai-github/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml index c90d10ff9..d0f9b3f66 100644 --- a/akamai-github/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml +++ b/akamai-github/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml @@ -23,6 +23,7 @@ kind: Job metadata: annotations: argocd.argoproj.io/sync-wave: '0' + argocd.argoproj.io/sync-options: Force=true,Replace=true name: wait-vault-tls namespace: vault spec: diff --git a/akamai-github/templates/mgmt/components/argocd/kustomization.yaml b/akamai-github/templates/mgmt/components/argocd/kustomization.yaml index 362b89122..907f8ba77 100644 --- a/akamai-github/templates/mgmt/components/argocd/kustomization.yaml +++ b/akamai-github/templates/mgmt/components/argocd/kustomization.yaml @@ -5,7 +5,7 @@ namespace: argocd # To upgrade ArgoCD, increment the version here # https://github.com/argoproj/argo-cd/tags resources: - - github.com:kubefirst/manifests.git/argocd/cloud?ref=main + - github.com:konstructio/manifests.git/argocd/cloud?ref=v1.1.0 - argocd-ui-ingress.yaml - externalsecrets.yaml - argocd-oidc-restart-job.yaml diff --git a/akamai-github/templates/mgmt/components/kubefirst/console.yaml b/akamai-github/templates/mgmt/components/kubefirst/console.yaml index a7a0e7cc9..df130b7f1 100644 --- a/akamai-github/templates/mgmt/components/kubefirst/console.yaml +++ b/akamai-github/templates/mgmt/components/kubefirst/console.yaml @@ -8,8 +8,8 @@ metadata: spec: project: default source: - repoURL: https://charts.kubefirst.com - targetRevision: 2.4.14-rc22 + repoURL: https://charts.konstruct.io + targetRevision: 2.5.12-rc3 chart: kubefirst helm: values: |- diff --git a/akamai-github/terraform/akamai/main.tf b/akamai-github/terraform/akamai/main.tf index 0fcb71ab5..1c8ab565f 100644 --- a/akamai-github/terraform/akamai/main.tf +++ b/akamai-github/terraform/akamai/main.tf @@ -35,7 +35,7 @@ locals { resource "linode_lke_cluster" "kubefirst" { label = local.cluster_name - k8s_version = "1.28" + k8s_version = "1.30" region = "us-central" tags = [""] diff --git a/akamai-github/terraform/github/repos.tf b/akamai-github/terraform/github/repos.tf index 5126eb8a9..93e1e125c 100644 --- a/akamai-github/terraform/github/repos.tf +++ b/akamai-github/terraform/github/repos.tf @@ -26,7 +26,7 @@ terraform { module "gitops" { source = "./modules/repository" - repo_name = "gitops" + repo_name = " " archive_on_destroy = false auto_init = false # set to false if importing an existing repository team_developers_id = github_team.developers.id @@ -55,7 +55,7 @@ variable "atlantis_repo_webhook_secret" { module "metaphor" { source = "./modules/repository" - repo_name = "metaphor" + repo_name = "" archive_on_destroy = false auto_init = false # set to false if importing an existing repository create_ecr = true diff --git a/akamai-github/terraform/github/teams.tf b/akamai-github/terraform/github/teams.tf index 355d21b5f..a77f9bae9 100644 --- a/akamai-github/terraform/github/teams.tf +++ b/akamai-github/terraform/github/teams.tf @@ -1,11 +1,11 @@ resource "github_team" "admins" { - name = "admins" + name = "" description = "administrators of the kubefirst platform" privacy = "closed" } resource "github_team" "developers" { - name = "developers" + name = "" description = "developers using the kubefirst plaftform" privacy = "closed" } diff --git a/akamai-github/terraform/users/admins/data_sources.tf b/akamai-github/terraform/users/admins/data_sources.tf index a454eea5f..1331a4653 100644 --- a/akamai-github/terraform/users/admins/data_sources.tf +++ b/akamai-github/terraform/users/admins/data_sources.tf @@ -1,5 +1,5 @@ data "github_team" "admins" { - slug = "admins" + slug = "" } data "vault_auth_backend" "userpass" { diff --git a/akamai-github/terraform/users/developers/data_sources.tf b/akamai-github/terraform/users/developers/data_sources.tf index 9c5d5c625..471e1c444 100644 --- a/akamai-github/terraform/users/developers/data_sources.tf +++ b/akamai-github/terraform/users/developers/data_sources.tf @@ -1,5 +1,5 @@ data "github_team" "developers" { - slug = "developers" + slug = "" } data "vault_auth_backend" "userpass" { diff --git a/akamai-github/terraform/users/users.tf b/akamai-github/terraform/users/users.tf index 672aa9857..d70c8fceb 100644 --- a/akamai-github/terraform/users/users.tf +++ b/akamai-github/terraform/users/users.tf @@ -20,11 +20,11 @@ terraform { } data "github_team" "admins" { - slug = "admins" + slug = "" } data "github_team" "developers" { - slug = "developers" + slug = "" } data "vault_auth_backend" "userpass" { @@ -32,7 +32,7 @@ data "vault_auth_backend" "userpass" { } data "vault_identity_group" "admins" { - group_name = "admins" + group_name = "" } variable "initial_password" { diff --git a/akamai-github/terraform/vault/oidc-groups.tf b/akamai-github/terraform/vault/oidc-groups.tf index 4da060600..b2cc82df9 100644 --- a/akamai-github/terraform/vault/oidc-groups.tf +++ b/akamai-github/terraform/vault/oidc-groups.tf @@ -1,5 +1,5 @@ resource "vault_identity_group" "developers" { - name = "developers" + name = "" type = "internal" policies = ["developer"] @@ -16,7 +16,7 @@ resource "vault_identity_group" "developers" { } resource "vault_identity_group" "admins" { - name = "admins" + name = "" type = "internal" policies = ["admin"] diff --git a/akamai-gitlab/atlantis.yaml b/akamai-gitlab/atlantis.yaml new file mode 100644 index 000000000..ed8f5cf2c --- /dev/null +++ b/akamai-gitlab/atlantis.yaml @@ -0,0 +1,23 @@ +version: 3 +automerge: true +projects: + - dir: terraform/ + terraform_version: 1.3.8 + autoplan: + enabled: true + when_modified: ['**/*.tf', '*.tf*'] + - dir: terraform/ + terraform_version: 1.3.8 + autoplan: + enabled: true + when_modified: ['**/*.tf', '*.tf*'] + - dir: terraform/users + terraform_version: 1.3.8 + autoplan: + enabled: true + when_modified: ['**/*.tf', '**/modules/*.tf', '**/admins/*.tf', '**/developers/*.tf', '*.tf*'] + - dir: terraform/vault + terraform_version: 1.3.8 + autoplan: + enabled: true + when_modified: ['**/*.tf', '*.tf*'] diff --git a/akamai-gitlab/registry/environments/.gitkeep b/akamai-gitlab/registry/environments/.gitkeep new file mode 100644 index 000000000..e69de29bb diff --git a/akamai-gitlab/registry/environments/development/docker-config.yaml b/akamai-gitlab/registry/environments/development/docker-config.yaml new file mode 100644 index 000000000..abce40648 --- /dev/null +++ b/akamai-gitlab/registry/environments/development/docker-config.yaml @@ -0,0 +1,21 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: development-docker-config +spec: + refreshInterval: 10s + secretStoreRef: + name: vault-kv-secret + kind: ClusterSecretStore + target: + template: + type: kubernetes.io/dockerconfigjson + data: + .dockerconfigjson: "{{ .dockerconfig | toString }}" + name: docker-config + creationPolicy: Owner + data: + - secretKey: "dockerconfig" + remoteRef: + property: dockerconfig + key: dockerconfigjson diff --git a/akamai-gitlab/registry/environments/development/metaphor.yaml b/akamai-gitlab/registry/environments/development/metaphor.yaml new file mode 100644 index 000000000..729c9a8ea --- /dev/null +++ b/akamai-gitlab/registry/environments/development/metaphor.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: development-environment-metaphor + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '45' +spec: + project: default + source: + repoURL: + path: registry/environments/development/metaphor + targetRevision: HEAD + destination: + name: in-cluster + namespace: development + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/registry/environments/development/metaphor/Chart.yaml b/akamai-gitlab/registry/environments/development/metaphor/Chart.yaml new file mode 100644 index 000000000..add07d286 --- /dev/null +++ b/akamai-gitlab/registry/environments/development/metaphor/Chart.yaml @@ -0,0 +1,9 @@ +apiVersion: v2 +dependencies: + - name: metaphor + repository: http://chartmuseum.chartmuseum.svc.cluster.local:8080 + version: 0.0.1-rc.awaiting-ci +description: metaphor example application +name: metaphor +type: application +version: 1.0.0 diff --git a/akamai-gitlab/registry/environments/development/metaphor/values.yaml b/akamai-gitlab/registry/environments/development/metaphor/values.yaml new file mode 100644 index 000000000..5a2bd320e --- /dev/null +++ b/akamai-gitlab/registry/environments/development/metaphor/values.yaml @@ -0,0 +1,36 @@ +metaphor: + annotations: | + linkerd.io/inject: "enabled" + labels: | + mirror.linkerd.io/exported: "true" + image: + repository: /metaphor + imagePullSecrets: + - name: docker-config + ingress: + className: nginx + enabled: true + annotations: + + + + + nginx.ingress.kubernetes.io/service-upstream: "true" + hosts: + - host: metaphor-development. + paths: + - path: / + pathType: Prefix + tls: + - secretName: metaphor-tls + hosts: + - metaphor-development. + metaphor: + host: https://metaphor-development./api + console: https://kubefirst. + + clusterSecretStoreName: vault-kv-secret + vaultSecretPath: development/metaphor + configs: + configOne: development-config-one + configTwo: development-config-two diff --git a/akamai-gitlab/registry/environments/production/docker-config.yaml b/akamai-gitlab/registry/environments/production/docker-config.yaml new file mode 100644 index 000000000..a5bc0b0b0 --- /dev/null +++ b/akamai-gitlab/registry/environments/production/docker-config.yaml @@ -0,0 +1,21 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: production-docker-config +spec: + refreshInterval: 10s + secretStoreRef: + name: vault-kv-secret + kind: ClusterSecretStore + target: + template: + type: kubernetes.io/dockerconfigjson + data: + .dockerconfigjson: "{{ .dockerconfig | toString }}" + name: docker-config + creationPolicy: Owner + data: + - secretKey: "dockerconfig" + remoteRef: + property: dockerconfig + key: dockerconfigjson diff --git a/akamai-gitlab/registry/environments/production/metaphor.yaml b/akamai-gitlab/registry/environments/production/metaphor.yaml new file mode 100644 index 000000000..67732dd26 --- /dev/null +++ b/akamai-gitlab/registry/environments/production/metaphor.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: production-environment-metaphor + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: "45" +spec: + project: default + source: + repoURL: + path: registry/environments/production/metaphor + targetRevision: HEAD + destination: + name: in-cluster + namespace: production + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/registry/environments/production/metaphor/Chart.yaml b/akamai-gitlab/registry/environments/production/metaphor/Chart.yaml new file mode 100644 index 000000000..add07d286 --- /dev/null +++ b/akamai-gitlab/registry/environments/production/metaphor/Chart.yaml @@ -0,0 +1,9 @@ +apiVersion: v2 +dependencies: + - name: metaphor + repository: http://chartmuseum.chartmuseum.svc.cluster.local:8080 + version: 0.0.1-rc.awaiting-ci +description: metaphor example application +name: metaphor +type: application +version: 1.0.0 diff --git a/akamai-gitlab/registry/environments/production/metaphor/values.yaml b/akamai-gitlab/registry/environments/production/metaphor/values.yaml new file mode 100644 index 000000000..fa6fdc551 --- /dev/null +++ b/akamai-gitlab/registry/environments/production/metaphor/values.yaml @@ -0,0 +1,36 @@ +metaphor: + annotations: | + linkerd.io/inject: "enabled" + labels: | + mirror.linkerd.io/exported: "true" + image: + repository: /metaphor + imagePullSecrets: + - name: docker-config + ingress: + className: nginx + enabled: true + annotations: + + + + + nginx.ingress.kubernetes.io/service-upstream: "true" + hosts: + - host: metaphor-production. + paths: + - path: / + pathType: Prefix + tls: + - secretName: metaphor-tls + hosts: + - metaphor-production. + metaphor: + host: https://metaphor-production./api + console: https://kubefirst. + + clusterSecretStoreName: vault-kv-secret + vaultSecretPath: production/metaphor + configs: + configOne: production-config-one + configTwo: production-config-two diff --git a/akamai-gitlab/registry/environments/staging/docker-config.yaml b/akamai-gitlab/registry/environments/staging/docker-config.yaml new file mode 100644 index 000000000..ca0da599e --- /dev/null +++ b/akamai-gitlab/registry/environments/staging/docker-config.yaml @@ -0,0 +1,21 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: staging-docker-config +spec: + refreshInterval: 10s + secretStoreRef: + name: vault-kv-secret + kind: ClusterSecretStore + target: + template: + type: kubernetes.io/dockerconfigjson + data: + .dockerconfigjson: "{{ .dockerconfig | toString }}" + name: docker-config + creationPolicy: Owner + data: + - secretKey: "dockerconfig" + remoteRef: + property: dockerconfig + key: dockerconfigjson diff --git a/akamai-gitlab/registry/environments/staging/metaphor.yaml b/akamai-gitlab/registry/environments/staging/metaphor.yaml new file mode 100644 index 000000000..ffabfac66 --- /dev/null +++ b/akamai-gitlab/registry/environments/staging/metaphor.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: staging-environment-metaphor + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '45' +spec: + project: default + source: + repoURL: + path: registry/environments/staging/metaphor + targetRevision: HEAD + destination: + name: in-cluster + namespace: staging + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/registry/environments/staging/metaphor/Chart.yaml b/akamai-gitlab/registry/environments/staging/metaphor/Chart.yaml new file mode 100644 index 000000000..add07d286 --- /dev/null +++ b/akamai-gitlab/registry/environments/staging/metaphor/Chart.yaml @@ -0,0 +1,9 @@ +apiVersion: v2 +dependencies: + - name: metaphor + repository: http://chartmuseum.chartmuseum.svc.cluster.local:8080 + version: 0.0.1-rc.awaiting-ci +description: metaphor example application +name: metaphor +type: application +version: 1.0.0 diff --git a/akamai-gitlab/registry/environments/staging/metaphor/values.yaml b/akamai-gitlab/registry/environments/staging/metaphor/values.yaml new file mode 100644 index 000000000..c80894a39 --- /dev/null +++ b/akamai-gitlab/registry/environments/staging/metaphor/values.yaml @@ -0,0 +1,36 @@ +metaphor: + annotations: | + linkerd.io/inject: "enabled" + labels: | + mirror.linkerd.io/exported: "true" + image: + repository: /metaphor + imagePullSecrets: + - name: docker-config + ingress: + className: nginx + enabled: true + annotations: + + + + + nginx.ingress.kubernetes.io/service-upstream: "true" + hosts: + - host: metaphor-staging. + paths: + - path: / + pathType: Prefix + tls: + - secretName: metaphor-tls + hosts: + - metaphor-staging. + metaphor: + host: https://metaphor-staging./api + console: https://kubefirst. + + clusterSecretStoreName: vault-kv-secret + vaultSecretPath: staging/metaphor + configs: + configOne: staging-config-one + configTwo: staging-config-two diff --git a/akamai-gitlab/templates/mgmt/actions-runner-controller.yaml b/akamai-gitlab/templates/mgmt/actions-runner-controller.yaml new file mode 100644 index 000000000..fdc2e5883 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/actions-runner-controller.yaml @@ -0,0 +1,31 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: actions-runner-controller-components + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '50' +spec: + project: default + source: + repoURL: + path: registry/clusters//components/actions-runner-controller + targetRevision: HEAD + destination: + name: in-cluster + namespace: github-runner + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ApplyOutOfSyncOnly=true + - Replace=true + - PruneLast=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/akamai-gitlab/templates/mgmt/appprojects.yaml b/akamai-gitlab/templates/mgmt/appprojects.yaml new file mode 100644 index 000000000..a72971ae2 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/appprojects.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: argocd-projects + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '0' +spec: + project: default + source: + repoURL: + path: registry/clusters//components/argocd-appprojects + targetRevision: HEAD + destination: + name: in-cluster + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/mgmt/argo-workflows.yaml b/akamai-gitlab/templates/mgmt/argo-workflows.yaml new file mode 100644 index 000000000..c3b3da006 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/argo-workflows.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: argo-components + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '50' +spec: + project: default + source: + repoURL: + path: registry/clusters//components/argo-workflows + targetRevision: HEAD + destination: + name: in-cluster + namespace: argo + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/mgmt/argocd.yaml b/akamai-gitlab/templates/mgmt/argocd.yaml new file mode 100644 index 000000000..aff31c243 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/argocd.yaml @@ -0,0 +1,31 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: argocd-kustomized-app + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '100' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: argocd + name: in-cluster + project: default + source: + path: registry/clusters//components/argocd + repoURL: '' + targetRevision: HEAD + syncPolicy: + automated: + prune: true + selfHeal: true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/akamai-gitlab/templates/mgmt/atlantis.yaml b/akamai-gitlab/templates/mgmt/atlantis.yaml new file mode 100644 index 000000000..7618ce235 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/atlantis.yaml @@ -0,0 +1,28 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: atlantis-components + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '50' +spec: + project: default + source: + repoURL: + path: registry/clusters//components/atlantis + targetRevision: HEAD + destination: + name: in-cluster + namespace: atlantis + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/akamai-gitlab/templates/mgmt/cert-issuers.yaml b/akamai-gitlab/templates/mgmt/cert-issuers.yaml new file mode 100644 index 000000000..e4a32c26f --- /dev/null +++ b/akamai-gitlab/templates/mgmt/cert-issuers.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cert-issuers + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '20' +spec: + project: default + source: + repoURL: + path: registry/clusters//components/cert-issuers + targetRevision: HEAD + destination: + name: in-cluster + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/mgmt/cert-manager.yaml b/akamai-gitlab/templates/mgmt/cert-manager.yaml new file mode 100644 index 000000000..da101a165 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/cert-manager.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cert-manager-components + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: + path: registry/clusters//components/cert-manager + targetRevision: HEAD + destination: + name: in-cluster + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/mgmt/chartmuseum.yaml b/akamai-gitlab/templates/mgmt/chartmuseum.yaml new file mode 100644 index 000000000..97e88125c --- /dev/null +++ b/akamai-gitlab/templates/mgmt/chartmuseum.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: chartmuseum-components + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '50' +spec: + project: default + source: + repoURL: + path: registry/clusters//components/chartmuseum + targetRevision: HEAD + destination: + name: in-cluster + namespace: chartmuseum + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/mgmt/cloudflare-origin-ca-issuer.yaml b/akamai-gitlab/templates/mgmt/cloudflare-origin-ca-issuer.yaml new file mode 100644 index 000000000..a648c94d1 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/cloudflare-origin-ca-issuer.yaml @@ -0,0 +1,32 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cloudflare-cloudflare-origin-ca-issuer + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '19' +spec: + project: default + source: + repoURL: ghcr.io/cloudflare/origin-ca-issuer-charts + chart: origin-ca-issuer + targetRevision: 0.5.2 + helm: + values: |- + global: + rbac: + create: true + controller: + image: + repository: cloudflare/origin-ca-issuer + tag: v0.6.1 + pullPolicy: Always + destination: + name: in-cluster + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true \ No newline at end of file diff --git a/akamai-gitlab/templates/mgmt/cloudflare-origin-issuer-crd.yaml b/akamai-gitlab/templates/mgmt/cloudflare-origin-issuer-crd.yaml new file mode 100644 index 000000000..a45cbbd69 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/cloudflare-origin-issuer-crd.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cloudflare-origin-issuer-crd + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '19' +spec: + project: default + source: + repoURL: https://github.com/cloudflare/origin-ca-issuer + path: deploy/crds + targetRevision: v0.6.1 + destination: + name: in-cluster + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true \ No newline at end of file diff --git a/akamai-gitlab/templates/mgmt/cluster-secret-store.yaml b/akamai-gitlab/templates/mgmt/cluster-secret-store.yaml new file mode 100644 index 000000000..b41bcf86f --- /dev/null +++ b/akamai-gitlab/templates/mgmt/cluster-secret-store.yaml @@ -0,0 +1,28 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cluster-secret-store + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '40' +spec: + project: default + source: + repoURL: + path: registry/clusters//components/cluster-secret-store + targetRevision: HEAD + destination: + name: in-cluster + namespace: external-secrets-operator + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/akamai-gitlab/templates/mgmt/clusterrolebinding.yaml b/akamai-gitlab/templates/mgmt/clusterrolebinding.yaml new file mode 100644 index 000000000..35bf79f3a --- /dev/null +++ b/akamai-gitlab/templates/mgmt/clusterrolebinding.yaml @@ -0,0 +1,119 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: argocd-clusterrole + annotations: + argocd.argoproj.io/sync-wave: '0' +subjects: + - kind: ServiceAccount + name: argocd + namespace: argocd +roleRef: + kind: ClusterRole + name: admin + apiGroup: rbac.authorization.k8s.io +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: argo-clusterrole + annotations: + argocd.argoproj.io/sync-wave: '0' +subjects: + - kind: ServiceAccount + name: argo-server + namespace: argo +roleRef: + kind: ClusterRole + name: admin + apiGroup: rbac.authorization.k8s.io +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: github-runner-clusterrole + annotations: + argocd.argoproj.io/sync-wave: '0' +subjects: + - kind: ServiceAccount + name: github-runner + namespace: github-runner +roleRef: + kind: ClusterRole + name: admin + apiGroup: rbac.authorization.k8s.io +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: argo-admin-admin-clusterrole + annotations: + argocd.argoproj.io/sync-wave: '0' +subjects: + - kind: ServiceAccount + name: argo-admin + namespace: argo +roleRef: + kind: ClusterRole + name: admin + apiGroup: rbac.authorization.k8s.io +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: argo-admin-clusterrole + annotations: + argocd.argoproj.io/sync-wave: '0' +subjects: + - kind: ServiceAccount + name: argo-admin + namespace: argo +roleRef: + kind: ClusterRole + name: argo-admin + apiGroup: rbac.authorization.k8s.io +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: argo-developer-clusterrole + annotations: + argocd.argoproj.io/sync-wave: '0' +subjects: + - kind: ServiceAccount + name: argo-developer + namespace: argo +roleRef: + kind: ClusterRole + name: argo-view + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: argocd-admin-crb + annotations: + argocd.argoproj.io/sync-wave: '0' +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: admin +subjects: + - kind: ServiceAccount + name: argocd-server + namespace: argocd +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: argocd-crossplane-admin-crb + annotations: + argocd.argoproj.io/sync-wave: '0' +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: crossplane-admin +subjects: + - kind: ServiceAccount + name: argocd-server + namespace: argocd diff --git a/akamai-gitlab/templates/mgmt/clusters.yaml b/akamai-gitlab/templates/mgmt/clusters.yaml new file mode 100644 index 000000000..15dc510fd --- /dev/null +++ b/akamai-gitlab/templates/mgmt/clusters.yaml @@ -0,0 +1,25 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: clusters + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '1000' +spec: + project: default + source: + repoURL: + path: registry/clusters//components/clusters + targetRevision: HEAD + destination: + name: in-cluster + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + allowEmpty: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/mgmt/components/actions-runner-controller/application.yaml b/akamai-gitlab/templates/mgmt/components/actions-runner-controller/application.yaml new file mode 100644 index 000000000..eda48ffcf --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/actions-runner-controller/application.yaml @@ -0,0 +1,134 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: actions-runner-contoller + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: https://actions-runner-controller.github.io/actions-runner-controller + targetRevision: 0.20.2 + helm: + values: |- + labels: {} + + replicaCount: 1 + + webhookPort: 9443 + syncPeriod: 1m + defaultScaleDownDelay: 10m + + enableLeaderElection: true + authSecret: + enabled: true + name: "controller-manager" + + dockerRegistryMirror: "" + image: + repository: "summerwind/actions-runner-controller" + actionsRunnerRepositoryAndTag: "summerwind/actions-runner:latest" + dindSidecarRepositoryAndTag: "docker:dind" + pullPolicy: IfNotPresent + # The default image-pull secrets name for self-hosted runner container. + # It's added to spec.ImagePullSecrets of self-hosted runner pods. + actionsRunnerImagePullSecrets: [] + + imagePullSecrets: [] + nameOverride: "" + fullnameOverride: "" + + runner: + statusUpdateHook: + enabled: false + + rbac: + {} + + serviceAccount: + create: true + annotations: {} + name: "" + + podAnnotations: {} + + podLabels: {} + + podSecurityContext: + {} + + securityContext: + {} + + service: + type: ClusterIP + port: 443 + annotations: {} + + metrics: + serviceAnnotations: {} + serviceMonitor: false + serviceMonitorLabels: {} + port: 8443 + proxy: + enabled: true + image: + repository: quay.io/brancz/kube-rbac-proxy + tag: v0.13.0 + + resources: + {} + + nodeSelector: {} + + tolerations: [] + + affinity: {} + + podDisruptionBudget: + enabled: false + + priorityClassName: "" + + env: + {} + # specify additional environment variables for the controller pod. + # It's possible to specify either key vale pairs e.g.: + # http_proxy: "proxy.com:8080" + # https_proxy: "proxy.com:8080" + # no_proxy: "" + + # or a list of complete environment variable definitions e.g.: + # - name: GITHUB_APP_INSTALLATION_ID + # valueFrom: + # secretKeyRef: + # key: some_key_in_the_secret + # name: some-secret-name + # optional: true + + additionalVolumes: [] + + additionalVolumeMounts: [] + + scope: + singleNamespace: false + watchNamespace: "" + + certManagerEnabled: true + + admissionWebHooks: + {} + chart: actions-runner-controller + destination: + name: in-cluster + namespace: github-runner + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ApplyOutOfSyncOnly=true + - Replace=true + - PruneLast=true diff --git a/akamai-gitlab/templates/mgmt/components/actions-runner-controller/externalsecret.yaml b/akamai-gitlab/templates/mgmt/components/actions-runner-controller/externalsecret.yaml new file mode 100644 index 000000000..8d2657e16 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/actions-runner-controller/externalsecret.yaml @@ -0,0 +1,18 @@ +apiVersion: external-secrets.io/v1alpha1 +kind: ExternalSecret +metadata: + name: controller-manager + namespace: github-runner + annotations: + argocd.argoproj.io/sync-wave: '0' +spec: + target: + name: controller-manager + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + data: + - remoteRef: + key: ci-secrets + property: PERSONAL_ACCESS_TOKEN + secretKey: github_token diff --git a/akamai-gitlab/templates/mgmt/components/actions-runner-controller/wait.yaml b/akamai-gitlab/templates/mgmt/components/actions-runner-controller/wait.yaml new file mode 100644 index 000000000..3d73dde85 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/actions-runner-controller/wait.yaml @@ -0,0 +1,59 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-toolkit-arc + namespace: github-runner +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: k8s-toolkit-arc + namespace: github-runner +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: k8s-toolkit-arc + namespace: github-runner +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: k8s-toolkit-arc +subjects: + - kind: ServiceAccount + name: k8s-toolkit-arc + namespace: github-runner +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-actions-runner-controller + namespace: github-runner +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - github-runner + - --label + - app.kubernetes.io/name=actions-runner-controller + image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-arc diff --git a/akamai-gitlab/templates/mgmt/components/argo-workflows/application.yaml b/akamai-gitlab/templates/mgmt/components/argo-workflows/application.yaml new file mode 100644 index 000000000..6c5decdd0 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/argo-workflows/application.yaml @@ -0,0 +1,91 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: argo + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: https://argoproj.github.io/argo-helm + targetRevision: 0.20.1 + helm: + values: |- + nameOverride: argo + executor: + resources: + requests: + cpu: 200m + memory: 256Mi + limits: + cpu: 1 + memory: 1024Mi + server: + secure: false + extraArgs: + - --auth-mode=client + - --auth-mode=sso + ingress: + enabled: true + ingressClassName: nginx + annotations: + + + + + hosts: + - argo. + paths: + - / + pathType: Prefix + tls: + - secretName: argo-tls + hosts: + - argo. + sso: + issuer: https://vault./v1/identity/oidc/provider/kubefirst + clientId: + name: argo-secrets + key: client-id + clientSecret: + name: argo-secrets + key: client-secret + redirectUrl: https://argo./oauth2/callback + scopes: + - email + - openid + - groups + - user + - profile + # RBAC Config. >= v2.12 + rbac: + enabled: true + useDefaultArtifactRepo: true + useStaticCredentials: true + artifactRepository: + archiveLogs: false + s3: + accessKeySecret: + name: ci-secrets + key: accesskey + secretKeySecret: + name: ci-secrets + key: secretkey + insecure: false + bucket: + endpoint: us-east-1.linodeobjects.com + region: us-east-1 + useSDKCreds: false + encryptionOptions: + enableEncryption: false + chart: argo-workflows + destination: + name: in-cluster + namespace: argo + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/mgmt/components/argo-workflows/argo-workflows-cwfts.yaml b/akamai-gitlab/templates/mgmt/components/argo-workflows/argo-workflows-cwfts.yaml new file mode 100644 index 000000000..d67cd4efc --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/argo-workflows/argo-workflows-cwfts.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: argo-cwfts + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: default + source: + repoURL: + path: registry/clusters//components/argo-workflows/cwfts + targetRevision: HEAD + destination: + name: in-cluster + namespace: argo + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/mgmt/components/argo-workflows/cloudflareissuer.yaml b/akamai-gitlab/templates/mgmt/components/argo-workflows/cloudflareissuer.yaml new file mode 100644 index 000000000..0e2593d4e --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/argo-workflows/cloudflareissuer.yaml @@ -0,0 +1,31 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: cloudflare-creds + namespace: argo + annotations: + argocd.argoproj.io/sync-wave: "0" +spec: + target: + name: cloudflare-creds + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + data: + - remoteRef: + key: cloudflare + property: origin-ca-api-key + secretKey: origin-ca-api-key +--- +apiVersion: cert-manager.k8s.cloudflare.com/v1 +kind: OriginIssuer +metadata: + name: cloudflare-origin-issuer + namespace: argo +spec: + requestType: OriginECC + auth: + serviceKeyRef: + key: origin-ca-api-key + name: cloudflare-creds diff --git a/akamai-gitlab/templates/mgmt/components/argo-workflows/cwfts/cwft-git.yaml b/akamai-gitlab/templates/mgmt/components/argo-workflows/cwfts/cwft-git.yaml new file mode 100644 index 000000000..f49e9056e --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/argo-workflows/cwfts/cwft-git.yaml @@ -0,0 +1,178 @@ +apiVersion: argoproj.io/v1alpha1 +kind: ClusterWorkflowTemplate +metadata: + name: cwft-git + annotations: + argocd.argoproj.io/sync-wave: '55' +spec: + templates: + - name: checkout-with-gitops-ssh + inputs: + parameters: + - name: appName + - name: branch + default: main + - name: gitUrlNoProtocol + artifacts: + - name: repo-source + path: '/src/{{inputs.parameters.appName}}' + git: + repo: '{{inputs.parameters.gitUrlNoProtocol}}/{{inputs.parameters.appName}}.git' + branch: '{{inputs.parameters.branch}}' + singleBranch: true + insecureIgnoreHostKey: true + sshPrivateKeySecret: + name: ci-secrets + key: SSH_PRIVATE_KEY + - name: gitops-source + path: /src/gitops + git: + repo: '{{inputs.parameters.gitUrlNoProtocol}}/gitops.git' + branch: 'main' + singleBranch: true + insecureIgnoreHostKey: true + sshPrivateKeySecret: + name: ci-secrets + key: SSH_PRIVATE_KEY + container: + image: golang:latest + command: ['/bin/sh', '-c'] + args: + - ls -la /src && + ls -la /src/{{inputs.parameters.appName}} + outputs: + artifacts: + - name: repo-source + path: /src + - name: checkout-with-gitops-https + inputs: + parameters: + - name: appName + - name: branch + default: main + - name: gitUrlNoProtocol + artifacts: + - name: repo-source + path: '/src/{{inputs.parameters.appName}}' + git: + repo: '{{inputs.parameters.gitUrlNoProtocol}}/{{inputs.parameters.appName}}.git' + branch: '{{inputs.parameters.branch}}' + singleBranch: true + insecureIgnoreHostKey: true + usernameSecret: + name: ci-secrets + key: BASIC_AUTH_USER + passwordSecret: + name: ci-secrets + key: PERSONAL_ACCESS_TOKEN + - name: gitops-source + path: /src/gitops + git: + repo: '{{inputs.parameters.gitUrlNoProtocol}}/gitops.git' + branch: 'main' + singleBranch: true + insecureIgnoreHostKey: true + usernameSecret: + name: ci-secrets + key: BASIC_AUTH_USER + passwordSecret: + name: ci-secrets + key: PERSONAL_ACCESS_TOKEN + container: + image: golang:latest + command: ['/bin/sh', '-c'] + args: + - ls -la /src && + ls -la /src/{{inputs.parameters.appName}} + outputs: + artifacts: + - name: repo-source + path: /src + - name: pull-commit-push-ssh + retryStrategy: + limit: '5' + # todo get ssh item not all secrets + volumes: + - name: ssh-key + secret: + defaultMode: 256 + secretName: ci-secrets + inputs: + artifacts: + - name: repo-source + path: /src + parameters: + - name: commitMessage + - name: gitUrlNoProtocol + - name: repoName + container: + workingDir: '/src/{{inputs.parameters.repoName}}' + image: golang:latest + command: ['/bin/sh', '-c'] + volumeMounts: + - mountPath: '/mnt/secrets' + name: ssh-key + readOnly: true + args: + - set -e; + + eval `ssh-agent -s`; + mkdir $HOME/.ssh; + cat /mnt/secrets/SSH_PRIVATE_KEY > $HOME/.ssh/id_ed25519; + echo -n "\\n" >> $HOME/.ssh/id_ed25519; + chmod 0600 $HOME/.ssh/id_ed25519; + ssh-add $HOME/.ssh/id_ed25519; + + echo "Host *" >> $HOME/.ssh/config; + echo " StrictHostKeyChecking no" >> $HOME/.ssh/config; + echo " User git" >> $HOME/.ssh/config; + echo " IdentitiesOnly yes" >> $HOME/.ssh/config; + echo " UserKnownHostsFile /dev/null" >> $HOME/.ssh/config; + chmod 0700 $HOME/.ssh/config; + + git config --global user.email 'k-ray@example.com'; + git config --global user.name 'kbot'; + git remote set-url origin '{{inputs.parameters.gitUrlNoProtocol}}/{{inputs.parameters.repoName}}.git'; + git remote -v; + git status; + git pull; + git add .; + git commit -m "{{inputs.parameters.commitMessage}}" || echo "Assuming this was committed on previous run, not erroring out" ; + git push; + - name: pull-commit-push-https + retryStrategy: + limit: '5' + # todo get ssh item not all secrets + inputs: + artifacts: + - name: repo-source + path: /src + parameters: + - name: commitMessage + - name: gitUrlNoProtocol + - name: repoName + container: + workingDir: '/src/{{inputs.parameters.repoName}}' + image: golang:latest + command: ['/bin/bash', '-c'] + env: + - name: GIT_TOKEN + valueFrom: + secretKeyRef: + name: ci-secrets + key: PERSONAL_ACCESS_TOKEN + args: + - set -e; + + git config --global user.email 'k-ray@example.com'; + git config --global user.name 'kbot'; + echo "set url to https://kbot:token@.com/the_rest_of_the input slug"; + input_url='{{inputs.parameters.gitUrlNoProtocol}}/{{inputs.parameters.repoName}}.git'; + origin_url="${input_url/"https://.com"/"https://kbot:$GIT_TOKEN@.com"}"; + git remote set-url origin $origin_url; + git remote -v; + git status; + git pull; + git add .; + git commit -m "{{inputs.parameters.commitMessage}}" || echo "Assuming this was committed on previous run, not erroring out" ; + git push; diff --git a/akamai-gitlab/templates/mgmt/components/argo-workflows/cwfts/cwft-helm.yaml b/akamai-gitlab/templates/mgmt/components/argo-workflows/cwfts/cwft-helm.yaml new file mode 100644 index 000000000..795309cb0 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/argo-workflows/cwfts/cwft-helm.yaml @@ -0,0 +1,129 @@ +apiVersion: argoproj.io/v1alpha1 +kind: ClusterWorkflowTemplate +metadata: + name: cwft-helm + annotations: + argocd.argoproj.io/sync-wave: '55' +spec: + templates: + - name: get-chart-version + inputs: + artifacts: + - name: repo-source + path: /src + parameters: + - name: appName + - name: chartDir + script: + image: kubefirst/chubbo:0.2 + command: [python3] + workingDir: '/src/{{inputs.parameters.appName}}' + source: | + import yaml, semver + with open('./{{inputs.parameters.chartDir}}/Chart.yaml') as f: + chart_yaml = yaml.load(f, Loader=yaml.FullLoader) + print(chart_yaml['version']) + - name: set-chart-versions + inputs: + artifacts: + - name: repo-source + path: /src + parameters: + - name: appName + - name: chartDir + - name: chartVersion + - name: shortSha + script: + image: kubefirst/chubbo:0.2 + command: [bash] + workingDir: '/src/{{inputs.parameters.appName}}' + source: | + set -e + NEW_CHART_VERSION={{inputs.parameters.chartVersion}} + echo "setting ./{{inputs.parameters.chartDir}}/Chart.yaml to version: ${NEW_CHART_VERSION}" + sed -i "s/version:.*/version: ${NEW_CHART_VERSION}/g" /src/{{inputs.parameters.appName}}/{{inputs.parameters.chartDir}}/Chart.yaml + echo "setting ./{{inputs.parameters.chartDir}}/Chart.yaml to appVersion: {{inputs.parameters.shortSha}}" + sed -i "s/appVersion:.*/appVersion: '{{inputs.parameters.shortSha}}'/g" /src/{{inputs.parameters.appName}}/{{inputs.parameters.chartDir}}/Chart.yaml + echo "adjusted chart:" + cat /src/{{inputs.parameters.appName}}/{{inputs.parameters.chartDir}}/Chart.yaml + outputs: + artifacts: + - name: repo-source + path: /src + - name: publish-chart + retryStrategy: + limit: '5' + inputs: + artifacts: + - name: repo-source + path: /src + parameters: + - name: appName + - name: chartDir + container: + image: kubefirst/chubbo:0.2 + command: ['bash', '-c'] + workingDir: '/src/{{inputs.parameters.appName}}' + args: + - helm repo add kubefirst http://chartmuseum.chartmuseum.svc.cluster.local:8080 --username ${BASIC_AUTH_USER} --password ${BASIC_AUTH_PASS} || bash -c "sleep 10 && echo 'waiting before trying again' && exit 1"; + helm push {{inputs.parameters.chartDir}} kubefirst || bash -c "sleep 10 && echo 'waiting before trying again' && exit 1"; + env: + - name: BASIC_AUTH_PASS + valueFrom: + secretKeyRef: + name: ci-secrets + key: BASIC_AUTH_PASS + - name: BASIC_AUTH_USER + valueFrom: + secretKeyRef: + name: ci-secrets + key: BASIC_AUTH_USER + - name: set-environment-version + inputs: + artifacts: + - name: repo-source + path: /src + parameters: + - name: chartVersion + - name: environment + - name: fullChartPath + script: + image: kubefirst/chubbo:0.2 + command: [bash] + workingDir: '/src/gitops' + source: | + set -e + echo "setting wrapper Chart.yaml to version: {{inputs.parameters.chartVersion}}" + sed -i "s/ version:.*/ version: {{inputs.parameters.chartVersion}}/g" "{{inputs.parameters.fullChartPath}}" + echo "updated {{inputs.parameters.environment}} wrapper chart version to {{inputs.parameters.chartVersion}}" + outputs: + artifacts: + - name: repo-source + path: /src + - name: increment-chart-minor + inputs: + artifacts: + - name: repo-source + path: /src + parameters: + - name: appName + - name: chartDir + - name: chartVersion + script: + image: kubefirst/chubbo:0.2 + command: [python3] + workingDir: '/src/{{inputs.parameters.appName}}' + source: | + import yaml, semver + with open('./{{inputs.parameters.chartDir}}/Chart.yaml') as f: + chart_yaml = yaml.load(f, Loader=yaml.FullLoader) + chart_version = semver.parse('{{inputs.parameters.chartVersion}}') + next_chart_version = '{}.{}.0'.format(chart_version['major'],chart_version['minor']+1) + chart_yaml['version'] = next_chart_version + with open('./{{inputs.parameters.chartDir}}/Chart.yaml', 'w') as f: + yaml.dump(chart_yaml, f) + print('prepared next release in {{inputs.parameters.chartDir}} with bumped chart version after releasing {}'.format(next_chart_version)) + outputs: + artifacts: + - name: repo-source + path: /src diff --git a/akamai-gitlab/templates/mgmt/components/argo-workflows/cwfts/cwft-kaniko.yaml b/akamai-gitlab/templates/mgmt/components/argo-workflows/cwfts/cwft-kaniko.yaml new file mode 100644 index 000000000..02d9b8986 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/argo-workflows/cwfts/cwft-kaniko.yaml @@ -0,0 +1,84 @@ +apiVersion: argoproj.io/v1alpha1 +kind: ClusterWorkflowTemplate +metadata: + name: cwft-kaniko +spec: + entrypoint: build-push + templates: + - name: build-push-ssh + inputs: + parameters: + - name: appName + - name: branch + - name: containerRegistryURL + - name: gitUrlNoProtocol + artifacts: + - name: app-source + path: '/src/{{inputs.parameters.appName}}' + git: + repo: '{{inputs.parameters.gitUrlNoProtocol}}/{{inputs.parameters.appName}}.git' + branch: '{{inputs.parameters.branch}}' + singleBranch: true + insecureIgnoreHostKey: true + sshPrivateKeySecret: + name: ci-secrets + key: SSH_PRIVATE_KEY + volumes: + - name: docker-config + secret: + secretName: 'container-registry-auth' + container: + image: gcr.io/kaniko-project/executor:latest + volumeMounts: + - name: docker-config + mountPath: /.docker + env: + - name: DOCKER_CONFIG + value: /.docker + args: + - '--dockerfile' + - 'Dockerfile' + - '--context' + - 'dir:///src/{{inputs.parameters.appName}}/' + - '--destination' + - '{{inputs.parameters.containerRegistryURL}}' + - name: build-push-https + inputs: + parameters: + - name: appName + - name: branch + - name: containerRegistryURL + - name: gitUrlNoProtocol + artifacts: + - name: app-source + path: '/src/{{inputs.parameters.appName}}' + git: + repo: '{{inputs.parameters.gitUrlNoProtocol}}/{{inputs.parameters.appName}}.git' + branch: '{{inputs.parameters.branch}}' + singleBranch: true + insecureIgnoreHostKey: true + usernameSecret: + name: ci-secrets + key: BASIC_AUTH_USER + passwordSecret: + name: ci-secrets + key: PERSONAL_ACCESS_TOKEN + volumes: + - name: docker-config + secret: + secretName: 'container-registry-auth' + container: + image: gcr.io/kaniko-project/executor:latest + volumeMounts: + - name: docker-config + mountPath: /.docker + env: + - name: DOCKER_CONFIG + value: /.docker + args: + - '--dockerfile' + - 'Dockerfile' + - '--context' + - 'dir:///src/{{inputs.parameters.appName}}/' + - '--destination' + - '{{inputs.parameters.containerRegistryURL}}' diff --git a/akamai-gitlab/templates/mgmt/components/argo-workflows/externalsecret.yaml b/akamai-gitlab/templates/mgmt/components/argo-workflows/externalsecret.yaml new file mode 100644 index 000000000..a276c8c48 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/argo-workflows/externalsecret.yaml @@ -0,0 +1,59 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: ci-secrets + namespace: argo + annotations: + argocd.argoproj.io/sync-wave: '0' +spec: + target: + name: ci-secrets + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + dataFrom: + - extract: + key: /ci-secrets +--- +apiVersion: 'external-secrets.io/v1beta1' +kind: ExternalSecret +metadata: + name: argo-secrets + annotations: + argocd.argoproj.io/sync-wave: '0' +spec: + target: + name: argo-secrets + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + data: + - remoteRef: + key: oidc/argo + property: client_id + secretKey: client-id + - remoteRef: + key: oidc/argo + property: client_secret + secretKey: client-secret +--- +apiVersion: 'external-secrets.io/v1beta1' +kind: ExternalSecret +metadata: + name: container-registry-auth + annotations: + argocd.argoproj.io/sync-wave: '0' +spec: + target: + name: container-registry-auth + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + data: + - remoteRef: + key: registry-auth + property: auth + secretKey: config.json diff --git a/akamai-gitlab/templates/mgmt/components/argo-workflows/serviceaccount.yaml b/akamai-gitlab/templates/mgmt/components/argo-workflows/serviceaccount.yaml new file mode 100644 index 000000000..b18f586de --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/argo-workflows/serviceaccount.yaml @@ -0,0 +1,52 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: argo-admin + annotations: + argocd.argoproj.io/sync-wave: '0' + # The rule is an expression used to determine if this service account + # should be used. + # * `groups` - an array of the OIDC groups + # * `iss` - the issuer ("argo-server") + # * `sub` - the subject (typically the username) + # Must evaluate to a boolean. + # If you want an account to be the default to use, this rule can be "true". + # Details of the expression language are available in + # https://github.com/antonmedv/expr/blob/master/docs/Language-Definition.md. + workflows.argoproj.io/rbac-rule: "'admins' in groups" + # The precedence is used to determine which service account to use whe + # Precedence is an integer. It may be negative. If omitted, it defaults to "0". + # Numerically higher values have higher precedence (not lower, which maybe + # counter-intuitive to you). + # If two rules match and have the same precedence, then which one used will + # be arbitrary. + workflows.argoproj.io/rbac-rule-precedence: '1' +secrets: +- name: argo-admin +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: argo-developer + annotations: + argocd.argoproj.io/sync-wave: '0' + workflows.argoproj.io/rbac-rule: "'developers' in groups" + workflows.argoproj.io/rbac-rule-precedence: '0' +secrets: +- name: argo-developer +--- +apiVersion: v1 +kind: Secret +metadata: + name: argo-admin + annotations: + kubernetes.io/service-account.name: argo-admin +type: kubernetes.io/service-account-token +--- +apiVersion: v1 +kind: Secret +metadata: + name: argo-developer + annotations: + kubernetes.io/service-account.name: argo-developer +type: kubernetes.io/service-account-token diff --git a/akamai-gitlab/templates/mgmt/components/argo-workflows/vault-wait.yaml b/akamai-gitlab/templates/mgmt/components/argo-workflows/vault-wait.yaml new file mode 100644 index 000000000..47beecc62 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/argo-workflows/vault-wait.yaml @@ -0,0 +1,25 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: vault-wait + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '0' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: default + source: + repoURL: + path: registry/clusters//components/argo-workflows/wait + targetRevision: HEAD + destination: + name: in-cluster + namespace: vault + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - Replace=true diff --git a/akamai-gitlab/templates/mgmt/components/argo-workflows/wait.yaml b/akamai-gitlab/templates/mgmt/components/argo-workflows/wait.yaml new file mode 100644 index 000000000..0a16d771b --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/argo-workflows/wait.yaml @@ -0,0 +1,83 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-toolkit-argo + namespace: argo +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: k8s-toolkit-argo + namespace: argo +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: k8s-toolkit-argo + namespace: argo +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: k8s-toolkit-argo +subjects: + - kind: ServiceAccount + name: k8s-toolkit-argo + namespace: argo +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-argo-workflow-controller + namespace: argo +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - argo + - --label + - app.kubernetes.io/name=argo-workflow-controller + image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-argo +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-argo-server + namespace: argo +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - argo + - --label + - app.kubernetes.io/name=argo-server + image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-argo diff --git a/akamai-gitlab/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml b/akamai-gitlab/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml new file mode 100644 index 000000000..c90d10ff9 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml @@ -0,0 +1,45 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-toolkit-vault-tls + namespace: vault +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: k8s-toolkit-vault-tls + namespace: vault +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-view +subjects: + - kind: ServiceAccount + name: k8s-toolkit-vault-tls + namespace: vault +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '0' + name: wait-vault-tls + namespace: vault +spec: + template: + spec: + containers: + - args: + - wait-for + - certificate + - --namespace + - vault + - --name + - vault-tls + - --timeout-seconds + - '3600' + image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-vault-tls diff --git a/akamai-gitlab/templates/mgmt/components/argocd-appprojects/.gitkeep b/akamai-gitlab/templates/mgmt/components/argocd-appprojects/.gitkeep new file mode 100644 index 000000000..e69de29bb diff --git a/akamai-gitlab/templates/mgmt/components/argocd/argocd-cm.yaml b/akamai-gitlab/templates/mgmt/components/argocd/argocd-cm.yaml new file mode 100644 index 000000000..9e2433ea6 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/argocd/argocd-cm.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: argocd-cm +data: + url: 'https://argocd.' + oidc.config: | + name: Vault + issuer: https://vault./v1/identity/oidc/provider/kubefirst + clientID: $argocd-oidc-secret:clientId + clientSecret: $argocd-oidc-secret:clientSecret + requestedScopes: ["openid", "groups", "user", "profile", "email"] + requestedIDTokenClaims: {"groups": {"essential": true}} diff --git a/akamai-gitlab/templates/mgmt/components/argocd/argocd-cmd-params-cm.yaml b/akamai-gitlab/templates/mgmt/components/argocd/argocd-cmd-params-cm.yaml new file mode 100644 index 000000000..c3b99b953 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/argocd/argocd-cmd-params-cm.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: argocd-cmd-params-cm + labels: + app.kubernetes.io/name: argocd-cmd-params-cm + app.kubernetes.io/part-of: argocd +data: + # ssl terminated at ingress-nginx and forwarded + # to allow for cloudflare origin issuer certificates + server.insecure: 'true' diff --git a/akamai-gitlab/templates/mgmt/components/argocd/argocd-oidc-restart-job.yaml b/akamai-gitlab/templates/mgmt/components/argocd/argocd-oidc-restart-job.yaml new file mode 100644 index 000000000..472a6846d --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/argocd/argocd-oidc-restart-job.yaml @@ -0,0 +1,58 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: argocd-oidc-restart-job + namespace: argocd +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: argocd-oidc-restart-job + namespace: argocd +rules: + - apiGroups: + - apps + resources: + - deployments + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: argocd-oidc-restart-job + namespace: argocd +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: argocd-oidc-restart-job +subjects: + - kind: ServiceAccount + name: argocd-oidc-restart-job + namespace: argocd +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: argocd-oidc-restart-job + namespace: argocd +spec: + template: + spec: + containers: + - name: argocd-oidc-restart-job + image: public.ecr.aws/bitnami/kubectl:1.24 + command: + - /bin/sh + - -c + - echo restarting argocd-server in 15 seconds && sleep 15 && echo restarting && kubectl -n argocd get deployment/argocd-server -oyaml | kubectl -n argocd replace --force -f - + restartPolicy: OnFailure + serviceAccountName: argocd-oidc-restart-job + diff --git a/akamai-gitlab/templates/mgmt/components/argocd/argocd-ui-ingress.yaml b/akamai-gitlab/templates/mgmt/components/argocd/argocd-ui-ingress.yaml new file mode 100644 index 000000000..0f7d2f84b --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/argocd/argocd-ui-ingress.yaml @@ -0,0 +1,58 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: argocd-server-http-ingress + namespace: argocd + annotations: + nginx.ingress.kubernetes.io/force-ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" + + + + +spec: + ingressClassName: nginx + rules: + - http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: argocd-server + port: + name: http + host: argocd. + tls: + - hosts: + - argocd. + secretName: argocd-ingress-http +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: argocd-server-grpc-ingress + namespace: argocd + annotations: + nginx.ingress.kubernetes.io/backend-protocol: "GRPC" + + + + +spec: + ingressClassName: nginx + rules: + - http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: argocd-server + port: + name: https + host: grpc.argocd. + tls: + - hosts: + - grpc-argocd. + secretName: argocd-ingress-grpc \ No newline at end of file diff --git a/akamai-gitlab/templates/mgmt/components/argocd/cloudflareissuer.yaml b/akamai-gitlab/templates/mgmt/components/argocd/cloudflareissuer.yaml new file mode 100644 index 000000000..58ec02576 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/argocd/cloudflareissuer.yaml @@ -0,0 +1,31 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: cloudflare-creds + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "0" +spec: + target: + name: cloudflare-creds + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + data: + - remoteRef: + key: cloudflare + property: origin-ca-api-key + secretKey: origin-ca-api-key +--- +apiVersion: cert-manager.k8s.cloudflare.com/v1 +kind: OriginIssuer +metadata: + name: cloudflare-origin-issuer + namespace: argocd +spec: + requestType: OriginECC + auth: + serviceKeyRef: + key: origin-ca-api-key + name: cloudflare-creds diff --git a/akamai-gitlab/templates/mgmt/components/argocd/externalsecrets.yaml b/akamai-gitlab/templates/mgmt/components/argocd/externalsecrets.yaml new file mode 100644 index 000000000..e4a5ede28 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/argocd/externalsecrets.yaml @@ -0,0 +1,24 @@ +apiVersion: "external-secrets.io/v1alpha1" +kind: ExternalSecret +metadata: + name: argocd-oidc-secret + labels: + app.kubernetes.io/part-of: argocd +spec: + target: + name: argocd-oidc-secret + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + data: + - remoteRef: + conversionStrategy: Default + key: oidc/argocd + property: client_secret + secretKey: clientSecret + - remoteRef: + conversionStrategy: Default + key: oidc/argocd + property: client_id + secretKey: clientId diff --git a/akamai-gitlab/templates/mgmt/components/argocd/kustomization.yaml b/akamai-gitlab/templates/mgmt/components/argocd/kustomization.yaml new file mode 100644 index 000000000..362b89122 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/argocd/kustomization.yaml @@ -0,0 +1,18 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: argocd + +# To upgrade ArgoCD, increment the version here +# https://github.com/argoproj/argo-cd/tags +resources: + - github.com:kubefirst/manifests.git/argocd/cloud?ref=main + - argocd-ui-ingress.yaml + - externalsecrets.yaml + - argocd-oidc-restart-job.yaml + +patchesStrategicMerge: + - argocd-cm.yaml + - argocd-cmd-params-cm.yaml + +generatorOptions: + disableNameSuffixHash: true diff --git a/akamai-gitlab/templates/mgmt/components/atlantis/application.yaml b/akamai-gitlab/templates/mgmt/components/atlantis/application.yaml new file mode 100644 index 000000000..95812e153 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/atlantis/application.yaml @@ -0,0 +1,69 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: atlantis + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: https://runatlantis.github.io/helm-charts + chart: atlantis + targetRevision: 4.11.2 + helm: + values: |- + statefulSet: + annotations: + secret.reloader.stakater.com/reload: "atlantis-secrets" + atlantisUrl: https://atlantis. + orgAllowlist: + hidePrevPlanComments: true + serviceAccount: + create: false + mount: true + resources: + limits: + cpu: 400m + memory: 1Gi + requests: + cpu: 400m + memory: 512Mi + ingress: + enabled: true + annotations: + + + + + path: / + host: atlantis. + ingressClassName: "nginx" + tls: + - secretName: atlantis-tls + hosts: + - atlantis. + loadEnvFromSecrets: + - atlantis-secrets + repoConfig: | + --- + repos: + - id: + workflow: default + allowed_overrides: [apply_requirements] + apply_requirements: [mergeable] + destination: + server: 'https://kubernetes.default.svc' + namespace: atlantis + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/akamai-gitlab/templates/mgmt/components/atlantis/cloudflareissuer.yaml b/akamai-gitlab/templates/mgmt/components/atlantis/cloudflareissuer.yaml new file mode 100644 index 000000000..1926218e6 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/atlantis/cloudflareissuer.yaml @@ -0,0 +1,31 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: cloudflare-creds + namespace: atlantis + annotations: + argocd.argoproj.io/sync-wave: "0" +spec: + target: + name: cloudflare-creds + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + data: + - remoteRef: + key: cloudflare + property: origin-ca-api-key + secretKey: origin-ca-api-key +--- +apiVersion: cert-manager.k8s.cloudflare.com/v1 +kind: OriginIssuer +metadata: + name: cloudflare-origin-issuer + namespace: atlantis +spec: + requestType: OriginECC + auth: + serviceKeyRef: + key: origin-ca-api-key + name: cloudflare-creds diff --git a/akamai-gitlab/templates/mgmt/components/atlantis/externalsecret.yaml b/akamai-gitlab/templates/mgmt/components/atlantis/externalsecret.yaml new file mode 100644 index 000000000..334d4bf0a --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/atlantis/externalsecret.yaml @@ -0,0 +1,16 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: atlantis-secrets + annotations: + argocd.argoproj.io/sync-wave: '0' +spec: + target: + name: atlantis-secrets + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + dataFrom: + - extract: + key: /atlantis diff --git a/akamai-gitlab/templates/mgmt/components/atlantis/wait.yaml b/akamai-gitlab/templates/mgmt/components/atlantis/wait.yaml new file mode 100644 index 000000000..8ceb214fa --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/atlantis/wait.yaml @@ -0,0 +1,59 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-toolkit-atlantis + namespace: atlantis +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: k8s-toolkit-atlantis + namespace: atlantis +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: k8s-toolkit-atlantis + namespace: atlantis +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: k8s-toolkit-atlantis +subjects: + - kind: ServiceAccount + name: k8s-toolkit-atlantis + namespace: atlantis +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-atlantis + namespace: atlantis +spec: + template: + spec: + containers: + - args: + - wait-for + - statefulset + - --namespace + - atlantis + - --label + - app=atlantis + image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-atlantis diff --git a/akamai-gitlab/templates/mgmt/components/cert-issuers/clusterissuers.yaml b/akamai-gitlab/templates/mgmt/components/cert-issuers/clusterissuers.yaml new file mode 100644 index 000000000..8b67ffefe --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/cert-issuers/clusterissuers.yaml @@ -0,0 +1,29 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-staging +spec: + acme: + server: https://acme-staging-v02.api.letsencrypt.org/directory + email: + privateKeySecretRef: + name: letsencrypt-staging + solvers: + - http01: + ingress: + class: nginx +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-prod +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + email: + privateKeySecretRef: + name: letsencrypt-prod + solvers: + - http01: + ingress: + class: nginx diff --git a/akamai-gitlab/templates/mgmt/components/cert-manager/application.yaml b/akamai-gitlab/templates/mgmt/components/cert-manager/application.yaml new file mode 100644 index 000000000..ad0d96c83 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/cert-manager/application.yaml @@ -0,0 +1,28 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cert-manager + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: https://charts.jetstack.io + targetRevision: v1.14.4 + helm: + values: |- + serviceAccount: + create: true + name: cert-manager + installCRDs: true + chart: cert-manager + destination: + name: in-cluster + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/mgmt/components/cert-manager/wait-todo.yaml b/akamai-gitlab/templates/mgmt/components/cert-manager/wait-todo.yaml new file mode 100644 index 000000000..e69de29bb diff --git a/akamai-gitlab/templates/mgmt/components/chartmuseum/application.yaml b/akamai-gitlab/templates/mgmt/components/chartmuseum/application.yaml new file mode 100644 index 000000000..47cbbd645 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/chartmuseum/application.yaml @@ -0,0 +1,53 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: chartmuseum + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: https://chartmuseum.github.io/charts + targetRevision: 3.9.3 + helm: + values: |- + env: + open: + AUTH_ANONYMOUS_GET: true + STORAGE: amazon + STORAGE_AMAZON_BUCKET: + STORAGE_AMAZON_PREFIX: kubefirst-charts + STORAGE_AMAZON_REGION: us-east-1 + STORAGE_AMAZON_ENDPOINT: https://us-east-1.linodeobjects.com + DISABLE_API: false + existingSecret: chartmuseum-secrets + existingSecretMappings: + BASIC_AUTH_USER: BASIC_AUTH_USER + BASIC_AUTH_PASS: BASIC_AUTH_PASS + AWS_ACCESS_KEY_ID: AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY: AWS_SECRET_ACCESS_KEY + ingress: + enabled: true + pathType: "Prefix" + annotations: + + + + + hosts: + - name: chartmuseum. + path: / + tls: true + tlsSecret: chartmuseum-tls + ingressClassName: nginx + chart: chartmuseum + destination: + name: in-cluster + namespace: chartmuseum + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/mgmt/components/chartmuseum/cloudflareissuer.yaml b/akamai-gitlab/templates/mgmt/components/chartmuseum/cloudflareissuer.yaml new file mode 100644 index 000000000..64630f820 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/chartmuseum/cloudflareissuer.yaml @@ -0,0 +1,31 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: cloudflare-creds + namespace: chartmuseum + annotations: + argocd.argoproj.io/sync-wave: "0" +spec: + target: + name: cloudflare-creds + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + data: + - remoteRef: + key: cloudflare + property: origin-ca-api-key + secretKey: origin-ca-api-key +--- +apiVersion: cert-manager.k8s.cloudflare.com/v1 +kind: OriginIssuer +metadata: + name: cloudflare-origin-issuer + namespace: chartmuseum +spec: + requestType: OriginECC + auth: + serviceKeyRef: + key: origin-ca-api-key + name: cloudflare-creds diff --git a/akamai-gitlab/templates/mgmt/components/chartmuseum/externalsecret.yaml b/akamai-gitlab/templates/mgmt/components/chartmuseum/externalsecret.yaml new file mode 100644 index 000000000..020f387cf --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/chartmuseum/externalsecret.yaml @@ -0,0 +1,17 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: chartmuseum-secrets + namespace: chartmuseum + annotations: + argocd.argoproj.io/sync-wave: "0" +spec: + target: + name: chartmuseum-secrets + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + dataFrom: + - extract: + key: /chartmuseum diff --git a/akamai-gitlab/templates/mgmt/components/chartmuseum/wait.yaml b/akamai-gitlab/templates/mgmt/components/chartmuseum/wait.yaml new file mode 100644 index 000000000..131c8e5f3 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/chartmuseum/wait.yaml @@ -0,0 +1,59 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-toolkit-chartmuseum + namespace: chartmuseum +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: k8s-toolkit-chartmuseum + namespace: chartmuseum +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: k8s-toolkit-chartmuseum + namespace: chartmuseum +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: k8s-toolkit-chartmuseum +subjects: + - kind: ServiceAccount + name: k8s-toolkit-chartmuseum + namespace: chartmuseum +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-chartmuseum + namespace: chartmuseum +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - chartmuseum + - --label + - app.kubernetes.io/name=chartmuseum + image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-chartmuseum diff --git a/akamai-gitlab/templates/mgmt/components/cluster-secret-store/clustersecretstore.yaml b/akamai-gitlab/templates/mgmt/components/cluster-secret-store/clustersecretstore.yaml new file mode 100644 index 000000000..dc3995cc2 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/cluster-secret-store/clustersecretstore.yaml @@ -0,0 +1,29 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ClusterSecretStore +metadata: + name: vault-kv-secret + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + provider: + vault: + server: 'http://vault.vault.svc:8200' + # Path is the mount path of the Vault KV backend endpoint + path: 'secret' + version: 'v2' + auth: + # points to a secret that contains a vault token + # https://www.vaultproject.io/docs/auth/token + tokenSecretRef: + name: "vault-secrets" + namespace: external-secrets-operator + key: "vault-token" + # auth: + # kubernetes: + # # Path where the Kubernetes authentication backend is mounted in Vault + # mountPath: 'kubernetes/kubefirst' + # # A required field containing the Vault Role to assume. + # role: 'external-secrets' + # serviceAccountRef: + # name: 'external-secrets' + # namespace: 'external-secrets-operator' diff --git a/akamai-gitlab/templates/mgmt/components/cluster-secret-store/wait.yaml b/akamai-gitlab/templates/mgmt/components/cluster-secret-store/wait.yaml new file mode 100644 index 000000000..26bd264ed --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/cluster-secret-store/wait.yaml @@ -0,0 +1,40 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: eso-clustersecretstore + namespace: external-secrets-operator +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: eso-clustersecretstore + namespace: external-secrets-operator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: external-secrets-operator-view +subjects: +- kind: ServiceAccount + name: eso-clustersecretstore + namespace: external-secrets-operator +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: "20" + name: wait-vault-kv-secret + namespace: external-secrets-operator +spec: + template: + spec: + containers: + - name: wait + image: public.ecr.aws/bitnami/kubectl:1.24 + command: + - /bin/sh + - -c + - | + while ! kubectl get clustersecretstore/vault-kv-secret --namespace external-secrets-operator; do echo "waiting for external secrets store to be valid, sleeping 5 seconds"; sleep 5; done + restartPolicy: OnFailure + serviceAccountName: eso-clustersecretstore \ No newline at end of file diff --git a/akamai-gitlab/templates/mgmt/components/clusters/.gitkeep b/akamai-gitlab/templates/mgmt/components/clusters/.gitkeep new file mode 100644 index 000000000..e69de29bb diff --git a/akamai-gitlab/templates/mgmt/components/crossplane/crossplane-system.yaml b/akamai-gitlab/templates/mgmt/components/crossplane/crossplane-system.yaml new file mode 100644 index 000000000..55e14e582 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/crossplane/crossplane-system.yaml @@ -0,0 +1,25 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: crossplane-system + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: default + source: + repoURL: + path: registry/clusters//components/crossplane/crossplane-system + targetRevision: HEAD + destination: + name: in-cluster + namespace: crossplane-system + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - Replace=true diff --git a/akamai-gitlab/templates/mgmt/components/crossplane/crossplane-system/crossplane-secrets.yaml b/akamai-gitlab/templates/mgmt/components/crossplane/crossplane-system/crossplane-secrets.yaml new file mode 100644 index 000000000..72e3d807f --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/crossplane/crossplane-system/crossplane-secrets.yaml @@ -0,0 +1,51 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + annotations: + argocd.argoproj.io/sync-wave: "0" + name: crossplane-secrets + namespace: crossplane-system +spec: + dataFrom: + - extract: + conversionStrategy: Default + decodingStrategy: None + key: /crossplane + refreshInterval: 10s + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + target: + creationPolicy: Owner + deletionPolicy: Retain + name: crossplane-secrets +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: git-credentials + annotations: + argocd.argoproj.io/sync-wave: "0" +spec: + target: + name: git-credentials + template: + engineVersion: v2 + data: + creds: | + https://{{ .username }}:{{ .password }}@github.com + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + data: + - remoteRef: + key: crossplane + property: username + conversionStrategy: Default + secretKey: username + - remoteRef: + key: crossplane + property: password + conversionStrategy: Default + secretKey: password \ No newline at end of file diff --git a/akamai-gitlab/templates/mgmt/components/crossplane/crossplane-system/crossplane-system.yaml b/akamai-gitlab/templates/mgmt/components/crossplane/crossplane-system/crossplane-system.yaml new file mode 100644 index 000000000..598920503 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/crossplane/crossplane-system/crossplane-system.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: crossplane + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "10" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: default + destination: + name: in-cluster + namespace: crossplane-system + source: + repoURL: https://charts.crossplane.io/stable + chart: crossplane + targetRevision: 1.12.2 + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true \ No newline at end of file diff --git a/akamai-gitlab/templates/mgmt/components/crossplane/provider.yaml b/akamai-gitlab/templates/mgmt/components/crossplane/provider.yaml new file mode 100644 index 000000000..aad40ccc2 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/crossplane/provider.yaml @@ -0,0 +1,25 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: crossplane-provider + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '20' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: default + source: + repoURL: + path: registry/clusters//components/crossplane/provider + targetRevision: HEAD + destination: + name: in-cluster + namespace: crossplane-system + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - Replace=true diff --git a/akamai-gitlab/templates/mgmt/components/crossplane/provider/controllerconfig.yaml b/akamai-gitlab/templates/mgmt/components/crossplane/provider/controllerconfig.yaml new file mode 100644 index 000000000..c4636b1ba --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/crossplane/provider/controllerconfig.yaml @@ -0,0 +1,15 @@ +apiVersion: pkg.crossplane.io/v1alpha1 +kind: ControllerConfig +metadata: + annotations: + argocd.argoproj.io/sync-wave: '10' + labels: + app: crossplane-provider-terraform + name: terraform-config +spec: + args: + - -d + - --poll=2m + envFrom: + - secretRef: + name: crossplane-secrets diff --git a/akamai-gitlab/templates/mgmt/components/crossplane/provider/terraform-provider.yaml b/akamai-gitlab/templates/mgmt/components/crossplane/provider/terraform-provider.yaml new file mode 100644 index 000000000..6403c68ab --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/crossplane/provider/terraform-provider.yaml @@ -0,0 +1,16 @@ +apiVersion: pkg.crossplane.io/v1 +kind: Provider +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: crossplane-provider-terraform +spec: + controllerConfigRef: + name: terraform-config + ignoreCrossplaneConstraints: false + package: xpkg.upbound.io/upbound/provider-terraform:v0.12.0 + packagePullPolicy: IfNotPresent + revisionActivationPolicy: Automatic + revisionHistoryLimit: 1 + skipDependencyResolution: false + diff --git a/akamai-gitlab/templates/mgmt/components/external-dns/application.yaml b/akamai-gitlab/templates/mgmt/components/external-dns/application.yaml new file mode 100644 index 000000000..e9b5624df --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/external-dns/application.yaml @@ -0,0 +1,42 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: external-dns + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: https://kubernetes-sigs.github.io/external-dns + targetRevision: 1.14.4 + helm: + releaseName: external-dns + values: | + image: + repository: registry.k8s.io/external-dns/external-dns + tag: "v0.13.2" + serviceAccount: + create: true + name: external-dns + provider: + sources: + - ingress + domainFilters: + - + env: + - name: + valueFrom: + secretKeyRef: + name: external-dns-secrets + key: token + chart: external-dns + destination: + name: in-cluster + namespace: external-dns + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/mgmt/components/external-dns/wait.yaml b/akamai-gitlab/templates/mgmt/components/external-dns/wait.yaml new file mode 100644 index 000000000..a42e75f26 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/external-dns/wait.yaml @@ -0,0 +1,59 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: kubernetes-toolkit + namespace: external-dns +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: kubernetes-toolkit + namespace: external-dns +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: kubernetes-toolkit + namespace: external-dns +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: kubernetes-toolkit +subjects: + - kind: ServiceAccount + name: kubernetes-toolkit + namespace: external-dns +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: kubernetes-toolkit + namespace: external-dns +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - external-dns + - --label + - app.kubernetes.io/name=external-dns + image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8 + imagePullPolicy: IfNotPresent + name: kubernetes-toolkit + restartPolicy: OnFailure + serviceAccountName: kubernetes-toolkit diff --git a/akamai-gitlab/templates/mgmt/components/external-secrets-operator/external-secrets-operator.yaml b/akamai-gitlab/templates/mgmt/components/external-secrets-operator/external-secrets-operator.yaml new file mode 100644 index 000000000..1ccada0a7 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/external-secrets-operator/external-secrets-operator.yaml @@ -0,0 +1,54 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: external-secrets-operator + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: https://charts.external-secrets.io + targetRevision: 0.8.1 + helm: + values: |- + serviceAccount: + create: false + name: external-secrets + chart: external-secrets + destination: + name: in-cluster + namespace: external-secrets-operator + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - RespectIgnoreDifferences=true + ignoreDifferences: + - group: apiextensions.k8s.io + kind: CustomResourceDefinition + jqPathExpressions: + - .spec.conversion.webhook.clientConfig.caBundle + - .spec.conversion.webhook.clientConfig.service.name + - .spec.conversion.webhook.clientConfig.service.namespace + - group: admissionregistration.k8s.io + kind: ValidatingWebhookConfiguration + jqPathExpressions: + - .webhooks[]?.clientConfig.caBundle +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: eso-kubernetes-external-secrets-auth + annotations: + argocd.argoproj.io/sync-wave: '40' +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: 'system:auth-delegator' +subjects: + - kind: ServiceAccount + name: external-secrets + namespace: external-secrets-operator diff --git a/akamai-gitlab/templates/mgmt/components/external-secrets-operator/wait.yaml b/akamai-gitlab/templates/mgmt/components/external-secrets-operator/wait.yaml new file mode 100644 index 000000000..7352d764c --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/external-secrets-operator/wait.yaml @@ -0,0 +1,107 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-toolkit-eso + namespace: external-secrets-operator +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: k8s-toolkit-eso + namespace: external-secrets-operator +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: k8s-toolkit-eso + namespace: external-secrets-operator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: k8s-toolkit-eso +subjects: + - kind: ServiceAccount + name: k8s-toolkit-eso + namespace: external-secrets-operator +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-external-secrets-cert-controller + namespace: external-secrets-operator +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - external-secrets-operator + - --label + - app.kubernetes.io/name=external-secrets-cert-controller + image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-eso +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-external-secrets + namespace: external-secrets-operator +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - external-secrets-operator + - --label + - app.kubernetes.io/name=external-secrets + image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-eso +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-external-secrets-webhook + namespace: external-secrets-operator +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - external-secrets-operator + - --label + - app.kubernetes.io/name=external-secrets-webhook + image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-eso diff --git a/akamai-gitlab/templates/mgmt/components/github-runner/runnerdeployment.yaml b/akamai-gitlab/templates/mgmt/components/github-runner/runnerdeployment.yaml new file mode 100644 index 000000000..cce93eb20 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/github-runner/runnerdeployment.yaml @@ -0,0 +1,15 @@ +apiVersion: actions.summerwind.dev/v1alpha1 +kind: RunnerDeployment +metadata: + name: actions-runner + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + replicas: 2 + template: + spec: + organization: + image: summerwind/actions-runner-dind + serviceAccountName: github-runner + dockerdWithinRunnerContainer: true + automountServiceAccountToken: true diff --git a/akamai-gitlab/templates/mgmt/components/github-runner/serviceaccount.yaml b/akamai-gitlab/templates/mgmt/components/github-runner/serviceaccount.yaml new file mode 100644 index 000000000..6e2d55674 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/github-runner/serviceaccount.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: github-runner + namespace: github-runner + annotations: + argocd.argoproj.io/sync-wave: '0' diff --git a/akamai-gitlab/templates/mgmt/components/ingress-nginx/application.yaml b/akamai-gitlab/templates/mgmt/components/ingress-nginx/application.yaml new file mode 100644 index 000000000..bfb81ad38 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/ingress-nginx/application.yaml @@ -0,0 +1,35 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: ingress-nginx + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: https://kubernetes.github.io/ingress-nginx + targetRevision: 4.10.0 + helm: + values: |- + controller: + publishService: + enabled: true + service: + annotations: + service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" + service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "60" + extraArgs: + enable-ssl-passthrough: true + chart: ingress-nginx + destination: + name: in-cluster + namespace: ingress-nginx + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/mgmt/components/ingress-nginx/wait.yaml b/akamai-gitlab/templates/mgmt/components/ingress-nginx/wait.yaml new file mode 100644 index 000000000..4e4b41ce9 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/ingress-nginx/wait.yaml @@ -0,0 +1,59 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-toolkit-ingress-nginx + namespace: ingress-nginx +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: k8s-toolkit-ingress-nginx + namespace: ingress-nginx +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: k8s-toolkit-ingress-nginx + namespace: ingress-nginx +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: k8s-toolkit-ingress-nginx +subjects: + - kind: ServiceAccount + name: k8s-toolkit-ingress-nginx + namespace: ingress-nginx +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-ingress-nginx + namespace: ingress-nginx +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - ingress-nginx + - --label + - app.kubernetes.io/name=ingress-nginx + image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-ingress-nginx diff --git a/akamai-gitlab/templates/mgmt/components/kubefirst/cloudflareissuer.yaml b/akamai-gitlab/templates/mgmt/components/kubefirst/cloudflareissuer.yaml new file mode 100644 index 000000000..a9ad3e28c --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/kubefirst/cloudflareissuer.yaml @@ -0,0 +1,31 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: cloudflare-creds + namespace: kubefirst + annotations: + argocd.argoproj.io/sync-wave: "0" +spec: + target: + name: cloudflare-creds + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + data: + - remoteRef: + key: cloudflare + property: origin-ca-api-key + secretKey: origin-ca-api-key +--- +apiVersion: cert-manager.k8s.cloudflare.com/v1 +kind: OriginIssuer +metadata: + name: cloudflare-origin-issuer + namespace: kubefirst +spec: + requestType: OriginECC + auth: + serviceKeyRef: + key: origin-ca-api-key + name: cloudflare-creds diff --git a/akamai-gitlab/templates/mgmt/components/kubefirst/console.yaml b/akamai-gitlab/templates/mgmt/components/kubefirst/console.yaml new file mode 100644 index 000000000..a7a0e7cc9 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/kubefirst/console.yaml @@ -0,0 +1,72 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: kubefirst + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "10" +spec: + project: default + source: + repoURL: https://charts.kubefirst.com + targetRevision: 2.4.14-rc22 + chart: kubefirst + helm: + values: |- + global: + cloudProvider: "" + clusterId: "" + clusterType: "" + domainName: "" + gitProvider: "" + installMethod: "helm" + kubefirstClient: "" + kubefirstTeam: "" + kubefirstTeamInfo: "" + kubefirstVersion: "" + useTelemetry: "" + kubefirst-api-ee: + extraEnv: + IN_CLUSTER: "true" + kubefirst-api: + isClusterZero: "false" + extraEnv: + IN_CLUSTER: "true" + CLUSTER_NAME: "" + ENTERPRISE_API_URL: "http://kubefirst-kubefirst-api-ee.kubefirst.svc.cluster.local" + console: + isClusterZero: "false" + domain: "" + extraEnvSecrets: + CLIENT_ID: + name: kubefirst-console-secrets + key: client_id + SECRET_ID: + name: kubefirst-console-secrets + key: client_secret + ingress: + enabled: "true" + className: nginx + annotations: + + + + + hosts: + - host: kubefirst. + paths: + - path: / + pathType: Prefix + tls: + - secretName: kubefirst-tls + hosts: + - kubefirst. + destination: + name: in-cluster + namespace: kubefirst + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/mgmt/components/kubefirst/externalsecret.yaml b/akamai-gitlab/templates/mgmt/components/kubefirst/externalsecret.yaml new file mode 100644 index 000000000..ffe387fe6 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/kubefirst/externalsecret.yaml @@ -0,0 +1,17 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: kubefirst-console-secrets + namespace: kubefirst + annotations: + argocd.argoproj.io/sync-wave: '0' +spec: + dataFrom: + - extract: + key: /oidc/console + refreshInterval: 10s + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + target: + name: kubefirst-console-secrets \ No newline at end of file diff --git a/akamai-gitlab/templates/mgmt/components/kubefirst/wait.yaml b/akamai-gitlab/templates/mgmt/components/kubefirst/wait.yaml new file mode 100644 index 000000000..2ca1ed176 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/kubefirst/wait.yaml @@ -0,0 +1,59 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-toolkit-console + namespace: kubefirst +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: k8s-toolkit-console + namespace: kubefirst +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: k8s-toolkit-console + namespace: kubefirst +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: k8s-toolkit-console +subjects: + - kind: ServiceAccount + name: k8s-toolkit-console + namespace: kubefirst +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-console + namespace: kubefirst +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - kubefirst + - --label + - app.kubernetes.io/name=console + image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-console diff --git a/akamai-gitlab/templates/mgmt/components/nginx-apex/config-map.yaml b/akamai-gitlab/templates/mgmt/components/nginx-apex/config-map.yaml new file mode 100644 index 000000000..a937cee8f --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/nginx-apex/config-map.yaml @@ -0,0 +1,109 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: index-html-configmap + namespace: default +data: + index.html: | + + + + + + + Kubefirst + + + + + + + +
+
+ +
+
+

Hello World!

+

+ Kubefirst has added this apex site at the domain’s apex to allow the Google bots to safely + onboard the cluster’s new domain. +

+

+ You can adjust this site in your new + kubefirst gitops repository. +

+

Learn more about this apex site.

+
+
+ + + \ No newline at end of file diff --git a/akamai-gitlab/templates/mgmt/components/nginx-apex/ingress.yaml b/akamai-gitlab/templates/mgmt/components/nginx-apex/ingress.yaml new file mode 100644 index 000000000..0b1f951b9 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/nginx-apex/ingress.yaml @@ -0,0 +1,30 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: nginx-apex + namespace: default + labels: + app.kubernetes.io/name: nginx + app.kubernetes.io/instance: nginx + annotations: + kubernetes.io/ingress.class: nginx + + + + +spec: + rules: + - host: + http: + paths: + - path: / + pathType: ImplementationSpecific + backend: + service: + name: nginx + port: + name: http + tls: + - hosts: + - + secretName: nginx-apex-tls diff --git a/akamai-gitlab/templates/mgmt/components/nginx-apex/kustomization.yaml b/akamai-gitlab/templates/mgmt/components/nginx-apex/kustomization.yaml new file mode 100644 index 000000000..512cc53be --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/nginx-apex/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: argocd + +resources: + - github.com:kubefirst/manifests.git/nginx/apex?ref=main + - ingress.yaml + - config-map.yaml diff --git a/akamai-gitlab/templates/mgmt/components/nginx-apex/wait.yaml b/akamai-gitlab/templates/mgmt/components/nginx-apex/wait.yaml new file mode 100644 index 000000000..c146d3562 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/nginx-apex/wait.yaml @@ -0,0 +1,59 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-toolkit-nginx-apex + namespace: nginx-apex +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: k8s-toolkit-nginx-apex + namespace: nginx-apex +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: k8s-toolkit-nginx-apex + namespace: nginx-apex +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: k8s-toolkit-nginx-apex +subjects: + - kind: ServiceAccount + name: k8s-toolkit-nginx-apex + namespace: nginx-apex +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-nginx-apex + namespace: nginx-apex +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - nginx-apex + - --label + - app.kubernetes.io/name=nginx-apex + image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-nginx-apex diff --git a/akamai-gitlab/templates/mgmt/components/reloader/application.yaml b/akamai-gitlab/templates/mgmt/components/reloader/application.yaml new file mode 100644 index 000000000..08dc04cdb --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/reloader/application.yaml @@ -0,0 +1,31 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: reloader + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: 'https://stakater.github.io/stakater-charts' + targetRevision: v1.0.10 + chart: reloader + helm: + values: |- + ignoreSecrets: false + destination: + server: 'https://kubernetes.default.svc' + namespace: reloader + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/akamai-gitlab/templates/mgmt/components/reloader/wait.yaml b/akamai-gitlab/templates/mgmt/components/reloader/wait.yaml new file mode 100644 index 000000000..1130124f4 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/reloader/wait.yaml @@ -0,0 +1,59 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-toolkit-reloader + namespace: reloader +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: k8s-toolkit-reloader + namespace: reloader +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: k8s-toolkit-reloader + namespace: reloader +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: k8s-toolkit-reloader +subjects: + - kind: ServiceAccount + name: k8s-toolkit-reloader + namespace: reloader +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-reloader + namespace: reloader +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - reloader + - --label + - app=reloader-reloader + image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-reloader diff --git a/akamai-gitlab/templates/mgmt/components/secrets/externalsecret.yaml b/akamai-gitlab/templates/mgmt/components/secrets/externalsecret.yaml new file mode 100644 index 000000000..ce0d29df5 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/secrets/externalsecret.yaml @@ -0,0 +1,15 @@ +# apiVersion: external-secrets.io/v1beta1 +# kind: ExternalSecret +# metadata: +# name: external-dns-secrets +# namespace: external-dns +# spec: +# target: +# name: external-dns-secrets +# secretStoreRef: +# kind: ClusterSecretStore +# name: vault-kv-secret +# refreshInterval: 10s +# dataFrom: +# - extract: +# key: /external-dns diff --git a/akamai-gitlab/templates/mgmt/components/vault/application.yaml b/akamai-gitlab/templates/mgmt/components/vault/application.yaml new file mode 100644 index 000000000..b36ebd549 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/vault/application.yaml @@ -0,0 +1,71 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: vault + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: https://helm.releases.hashicorp.com + targetRevision: 0.22.0 + helm: + values: |- + server: + affinity: "" + ha: + enabled: true + replicas: 3 + raft: + enabled: true + setNodeId: true + config: | + ui = true + listener "tcp" { + tls_disable = 1 + address = "[::]:8200" + cluster_address = "[::]:8201" + } + storage "raft" { + path = "/vault/data" + } + service_registration "kubernetes" {} + ingress: + enabled: true + annotations: + + + + + ingressClassName: "nginx" + pathType: Prefix + # When HA mode is enabled and K8s service registration is being used, + # configure the ingress to point to the Vault active service. + # activeService: true + hosts: + - host: vault. + tls: + - secretName: vault-tls + hosts: + - vault. + ui: + enabled: true + serviceType: "ClusterIP" + serviceNodePort: null + externalPort: 8200 + chart: vault + destination: + name: in-cluster + namespace: vault + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + ignoreDifferences: + - group: admissionregistration.k8s.io + kind: MutatingWebhookConfiguration + jsonPointers: + - /webhooks diff --git a/akamai-gitlab/templates/mgmt/components/vault/cloudflareissuer.yaml b/akamai-gitlab/templates/mgmt/components/vault/cloudflareissuer.yaml new file mode 100644 index 000000000..f5ea945b7 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/vault/cloudflareissuer.yaml @@ -0,0 +1,31 @@ +# apiVersion: external-secrets.io/v1beta1 +# kind: ExternalSecret +# metadata: +# name: cloudflare-creds +# namespace: vault +# annotations: +# argocd.argoproj.io/sync-wave: "0" +# spec: +# target: +# name: cloudflare-creds +# secretStoreRef: +# kind: ClusterSecretStore +# name: vault-kv-secret +# refreshInterval: 10s +# data: +# - remoteRef: +# key: cloudflare +# property: origin-ca-api-key +# secretKey: origin-ca-api-key +# --- +apiVersion: cert-manager.k8s.cloudflare.com/v1 +kind: OriginIssuer +metadata: + name: cloudflare-origin-issuer + namespace: vault +spec: + requestType: OriginECC + auth: + serviceKeyRef: + key: origin-ca-api-key + name: cloudflare-creds diff --git a/akamai-gitlab/templates/mgmt/components/vault/wait.yaml b/akamai-gitlab/templates/mgmt/components/vault/wait.yaml new file mode 100644 index 000000000..5b40231bc --- /dev/null +++ b/akamai-gitlab/templates/mgmt/components/vault/wait.yaml @@ -0,0 +1,87 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-toolkit + namespace: vault +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: k8s-toolkit + namespace: vault +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list + - apiGroups: + - '' + resources: + - secrets + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: k8s-toolkit + namespace: vault +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: k8s-toolkit +subjects: + - kind: ServiceAccount + name: k8s-toolkit + namespace: vault +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-vault-unseal + namespace: vault +spec: + template: + spec: + containers: + - args: + - wait-for + - vault-unseal + image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '21' + name: wait-vault-init-complete + namespace: vault +spec: + template: + spec: + containers: + - args: + - wait-for + - vault-init-complete + image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8 + imagePullPolicy: IfNotPresent + name: wait + env: + - name: VAULT_TOKEN + valueFrom: + secretKeyRef: + name: vault-unseal-secret + key: root-token + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit diff --git a/akamai-gitlab/templates/mgmt/crossplane.yaml b/akamai-gitlab/templates/mgmt/crossplane.yaml new file mode 100644 index 000000000..2b750e840 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/crossplane.yaml @@ -0,0 +1,25 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: crossplane-components + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '60' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: default + source: + repoURL: + path: registry/clusters//components/crossplane + targetRevision: HEAD + destination: + name: in-cluster + namespace: crossplane-system + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - Replace=true diff --git a/akamai-gitlab/templates/mgmt/development.yaml b/akamai-gitlab/templates/mgmt/development.yaml new file mode 100644 index 000000000..430831071 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/development.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: development + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '60' +spec: + project: default + source: + repoURL: + path: registry/environments/development + targetRevision: HEAD + destination: + name: in-cluster + namespace: development + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/mgmt/external-dns.yaml b/akamai-gitlab/templates/mgmt/external-dns.yaml new file mode 100644 index 000000000..198f60a7d --- /dev/null +++ b/akamai-gitlab/templates/mgmt/external-dns.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: external-dns-components + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: + path: registry/clusters//components/external-dns + targetRevision: HEAD + destination: + name: in-cluster + namespace: external-dns + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/mgmt/external-secrets-operator.yaml b/akamai-gitlab/templates/mgmt/external-secrets-operator.yaml new file mode 100644 index 000000000..e0cbe9eca --- /dev/null +++ b/akamai-gitlab/templates/mgmt/external-secrets-operator.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: external-secrets-operator-components + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: default + source: + repoURL: + path: registry/clusters//components/external-secrets-operator + targetRevision: HEAD + destination: + name: in-cluster + namespace: external-secrets-operator + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/mgmt/github-runner.yaml b/akamai-gitlab/templates/mgmt/github-runner.yaml new file mode 100644 index 000000000..6478d6846 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/github-runner.yaml @@ -0,0 +1,31 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: github-runner-components + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '60' +spec: + project: default + source: + repoURL: + path: registry/clusters//components/github-runner + targetRevision: HEAD + destination: + name: in-cluster + namespace: github-runner + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ApplyOutOfSyncOnly=true + - Replace=true + - PruneLast=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/akamai-gitlab/templates/mgmt/ingress-nginx.yaml b/akamai-gitlab/templates/mgmt/ingress-nginx.yaml new file mode 100644 index 000000000..aba47a9a4 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/ingress-nginx.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: ingress-nginx-components + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: + path: registry/clusters//components/ingress-nginx + targetRevision: HEAD + destination: + name: in-cluster + namespace: ingress-nginx + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/mgmt/kubefirst.yaml b/akamai-gitlab/templates/mgmt/kubefirst.yaml new file mode 100644 index 000000000..41dbd85a9 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/kubefirst.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: kubefirst-components + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '70' +spec: + project: default + source: + repoURL: + path: registry/clusters//components/kubefirst + targetRevision: HEAD + destination: + name: in-cluster + namespace: kubefirst + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/mgmt/nginx-apex.yaml b/akamai-gitlab/templates/mgmt/nginx-apex.yaml new file mode 100644 index 000000000..4c2772a73 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/nginx-apex.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + finalizers: + - resources-finalizer.argocd.argoproj.io + name: nginx-apex-components + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '11' +spec: + project: default + source: + repoURL: + path: registry/clusters//components/nginx-apex + targetRevision: HEAD + destination: + name: in-cluster + namespace: default + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/mgmt/production.yaml b/akamai-gitlab/templates/mgmt/production.yaml new file mode 100644 index 000000000..0751a6496 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/production.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: production + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '60' +spec: + project: default + source: + repoURL: + path: registry/environments/production + targetRevision: HEAD + destination: + name: in-cluster + namespace: production + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/mgmt/registry.yaml b/akamai-gitlab/templates/mgmt/registry.yaml new file mode 100644 index 000000000..74b3224d8 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/registry.yaml @@ -0,0 +1,30 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: registry + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '1001' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: default + source: + repoURL: + path: registry/clusters/ + targetRevision: HEAD + destination: + server: https://kubernetes.default.svc + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/akamai-gitlab/templates/mgmt/reloader.yaml b/akamai-gitlab/templates/mgmt/reloader.yaml new file mode 100644 index 000000000..84503375c --- /dev/null +++ b/akamai-gitlab/templates/mgmt/reloader.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: reloader-components + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '60' +spec: + project: default + source: + repoURL: + path: registry/clusters//components/reloader + targetRevision: HEAD + destination: + name: in-cluster + namespace: reloader + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/mgmt/secrets.yaml b/akamai-gitlab/templates/mgmt/secrets.yaml new file mode 100644 index 000000000..3cd7d3c35 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/secrets.yaml @@ -0,0 +1,25 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: secrets + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '120' +spec: + project: default + source: + repoURL: + path: registry/clusters//components/secrets + targetRevision: HEAD + destination: + server: https://kubernetes.default.svc + syncPolicy: + automated: + prune: true + selfHeal: true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/akamai-gitlab/templates/mgmt/staging.yaml b/akamai-gitlab/templates/mgmt/staging.yaml new file mode 100644 index 000000000..c75c684a6 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/staging.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: staging + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '60' +spec: + project: default + source: + repoURL: + path: registry/environments/staging + targetRevision: HEAD + destination: + name: in-cluster + namespace: staging + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/mgmt/vault.yaml b/akamai-gitlab/templates/mgmt/vault.yaml new file mode 100644 index 000000000..31220c4f3 --- /dev/null +++ b/akamai-gitlab/templates/mgmt/vault.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: vault-components + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '20' +spec: + project: default + source: + repoURL: + path: registry/clusters//components/vault + targetRevision: HEAD + destination: + name: in-cluster + namespace: vault + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/workload-cluster/0-providerconfig.yaml b/akamai-gitlab/templates/workload-cluster/0-providerconfig.yaml new file mode 100644 index 000000000..cac4df032 --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/0-providerconfig.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -provider-config + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '0' +spec: + project: default + source: + repoURL: + path: registry/clusters//provider-config + targetRevision: HEAD + destination: + name: in-cluster + namespace: crossplane-system + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/workload-cluster/10-infrastructure.yaml b/akamai-gitlab/templates/workload-cluster/10-infrastructure.yaml new file mode 100644 index 000000000..5e2a0defc --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/10-infrastructure.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -infrastructure + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: + path: registry/clusters//infrastructure + targetRevision: HEAD + destination: + name: in-cluster + namespace: + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/workload-cluster/20-argocd-connection.yaml b/akamai-gitlab/templates/workload-cluster/20-argocd-connection.yaml new file mode 100644 index 000000000..a8536ee9a --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/20-argocd-connection.yaml @@ -0,0 +1,63 @@ +apiVersion: "external-secrets.io/v1beta1" +kind: ExternalSecret +metadata: + name: + annotations: + argocd.argoproj.io/sync-wave: '20' + labels: + app.kubernetes.io/part-of: argocd +spec: + target: + name: + template: + metadata: + labels: + argocd.argoproj.io/secret-type: cluster + engineVersion: v2 + data: + name: "{{ .cluster_name }}" + server: "{{ .host }}" + clusterResources: "true" + config: | + { + "bearerToken": "{{ .argocd_manager_sa_token }}", + "tlsClientConfig": { + "caData": "{{ .cluster_ca_certificate | b64enc }}", + "certData": "{{ .client_certificate | b64enc }}", + "insecure": false, + "keyData": "{{ .client_key | b64enc }}" + } + } + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + data: + - remoteRef: + key: clusters/ + property: argocd_manager_sa_token + secretKey: argocd_manager_sa_token + - remoteRef: + key: clusters/ + property: host + secretKey: host + - remoteRef: + key: clusters/ + property: cluster_name + secretKey: cluster_name + - remoteRef: + key: clusters/ + property: cluster_ca_certificate + conversionStrategy: Default + secretKey: cluster_ca_certificate + - remoteRef: + key: clusters/ + property: client_certificate + conversionStrategy: Default + secretKey: client_certificate + - remoteRef: + key: clusters/ + property: client_key + conversionStrategy: Default + secretKey: client_key + diff --git a/akamai-gitlab/templates/workload-cluster/30-cert-manager.yaml b/akamai-gitlab/templates/workload-cluster/30-cert-manager.yaml new file mode 100644 index 000000000..c5d4cb25d --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/30-cert-manager.yaml @@ -0,0 +1,30 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -cert-manager + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: + source: + repoURL: https://charts.jetstack.io + targetRevision: v1.14.4 + helm: + values: |- + serviceAccount: + create: true + name: cert-manager + installCRDs: true + chart: cert-manager + destination: + name: + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/workload-cluster/30-external-dns.yaml b/akamai-gitlab/templates/workload-cluster/30-external-dns.yaml new file mode 100644 index 000000000..ec20e60b4 --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/30-external-dns.yaml @@ -0,0 +1,42 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -external-dns + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: + source: + repoURL: https://kubernetes-sigs.github.io/external-dns + targetRevision: 1.14.4 + helm: + releaseName: external-dns + values: | + image: + repository: registry.k8s.io/external-dns/external-dns + tag: "v0.13.2" + serviceAccount: + create: true + name: external-dns + provider: + sources: + - ingress + domainFilters: + - + env: + - name: + valueFrom: + secretKeyRef: + name: external-dns-secrets + key: token + chart: external-dns + destination: + name: + namespace: external-dns + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/workload-cluster/30-external-secrets-operator.yaml b/akamai-gitlab/templates/workload-cluster/30-external-secrets-operator.yaml new file mode 100644 index 000000000..c09c2bc73 --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/30-external-secrets-operator.yaml @@ -0,0 +1,71 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -external-secrets-operator + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: + source: + repoURL: https://charts.external-secrets.io + targetRevision: 0.8.1 + helm: + values: |- + serviceAccount: + create: false + name: external-secrets + chart: external-secrets + destination: + name: + namespace: external-secrets-operator + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - RespectIgnoreDifferences=true + ignoreDifferences: + - group: apiextensions.k8s.io + kind: CustomResourceDefinition + jqPathExpressions: + - .spec.conversion.webhook.clientConfig.caBundle + - .spec.conversion.webhook.clientConfig.service.name + - .spec.conversion.webhook.clientConfig.service.namespace + - group: admissionregistration.k8s.io + kind: ValidatingWebhookConfiguration + jqPathExpressions: + - .webhooks[]?.clientConfig.caBundle +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: -eso-kubernetes-external-secrets-auth + annotations: + argocd.argoproj.io/sync-wave: '40' +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: 'system:auth-delegator' +subjects: + - kind: ServiceAccount + name: external-secrets + namespace: external-secrets-operator +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: -eso-kubernetes-external-secrets-auth2 + annotations: + argocd.argoproj.io/sync-wave: '40' +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: 'cluster-admin' +subjects: + - kind: ServiceAccount + name: external-secrets + namespace: external-secrets-operator diff --git a/akamai-gitlab/templates/workload-cluster/30-ingress-nginx.yaml b/akamai-gitlab/templates/workload-cluster/30-ingress-nginx.yaml new file mode 100644 index 000000000..7221cd66c --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/30-ingress-nginx.yaml @@ -0,0 +1,38 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -ingress-nginx + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: + source: + repoURL: https://kubernetes.github.io/ingress-nginx + targetRevision: 4.10.0 + helm: + values: |- + controller: + podAnnotations: + linkerd.io/inject: enabled + ingressClass: nginx + publishService: + enabled: true + service: + annotations: + service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" + service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "60" + extraArgs: + enable-ssl-passthrough: true + chart: ingress-nginx + destination: + name: + namespace: ingress-nginx + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/workload-cluster/30-reloader.yaml b/akamai-gitlab/templates/workload-cluster/30-reloader.yaml new file mode 100644 index 000000000..2336f6b12 --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/30-reloader.yaml @@ -0,0 +1,31 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -reloader + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: + source: + repoURL: 'https://stakater.github.io/stakater-charts' + targetRevision: v1.0.10 + chart: reloader + helm: + values: |- + ignoreSecrets: false + destination: + name: + namespace: reloader + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/akamai-gitlab/templates/workload-cluster/40-cloudflare-origin-issuer-crd.yaml b/akamai-gitlab/templates/workload-cluster/40-cloudflare-origin-issuer-crd.yaml new file mode 100644 index 000000000..4f366651e --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/40-cloudflare-origin-issuer-crd.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -cloudflare-origin-issuer-crd + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '40' +spec: + project: + source: + repoURL: https://github.com/cloudflare/origin-ca-issuer + path: deploy/crds + targetRevision: v0.6.1 + destination: + name: + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true \ No newline at end of file diff --git a/akamai-gitlab/templates/workload-cluster/40-clusterissuers.yaml b/akamai-gitlab/templates/workload-cluster/40-clusterissuers.yaml new file mode 100644 index 000000000..e45d89d86 --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/40-clusterissuers.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -cert-issuers + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '40' +spec: + project: + source: + repoURL: + path: registry/clusters//cert-issuers + targetRevision: HEAD + destination: + name: + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/workload-cluster/40-clustersecretstore.yaml b/akamai-gitlab/templates/workload-cluster/40-clustersecretstore.yaml new file mode 100644 index 000000000..82bbdf5e3 --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/40-clustersecretstore.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -cluster-secret-store + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '40' +spec: + project: + source: + repoURL: + path: registry/clusters//cluster-secret-store + targetRevision: HEAD + destination: + name: + namespace: external-secrets-operator + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/workload-cluster/41-cloudflare-origin-ca-issuer.yaml b/akamai-gitlab/templates/workload-cluster/41-cloudflare-origin-ca-issuer.yaml new file mode 100644 index 000000000..851e73895 --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/41-cloudflare-origin-ca-issuer.yaml @@ -0,0 +1,32 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -cloudflare-cloudflare-origin-ca-issuer + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '41' +spec: + project: + source: + repoURL: ghcr.io/cloudflare/origin-ca-issuer-charts + chart: origin-ca-issuer + targetRevision: 0.5.2 + helm: + values: |- + global: + rbac: + create: true + controller: + image: + repository: cloudflare/origin-ca-issuer + tag: v0.6.1 + pullPolicy: Always + destination: + name: + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true \ No newline at end of file diff --git a/akamai-gitlab/templates/workload-cluster/45-cloudflare-origin-issuer.yaml b/akamai-gitlab/templates/workload-cluster/45-cloudflare-origin-issuer.yaml new file mode 100644 index 000000000..d118509ca --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/45-cloudflare-origin-issuer.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -cloudflare-origin-issuer + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '45' +spec: + project: + source: + repoURL: + path: registry/clusters//cloudflare-origin-issuer + targetRevision: HEAD + destination: + name: + namespace: + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true \ No newline at end of file diff --git a/akamai-gitlab/templates/workload-cluster/45-environment.yaml b/akamai-gitlab/templates/workload-cluster/45-environment.yaml new file mode 100644 index 000000000..66cba38b5 --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/45-environment.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -environment + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '45' +spec: + project: default + source: + repoURL: + path: registry/environments/ + targetRevision: HEAD + destination: + name: in-cluster + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/workload-cluster/appproject-workload-cluster.yaml b/akamai-gitlab/templates/workload-cluster/appproject-workload-cluster.yaml new file mode 100644 index 000000000..f3c94e429 --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/appproject-workload-cluster.yaml @@ -0,0 +1,55 @@ +apiVersion: argoproj.io/v1alpha1 +kind: AppProject +metadata: + name: + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "-1" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + description: description + sourceRepos: + - '' + - 'https://kubernetes.github.io/ingress-nginx' + - 'https://kubernetes-sigs.github.io/external-dns' + - 'https://charts.jetstack.io' + - 'https://charts.external-secrets.io' + - 'https://helm.datadoghq.com' + - 'https://stakater.github.io/stakater-charts' + - 'https://chartmuseum.' + - 'https://charts.loft.sh' + - 'https://github.com/cloudflare/origin-ca-issuer' + - 'https://cloudflare.github.io/origin-ca-issuer/charts' + - '*' # Adding wildcard for the gitops catalog. This wildcard can be removed from the template or after provisioning + destinations: + - namespace: external-dns + name: + - namespace: datadog + name: + - namespace: default + name: + - namespace: + name: + - namespace: external-secrets-operator + name: + - namespace: reloader + name: + - namespace: cert-manager + name: + - namespace: ingress-nginx + name: + - namespace: kube-system + name: + - namespace: '*' # Adding wildcard for the gitops catalog. This wildcard can be removed from the template or after provisioning + server: '*' # Adding wildcard for the gitops catalog. This wildcard can be removed from the template or after provisioning + clusterResourceWhitelist: + - group: '*' + kind: '*' + roles: + - description: -admin-role + groups: + - admins + name: admin-role + policies: + - p, proj::admin-role, applications, *, /*, allow diff --git a/akamai-gitlab/templates/workload-cluster/cert-issuers/clusterissuers.yaml b/akamai-gitlab/templates/workload-cluster/cert-issuers/clusterissuers.yaml new file mode 100644 index 000000000..97711a762 --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/cert-issuers/clusterissuers.yaml @@ -0,0 +1,29 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-staging +spec: + acme: + server: https://acme-staging-v02.api.letsencrypt.org/directory + email: + privateKeySecretRef: + name: letsencrypt-staging + solvers: + - http01: + ingress: + class: nginx +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-prod +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + email: + privateKeySecretRef: + name: letsencrypt-prod + solvers: + - http01: + ingress: + class: nginx diff --git a/akamai-gitlab/templates/workload-cluster/cloudflare-origin-issuer/cloudflare-issuer.yaml b/akamai-gitlab/templates/workload-cluster/cloudflare-origin-issuer/cloudflare-issuer.yaml new file mode 100644 index 000000000..741e2760c --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/cloudflare-origin-issuer/cloudflare-issuer.yaml @@ -0,0 +1,31 @@ +# apiVersion: external-secrets.io/v1beta1 +# kind: ExternalSecret +# metadata: +# name: cloudflare-creds +# namespace: +# annotations: +# argocd.argoproj.io/sync-wave: "0" +# spec: +# target: +# name: cloudflare-creds +# secretStoreRef: +# kind: ClusterSecretStore +# name: -vault-kv-secret +# refreshInterval: 10s +# data: +# - remoteRef: +# key: cloudflare +# property: origin-ca-api-key +# secretKey: origin-ca-api-key +# --- +# apiVersion: cert-manager.k8s.cloudflare.com/v1 +# kind: OriginIssuer +# metadata: +# name: cloudflare-origin-issuer +# namespace: +# spec: +# requestType: OriginECC +# auth: +# serviceKeyRef: +# key: origin-ca-api-key +# name: cloudflare-creds \ No newline at end of file diff --git a/akamai-gitlab/templates/workload-cluster/cluster-secret-store/clustersecretstore.yaml b/akamai-gitlab/templates/workload-cluster/cluster-secret-store/clustersecretstore.yaml new file mode 100644 index 000000000..b6e90f68a --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/cluster-secret-store/clustersecretstore.yaml @@ -0,0 +1,18 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ClusterSecretStore +metadata: + name: -vault-kv-secret + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + provider: + vault: + server: 'https://vault.' + path: 'secret' + version: 'v2' + auth: + # points to a secret that contains a vault token + # https://www.vaultproject.io/docs/auth/token + tokenSecretRef: + name: "-cluster-vault-bootstrap" + key: "vault-token" diff --git a/akamai-gitlab/templates/workload-cluster/infrastructure/wait.yaml b/akamai-gitlab/templates/workload-cluster/infrastructure/wait.yaml new file mode 100644 index 000000000..f409abaa6 --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/infrastructure/wait.yaml @@ -0,0 +1,24 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: -infrastructure-wait + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "20" +spec: + template: + spec: + serviceAccountName: argocd-server + containers: + - name: wait + image: bitnami/kubectl:1.25.12 + command: + - /bin/sh + - -c + - | + while ! kubectl wait --for=jsonpath='{.status.conditions[0].status}'='True' workspace/; do echo "waiting for cluster to provision"; sleep 5; done + restartPolicy: Never + backoffLimit: 1 + + + diff --git a/akamai-gitlab/templates/workload-cluster/infrastructure/workspace.yaml b/akamai-gitlab/templates/workload-cluster/infrastructure/workspace.yaml new file mode 100644 index 000000000..8aba21372 --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/infrastructure/workspace.yaml @@ -0,0 +1,235 @@ +apiVersion: tf.upbound.io/v1beta1 +kind: Workspace +metadata: + name: + annotations: + argocd.argoproj.io/sync-wave: "10" + crossplane.io/external-name: +spec: + providerConfigRef: + name: + forProvider: + source: Inline + module: | + variable "instance_size" { + type = string + default = "g4s.kube.medium" + } + + variable "node_count" { + type = number + default = "" + } + + locals { + cluster_name = "" + } + + resource "civo_network" "kubefirst" { + label = local.cluster_name + } + + resource "civo_firewall" "kubefirst" { + name = local.cluster_name + network_id = civo_network.kubefirst.id + create_default_rules = true + } + + resource "civo_kubernetes_cluster" "kubefirst" { + name = local.cluster_name + network_id = civo_network.kubefirst.id + firewall_id = civo_firewall.kubefirst.id + pools { + label = local.cluster_name + size = var.instance_size + node_count = var.node_count + } + } + + resource "vault_generic_secret" "clusters" { + path = "secret/clusters/${local.cluster_name}" + + data_json = jsonencode( + { + kubeconfig = civo_kubernetes_cluster.kubefirst.kubeconfig + client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-certificate-data) + client_key = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-key-data) + cluster_ca_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).clusters[0].cluster.certificate-authority-data) + host = civo_kubernetes_cluster.kubefirst.api_endpoint + cluster_name = local.cluster_name + argocd_manager_sa_token = kubernetes_secret_v1.argocd_manager.data.token + } + ) + } + + provider "kubernetes" { + host = civo_kubernetes_cluster.kubefirst.api_endpoint + client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-certificate-data) + client_key = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-key-data) + cluster_ca_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).clusters[0].cluster.certificate-authority-data) + } + + resource "kubernetes_cluster_role_v1" "argocd_manager" { + metadata { + name = "argocd-manager-role" + } + + rule { + api_groups = ["*"] + resources = ["*"] + verbs = ["*"] + } + rule { + non_resource_urls = ["*"] + verbs = ["*"] + } + } + + + resource "kubernetes_cluster_role_binding_v1" "argocd_manager" { + metadata { + name = "argocd-manager-role-binding" + } + role_ref { + api_group = "rbac.authorization.k8s.io" + kind = "ClusterRole" + name = kubernetes_cluster_role_v1.argocd_manager.metadata.0.name + } + subject { + kind = "ServiceAccount" + name = kubernetes_service_account_v1.argocd_manager.metadata.0.name + namespace = "kube-system" + } + } + + resource "kubernetes_service_account_v1" "argocd_manager" { + metadata { + name = "argocd-manager" + namespace = "kube-system" + } + secret { + name = "argocd-manager-token" + } + } + + resource "kubernetes_secret_v1" "argocd_manager" { + metadata { + name = "argocd-manager-token" + namespace = "kube-system" + annotations = { + "kubernetes.io/service-account.name" = "argocd-manager" + } + } + type = "kubernetes.io/service-account-token" + depends_on = [ kubernetes_service_account_v1.argocd_manager ] + } + + resource "kubernetes_namespace_v1" "external_dns" { + metadata { + name = "external-dns" + } + } + + data "vault_generic_secret" "external_dns" { + path = "secret/external-dns" + } + + resource "kubernetes_secret_v1" "external_dns" { + metadata { + name = "external-dns-secrets" + namespace = kubernetes_namespace_v1.external_dns.metadata.0.name + } + data = { + token = data.vault_generic_secret.external_dns.data["token"] + } + type = "Opaque" + } + + + resource "kubernetes_namespace_v1" "external_secrets_operator" { + metadata { + name = "external-secrets-operator" + } + } + + resource "kubernetes_namespace_v1" "environment" { + metadata { + name = "" + } + } + + data "vault_generic_secret" "docker_config" { + path = "secret/dockerconfigjson" + } + + resource "kubernetes_secret_v1" "image_pull" { + metadata { + name = "docker-config" + namespace = kubernetes_namespace_v1.environment.metadata.0.name + } + + data = { + ".dockerconfigjson" = data.vault_generic_secret.docker_config.data["dockerconfig"] + } + + type = "kubernetes.io/dockerconfigjson" + } + + data "vault_generic_secret" "external_secrets_operator" { + path = "secret/atlantis" + } + + resource "kubernetes_secret_v1" "external_secrets_operator_environment" { + metadata { + name = "${local.cluster_name}-cluster-vault-bootstrap" + namespace = kubernetes_namespace_v1.environment.metadata.0.name + } + data = { + vault-token = data.vault_generic_secret.external_secrets_operator.data["VAULT_TOKEN"] + } + type = "Opaque" + } + + resource "kubernetes_secret_v1" "external_secrets_operator" { + metadata { + name = "${local.cluster_name}-cluster-vault-bootstrap" + namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name + } + data = { + vault-token = data.vault_generic_secret.external_secrets_operator.data["VAULT_TOKEN"] + } + type = "Opaque" + } + + resource "kubernetes_service_account_v1" "external_secrets" { + metadata { + name = "external-secrets" + namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name + } + secret { + name = "external-secrets-token" + } + } + + resource "kubernetes_secret_v1" "external_secrets" { + metadata { + name = "external-secrets-token" + namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name + annotations = { + "kubernetes.io/service-account.name" = "external-secrets" + } + } + type = "kubernetes.io/service-account-token" + depends_on = [ kubernetes_service_account_v1.external_secrets ] + } + + resource "kubernetes_config_map" "kubefirst_cm" { + metadata { + name = "kubefirst-cm" + namespace = "kube-system" + } + + data = { + mgmt_cluster_id = "" + } + } \ No newline at end of file diff --git a/akamai-gitlab/templates/workload-cluster/provider-config/providerconfig.yaml b/akamai-gitlab/templates/workload-cluster/provider-config/providerconfig.yaml new file mode 100644 index 000000000..584031233 --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/provider-config/providerconfig.yaml @@ -0,0 +1,51 @@ +apiVersion: tf.upbound.io/v1beta1 +kind: ProviderConfig +metadata: + name: + annotations: + argocd.argoproj.io/sync-wave: "-1" +spec: + configuration: | + terraform { + backend "s3" { + bucket = "" + key = "registry/clusters//infrastructure/provider-config/terraform.tfstate" + endpoint = "https://us-east-1.linodeobjects.com" + + region = "" + + skip_credentials_validation = true + skip_metadata_api_check = true + skip_region_validation = true + force_path_style = true + } + required_providers { + civo = { + source = "civo/civo" + } + kubernetes = { + source = "hashicorp/kubernetes" + version = "2.23.0" + } + vault = { + source = "hashicorp/vault" + version = "3.19.0" + } + } + } + provider "civo" { + region = "" + } + credentials: + - filename: gen-nothing + source: None + secretRef: + namespace: crossplane-system + name: civo-creds + key: token + - filename: .git-credentials + source: Secret + secretRef: + namespace: crossplane-system + name: git-credentials + key: creds diff --git a/akamai-gitlab/templates/workload-cluster/registry-workload-cluster.yaml b/akamai-gitlab/templates/workload-cluster/registry-workload-cluster.yaml new file mode 100644 index 000000000..f925b88dd --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/registry-workload-cluster.yaml @@ -0,0 +1,30 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: registry- + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '100' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: default + source: + repoURL: + path: registry/clusters/ + targetRevision: HEAD + destination: + server: https://kubernetes.default.svc + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/akamai-gitlab/templates/workload-cluster/workload-cluster-environment/metaphor.yaml b/akamai-gitlab/templates/workload-cluster/workload-cluster-environment/metaphor.yaml new file mode 100644 index 000000000..e8a66cfc7 --- /dev/null +++ b/akamai-gitlab/templates/workload-cluster/workload-cluster-environment/metaphor.yaml @@ -0,0 +1,27 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -metaphor + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '100' +spec: + project: default + source: + repoURL: + path: registry/environments//metaphor + targetRevision: HEAD + helm: + valueFiles: + - values.yaml + destination: + name: + namespace: + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true \ No newline at end of file diff --git a/akamai-gitlab/templates/workload-vcluster/0-providerconfig.yaml b/akamai-gitlab/templates/workload-vcluster/0-providerconfig.yaml new file mode 100644 index 000000000..cac4df032 --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/0-providerconfig.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -provider-config + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '0' +spec: + project: default + source: + repoURL: + path: registry/clusters//provider-config + targetRevision: HEAD + destination: + name: in-cluster + namespace: crossplane-system + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/workload-vcluster/10-infrastructure.yaml b/akamai-gitlab/templates/workload-vcluster/10-infrastructure.yaml new file mode 100644 index 000000000..5e2a0defc --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/10-infrastructure.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -infrastructure + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: + path: registry/clusters//infrastructure + targetRevision: HEAD + destination: + name: in-cluster + namespace: + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/workload-vcluster/15-bootstrap.yaml b/akamai-gitlab/templates/workload-vcluster/15-bootstrap.yaml new file mode 100644 index 000000000..4c29b41e6 --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/15-bootstrap.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -bootstrap + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '15' +spec: + project: default + source: + repoURL: + path: registry/clusters//bootstrap + targetRevision: HEAD + destination: + name: in-cluster + namespace: crossplane-system + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/workload-vcluster/20-argocd-connection.yaml b/akamai-gitlab/templates/workload-vcluster/20-argocd-connection.yaml new file mode 100644 index 000000000..a8536ee9a --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/20-argocd-connection.yaml @@ -0,0 +1,63 @@ +apiVersion: "external-secrets.io/v1beta1" +kind: ExternalSecret +metadata: + name: + annotations: + argocd.argoproj.io/sync-wave: '20' + labels: + app.kubernetes.io/part-of: argocd +spec: + target: + name: + template: + metadata: + labels: + argocd.argoproj.io/secret-type: cluster + engineVersion: v2 + data: + name: "{{ .cluster_name }}" + server: "{{ .host }}" + clusterResources: "true" + config: | + { + "bearerToken": "{{ .argocd_manager_sa_token }}", + "tlsClientConfig": { + "caData": "{{ .cluster_ca_certificate | b64enc }}", + "certData": "{{ .client_certificate | b64enc }}", + "insecure": false, + "keyData": "{{ .client_key | b64enc }}" + } + } + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + data: + - remoteRef: + key: clusters/ + property: argocd_manager_sa_token + secretKey: argocd_manager_sa_token + - remoteRef: + key: clusters/ + property: host + secretKey: host + - remoteRef: + key: clusters/ + property: cluster_name + secretKey: cluster_name + - remoteRef: + key: clusters/ + property: cluster_ca_certificate + conversionStrategy: Default + secretKey: cluster_ca_certificate + - remoteRef: + key: clusters/ + property: client_certificate + conversionStrategy: Default + secretKey: client_certificate + - remoteRef: + key: clusters/ + property: client_key + conversionStrategy: Default + secretKey: client_key + diff --git a/akamai-gitlab/templates/workload-vcluster/30-cert-manager.yaml b/akamai-gitlab/templates/workload-vcluster/30-cert-manager.yaml new file mode 100644 index 000000000..c5d4cb25d --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/30-cert-manager.yaml @@ -0,0 +1,30 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -cert-manager + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: + source: + repoURL: https://charts.jetstack.io + targetRevision: v1.14.4 + helm: + values: |- + serviceAccount: + create: true + name: cert-manager + installCRDs: true + chart: cert-manager + destination: + name: + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/workload-vcluster/30-external-dns.yaml b/akamai-gitlab/templates/workload-vcluster/30-external-dns.yaml new file mode 100644 index 000000000..ec20e60b4 --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/30-external-dns.yaml @@ -0,0 +1,42 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -external-dns + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: + source: + repoURL: https://kubernetes-sigs.github.io/external-dns + targetRevision: 1.14.4 + helm: + releaseName: external-dns + values: | + image: + repository: registry.k8s.io/external-dns/external-dns + tag: "v0.13.2" + serviceAccount: + create: true + name: external-dns + provider: + sources: + - ingress + domainFilters: + - + env: + - name: + valueFrom: + secretKeyRef: + name: external-dns-secrets + key: token + chart: external-dns + destination: + name: + namespace: external-dns + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/workload-vcluster/30-external-secrets-operator.yaml b/akamai-gitlab/templates/workload-vcluster/30-external-secrets-operator.yaml new file mode 100644 index 000000000..c09c2bc73 --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/30-external-secrets-operator.yaml @@ -0,0 +1,71 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -external-secrets-operator + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: + source: + repoURL: https://charts.external-secrets.io + targetRevision: 0.8.1 + helm: + values: |- + serviceAccount: + create: false + name: external-secrets + chart: external-secrets + destination: + name: + namespace: external-secrets-operator + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - RespectIgnoreDifferences=true + ignoreDifferences: + - group: apiextensions.k8s.io + kind: CustomResourceDefinition + jqPathExpressions: + - .spec.conversion.webhook.clientConfig.caBundle + - .spec.conversion.webhook.clientConfig.service.name + - .spec.conversion.webhook.clientConfig.service.namespace + - group: admissionregistration.k8s.io + kind: ValidatingWebhookConfiguration + jqPathExpressions: + - .webhooks[]?.clientConfig.caBundle +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: -eso-kubernetes-external-secrets-auth + annotations: + argocd.argoproj.io/sync-wave: '40' +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: 'system:auth-delegator' +subjects: + - kind: ServiceAccount + name: external-secrets + namespace: external-secrets-operator +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: -eso-kubernetes-external-secrets-auth2 + annotations: + argocd.argoproj.io/sync-wave: '40' +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: 'cluster-admin' +subjects: + - kind: ServiceAccount + name: external-secrets + namespace: external-secrets-operator diff --git a/akamai-gitlab/templates/workload-vcluster/30-ingress-nginx.yaml b/akamai-gitlab/templates/workload-vcluster/30-ingress-nginx.yaml new file mode 100644 index 000000000..7221cd66c --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/30-ingress-nginx.yaml @@ -0,0 +1,38 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -ingress-nginx + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: + source: + repoURL: https://kubernetes.github.io/ingress-nginx + targetRevision: 4.10.0 + helm: + values: |- + controller: + podAnnotations: + linkerd.io/inject: enabled + ingressClass: nginx + publishService: + enabled: true + service: + annotations: + service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" + service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "60" + extraArgs: + enable-ssl-passthrough: true + chart: ingress-nginx + destination: + name: + namespace: ingress-nginx + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/workload-vcluster/30-reloader.yaml b/akamai-gitlab/templates/workload-vcluster/30-reloader.yaml new file mode 100644 index 000000000..2336f6b12 --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/30-reloader.yaml @@ -0,0 +1,31 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -reloader + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: + source: + repoURL: 'https://stakater.github.io/stakater-charts' + targetRevision: v1.0.10 + chart: reloader + helm: + values: |- + ignoreSecrets: false + destination: + name: + namespace: reloader + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/akamai-gitlab/templates/workload-vcluster/40-cloudflare-origin-issuer-crd.yaml b/akamai-gitlab/templates/workload-vcluster/40-cloudflare-origin-issuer-crd.yaml new file mode 100644 index 000000000..4f366651e --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/40-cloudflare-origin-issuer-crd.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -cloudflare-origin-issuer-crd + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '40' +spec: + project: + source: + repoURL: https://github.com/cloudflare/origin-ca-issuer + path: deploy/crds + targetRevision: v0.6.1 + destination: + name: + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true \ No newline at end of file diff --git a/akamai-gitlab/templates/workload-vcluster/40-clusterissuers.yaml b/akamai-gitlab/templates/workload-vcluster/40-clusterissuers.yaml new file mode 100644 index 000000000..e45d89d86 --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/40-clusterissuers.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -cert-issuers + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '40' +spec: + project: + source: + repoURL: + path: registry/clusters//cert-issuers + targetRevision: HEAD + destination: + name: + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/workload-vcluster/40-clustersecretstore.yaml b/akamai-gitlab/templates/workload-vcluster/40-clustersecretstore.yaml new file mode 100644 index 000000000..82bbdf5e3 --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/40-clustersecretstore.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -cluster-secret-store + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '40' +spec: + project: + source: + repoURL: + path: registry/clusters//cluster-secret-store + targetRevision: HEAD + destination: + name: + namespace: external-secrets-operator + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/workload-vcluster/41-cloudflare-origin-ca-issuer.yaml b/akamai-gitlab/templates/workload-vcluster/41-cloudflare-origin-ca-issuer.yaml new file mode 100644 index 000000000..851e73895 --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/41-cloudflare-origin-ca-issuer.yaml @@ -0,0 +1,32 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -cloudflare-cloudflare-origin-ca-issuer + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '41' +spec: + project: + source: + repoURL: ghcr.io/cloudflare/origin-ca-issuer-charts + chart: origin-ca-issuer + targetRevision: 0.5.2 + helm: + values: |- + global: + rbac: + create: true + controller: + image: + repository: cloudflare/origin-ca-issuer + tag: v0.6.1 + pullPolicy: Always + destination: + name: + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true \ No newline at end of file diff --git a/akamai-gitlab/templates/workload-vcluster/45-cloudflare-origin-issuer.yaml b/akamai-gitlab/templates/workload-vcluster/45-cloudflare-origin-issuer.yaml new file mode 100644 index 000000000..d118509ca --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/45-cloudflare-origin-issuer.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -cloudflare-origin-issuer + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '45' +spec: + project: + source: + repoURL: + path: registry/clusters//cloudflare-origin-issuer + targetRevision: HEAD + destination: + name: + namespace: + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true \ No newline at end of file diff --git a/akamai-gitlab/templates/workload-vcluster/45-environment.yaml b/akamai-gitlab/templates/workload-vcluster/45-environment.yaml new file mode 100644 index 000000000..66cba38b5 --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/45-environment.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -environment + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '45' +spec: + project: default + source: + repoURL: + path: registry/environments/ + targetRevision: HEAD + destination: + name: in-cluster + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/akamai-gitlab/templates/workload-vcluster/appproject-workload-cluster.yaml b/akamai-gitlab/templates/workload-vcluster/appproject-workload-cluster.yaml new file mode 100644 index 000000000..f3c94e429 --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/appproject-workload-cluster.yaml @@ -0,0 +1,55 @@ +apiVersion: argoproj.io/v1alpha1 +kind: AppProject +metadata: + name: + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "-1" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + description: description + sourceRepos: + - '' + - 'https://kubernetes.github.io/ingress-nginx' + - 'https://kubernetes-sigs.github.io/external-dns' + - 'https://charts.jetstack.io' + - 'https://charts.external-secrets.io' + - 'https://helm.datadoghq.com' + - 'https://stakater.github.io/stakater-charts' + - 'https://chartmuseum.' + - 'https://charts.loft.sh' + - 'https://github.com/cloudflare/origin-ca-issuer' + - 'https://cloudflare.github.io/origin-ca-issuer/charts' + - '*' # Adding wildcard for the gitops catalog. This wildcard can be removed from the template or after provisioning + destinations: + - namespace: external-dns + name: + - namespace: datadog + name: + - namespace: default + name: + - namespace: + name: + - namespace: external-secrets-operator + name: + - namespace: reloader + name: + - namespace: cert-manager + name: + - namespace: ingress-nginx + name: + - namespace: kube-system + name: + - namespace: '*' # Adding wildcard for the gitops catalog. This wildcard can be removed from the template or after provisioning + server: '*' # Adding wildcard for the gitops catalog. This wildcard can be removed from the template or after provisioning + clusterResourceWhitelist: + - group: '*' + kind: '*' + roles: + - description: -admin-role + groups: + - admins + name: admin-role + policies: + - p, proj::admin-role, applications, *, /*, allow diff --git a/akamai-gitlab/templates/workload-vcluster/bootstrap/workspace.yaml b/akamai-gitlab/templates/workload-vcluster/bootstrap/workspace.yaml new file mode 100644 index 000000000..36e7cb600 --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/bootstrap/workspace.yaml @@ -0,0 +1,229 @@ +apiVersion: tf.upbound.io/v1beta1 +kind: Workspace +metadata: + name: -bootstrap + annotations: + argocd.argoproj.io/sync-wave: "10" + crossplane.io/external-name: -bootstrap +spec: + providerConfigRef: + name: + forProvider: + source: Inline + module: | + variable "cluster_name" { + type = string + default = "" + } + provider "kubernetes" { + alias = "local" + } + data "kubernetes_secret_v1" "vcluster_kubeconfig" { + provider = "kubernetes.local" + metadata { + name = "vc-" + namespace = "" + } + } + + resource "vault_generic_secret" "clusters" { + path = "secret/clusters/${var.cluster_name}" + + data_json = jsonencode( + { + kubeconfig = data.kubernetes_secret_v1.vcluster_kubeconfig.data.config + client_certificate = base64decode(yamldecode(data.kubernetes_secret_v1.vcluster_kubeconfig.data.config).users[0].user.client-certificate-data) + client_key = base64decode(yamldecode(data.kubernetes_secret_v1.vcluster_kubeconfig.data.config).users[0].user.client-key-data) + cluster_ca_certificate = base64decode(yamldecode(data.kubernetes_secret_v1.vcluster_kubeconfig.data.config).clusters[0].cluster.certificate-authority-data) + host = "https://." + cluster_name = var.cluster_name + argocd_manager_sa_token = kubernetes_secret_v1.argocd_manager.data.token + } + ) + } + + provider "kubernetes" { + alias = "target" + host = "https://." + + client_certificate = base64decode(yamldecode(data.kubernetes_secret_v1.vcluster_kubeconfig.data.config).users[0].user.client-certificate-data) + client_key = base64decode(yamldecode(data.kubernetes_secret_v1.vcluster_kubeconfig.data.config).users[0].user.client-key-data) + cluster_ca_certificate = base64decode(yamldecode(data.kubernetes_secret_v1.vcluster_kubeconfig.data.config).clusters[0].cluster.certificate-authority-data) + } + + resource "kubernetes_cluster_role_v1" "argocd_manager" { + provider = "kubernetes.target" + metadata { + name = "argocd-manager-role" + } + + rule { + api_groups = ["*"] + resources = ["*"] + verbs = ["*"] + } + rule { + non_resource_urls = ["*"] + verbs = ["*"] + } + } + + + resource "kubernetes_cluster_role_binding_v1" "argocd_manager" { + provider = "kubernetes.target" + metadata { + name = "argocd-manager-role-binding" + } + role_ref { + api_group = "rbac.authorization.k8s.io" + kind = "ClusterRole" + name = kubernetes_cluster_role_v1.argocd_manager.metadata.0.name + } + subject { + kind = "ServiceAccount" + name = kubernetes_service_account_v1.argocd_manager.metadata.0.name + namespace = "kube-system" + } + } + + resource "kubernetes_service_account_v1" "argocd_manager" { + provider = "kubernetes.target" + metadata { + name = "argocd-manager" + namespace = "kube-system" + } + secret { + name = "argocd-manager-token" + } + } + + resource "kubernetes_secret_v1" "argocd_manager" { + provider = "kubernetes.target" + metadata { + name = "argocd-manager-token" + namespace = "kube-system" + annotations = { + "kubernetes.io/service-account.name" = "argocd-manager" + } + } + type = "kubernetes.io/service-account-token" + depends_on = [ kubernetes_service_account_v1.argocd_manager ] + } + + resource "kubernetes_namespace_v1" "external_dns" { + provider = "kubernetes.target" + metadata { + name = "external-dns" + } + } + + data "vault_generic_secret" "external_dns" { + path = "secret/external-dns" + } + + resource "kubernetes_secret_v1" "external_dns" { + provider = "kubernetes.target" + metadata { + name = "external-dns-secrets" + namespace = kubernetes_namespace_v1.external_dns.metadata.0.name + } + data = { + token = data.vault_generic_secret.external_dns.data["token"] + } + type = "Opaque" + } + + + resource "kubernetes_namespace_v1" "external_secrets_operator" { + provider = "kubernetes.target" + metadata { + name = "external-secrets-operator" + } + } + + data "vault_generic_secret" "external_secrets_operator" { + path = "secret/atlantis" + } + + resource "kubernetes_namespace_v1" "environment" { + provider = "kubernetes.target" + metadata { + name = "" + } + } + + data "vault_generic_secret" "docker_config" { + path = "secret/dockerconfigjson" + } + + resource "kubernetes_secret_v1" "image_pull" { + provider = "kubernetes.target" + metadata { + name = "docker-config" + namespace = kubernetes_namespace_v1.environment.metadata.0.name + } + + data = { + ".dockerconfigjson" = data.vault_generic_secret.docker_config.data["dockerconfig"] + } + + type = "kubernetes.io/dockerconfigjson" + } + + resource "kubernetes_secret_v1" "external_secrets_operator_environment" { + provider = "kubernetes.target" + metadata { + name = "${var.cluster_name}-cluster-vault-bootstrap" + namespace = kubernetes_namespace_v1.environment.metadata.0.name + } + data = { + vault-token = data.vault_generic_secret.external_secrets_operator.data["VAULT_TOKEN"] + } + type = "Opaque" + } + + resource "kubernetes_secret_v1" "external_secrets_operator" { + provider = "kubernetes.target" + metadata { + name = "${var.cluster_name}-cluster-vault-bootstrap" + namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name + } + data = { + vault-token = data.vault_generic_secret.external_secrets_operator.data["VAULT_TOKEN"] + } + type = "Opaque" + } + + resource "kubernetes_service_account_v1" "external_secrets" { + provider = "kubernetes.target" + metadata { + name = "external-secrets" + namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name + } + secret { + name = "external-secrets-token" + } + } + + resource "kubernetes_secret_v1" "external_secrets" { + provider = "kubernetes.target" + metadata { + name = "external-secrets-token" + namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name + annotations = { + "kubernetes.io/service-account.name" = "external-secrets" + } + } + type = "kubernetes.io/service-account-token" + depends_on = [ kubernetes_service_account_v1.external_secrets ] + } + + resource "kubernetes_config_map" "kubefirst_cm" { + metadata { + name = "kubefirst-cm" + namespace = "kube-system" + } + data = { + mgmt_cluster_id = "" + } + } \ No newline at end of file diff --git a/akamai-gitlab/templates/workload-vcluster/cert-issuers/clusterissuers.yaml b/akamai-gitlab/templates/workload-vcluster/cert-issuers/clusterissuers.yaml new file mode 100644 index 000000000..97711a762 --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/cert-issuers/clusterissuers.yaml @@ -0,0 +1,29 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-staging +spec: + acme: + server: https://acme-staging-v02.api.letsencrypt.org/directory + email: + privateKeySecretRef: + name: letsencrypt-staging + solvers: + - http01: + ingress: + class: nginx +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-prod +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + email: + privateKeySecretRef: + name: letsencrypt-prod + solvers: + - http01: + ingress: + class: nginx diff --git a/akamai-gitlab/templates/workload-vcluster/cloudflare-origin-issuer/cloudflare-issuer.yaml b/akamai-gitlab/templates/workload-vcluster/cloudflare-origin-issuer/cloudflare-issuer.yaml new file mode 100644 index 000000000..d7ea001a4 --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/cloudflare-origin-issuer/cloudflare-issuer.yaml @@ -0,0 +1,31 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: cloudflare-creds + namespace: + annotations: + argocd.argoproj.io/sync-wave: "0" +spec: + target: + name: cloudflare-creds + secretStoreRef: + kind: ClusterSecretStore + name: -vault-kv-secret + refreshInterval: 10s + data: + - remoteRef: + key: cloudflare + property: origin-ca-api-key + secretKey: origin-ca-api-key +--- +apiVersion: cert-manager.k8s.cloudflare.com/v1 +kind: OriginIssuer +metadata: + name: cloudflare-origin-issuer + namespace: +spec: + requestType: OriginECC + auth: + serviceKeyRef: + key: origin-ca-api-key + name: cloudflare-creds \ No newline at end of file diff --git a/akamai-gitlab/templates/workload-vcluster/cluster-secret-store/clustersecretstore.yaml b/akamai-gitlab/templates/workload-vcluster/cluster-secret-store/clustersecretstore.yaml new file mode 100644 index 000000000..b6e90f68a --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/cluster-secret-store/clustersecretstore.yaml @@ -0,0 +1,18 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ClusterSecretStore +metadata: + name: -vault-kv-secret + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + provider: + vault: + server: 'https://vault.' + path: 'secret' + version: 'v2' + auth: + # points to a secret that contains a vault token + # https://www.vaultproject.io/docs/auth/token + tokenSecretRef: + name: "-cluster-vault-bootstrap" + key: "vault-token" diff --git a/akamai-gitlab/templates/workload-vcluster/infrastructure/vcluster.yaml b/akamai-gitlab/templates/workload-vcluster/infrastructure/vcluster.yaml new file mode 100644 index 000000000..593c6d0af --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/infrastructure/vcluster.yaml @@ -0,0 +1,50 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: https://charts.loft.sh + targetRevision: 0.15.5 + chart: vcluster-k8s + helm: + values: | + syncer: + extraArgs: + - --tls-san=. + - --kube-config-context-name= + - --out-kube-config-server=https://. + replicas: 4 + ingress: + enabled: true + pathType: ImplementationSpecific + apiVersion: networking.k8s.io/v1 + ingressClassName: "nginx" + host: . + annotations: + nginx.ingress.kubernetes.io/backend-protocol: HTTPS + nginx.ingress.kubernetes.io/ssl-passthrough: "true" + nginx.ingress.kubernetes.io/ssl-redirect: "true" + + + + + tls: + - secretName: -tls + hosts: + - . + destination: + name: in-cluster + namespace: + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true \ No newline at end of file diff --git a/akamai-gitlab/templates/workload-vcluster/infrastructure/wait.yaml b/akamai-gitlab/templates/workload-vcluster/infrastructure/wait.yaml new file mode 100644 index 000000000..bc168ae18 --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/infrastructure/wait.yaml @@ -0,0 +1,131 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: kubernetes-toolkit + namespace: +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: kubernetes-toolkit + namespace: +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: kubernetes-toolkit + namespace: +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: kubernetes-toolkit +subjects: + - kind: ServiceAccount + name: kubernetes-toolkit + namespace: +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: kubernetes-toolkit-vcluster-api + namespace: +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - + - --label + - app=vcluster-api + image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8 + imagePullPolicy: IfNotPresent + name: kubernetes-toolkit + restartPolicy: OnFailure + serviceAccountName: kubernetes-toolkit +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: kubernetes-toolkit-vcluster-controller + namespace: +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - + - --label + - app=vcluster-controller + image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8 + imagePullPolicy: IfNotPresent + name: kubernetes-toolkit + restartPolicy: OnFailure + serviceAccountName: kubernetes-toolkit +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: kubernetes-toolkit-vcluster + namespace: +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - + - --label + - app=vcluster + image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8 + imagePullPolicy: IfNotPresent + name: kubernetes-toolkit + restartPolicy: OnFailure + serviceAccountName: kubernetes-toolkit +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: kubernetes-toolkit-vcluster-etcd + namespace: +spec: + template: + spec: + containers: + - args: + - wait-for + - statefulset + - --namespace + - + - --label + - app=vcluster-etcd + image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8 + imagePullPolicy: IfNotPresent + name: kubernetes-toolkit + restartPolicy: OnFailure + serviceAccountName: kubernetes-toolkit diff --git a/akamai-gitlab/templates/workload-vcluster/provider-config/providerconfig.yaml b/akamai-gitlab/templates/workload-vcluster/provider-config/providerconfig.yaml new file mode 100644 index 000000000..584031233 --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/provider-config/providerconfig.yaml @@ -0,0 +1,51 @@ +apiVersion: tf.upbound.io/v1beta1 +kind: ProviderConfig +metadata: + name: + annotations: + argocd.argoproj.io/sync-wave: "-1" +spec: + configuration: | + terraform { + backend "s3" { + bucket = "" + key = "registry/clusters//infrastructure/provider-config/terraform.tfstate" + endpoint = "https://us-east-1.linodeobjects.com" + + region = "" + + skip_credentials_validation = true + skip_metadata_api_check = true + skip_region_validation = true + force_path_style = true + } + required_providers { + civo = { + source = "civo/civo" + } + kubernetes = { + source = "hashicorp/kubernetes" + version = "2.23.0" + } + vault = { + source = "hashicorp/vault" + version = "3.19.0" + } + } + } + provider "civo" { + region = "" + } + credentials: + - filename: gen-nothing + source: None + secretRef: + namespace: crossplane-system + name: civo-creds + key: token + - filename: .git-credentials + source: Secret + secretRef: + namespace: crossplane-system + name: git-credentials + key: creds diff --git a/akamai-gitlab/templates/workload-vcluster/registry-workload-cluster.yaml b/akamai-gitlab/templates/workload-vcluster/registry-workload-cluster.yaml new file mode 100644 index 000000000..f925b88dd --- /dev/null +++ b/akamai-gitlab/templates/workload-vcluster/registry-workload-cluster.yaml @@ -0,0 +1,30 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: registry- + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '100' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: default + source: + repoURL: + path: registry/clusters/ + targetRevision: HEAD + destination: + server: https://kubernetes.default.svc + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/akamai-gitlab/terraform/akamai/main.tf b/akamai-gitlab/terraform/akamai/main.tf new file mode 100644 index 000000000..0fcb71ab5 --- /dev/null +++ b/akamai-gitlab/terraform/akamai/main.tf @@ -0,0 +1,58 @@ +terraform { + backend "s3" { + bucket = "" + key = "terraform/civo/terraform.tfstate" + endpoint = "https://.us-east-1.linodeobjects.com" #! edit + + region = "us-east-1" #! edit + + skip_credentials_validation = true + skip_metadata_api_check = true + skip_region_validation = true + force_path_style = true + } + required_providers { + linode = { + source = "linode/linode" + version = "2.16.0" + } + kubernetes = { + source = "hashicorp/kubernetes" + version = "2.23.0" + } + vault = { + source = "hashicorp/vault" + version = "3.19.0" + } + } +} +provider "linode" {} + +locals { + cluster_name = "" + kube_config_filename = "../../../kubeconfig" +} + +resource "linode_lke_cluster" "kubefirst" { + label = local.cluster_name + k8s_version = "1.28" + region = "us-central" + tags = [""] + + pool { + # NOTE: If count is undefined, the initial node count will + # equal the minimum autoscaler node count. + type = "" # "g6-standard-4" 4 + + autoscaler { + min = tonumber("") # tonumber() is used for a string token value + max = tonumber("") # tonumber() is used for a string token value + } + } +} + +resource "local_file" "kubeconfig" { + content = base64decode(linode_lke_cluster.kubefirst.kubeconfig) + filename = local.kube_config_filename +} + diff --git a/akamai-gitlab/terraform/gitlab/groups.tf b/akamai-gitlab/terraform/gitlab/groups.tf new file mode 100644 index 000000000..da300caa0 --- /dev/null +++ b/akamai-gitlab/terraform/gitlab/groups.tf @@ -0,0 +1,29 @@ +data "gitlab_group" "owner" { + group_id = tonumber(var.owner_group_id) +} + +resource "gitlab_group" "admins" { + name = "" + path = "" + parent_id = data.gitlab_group.owner.group_id + description = "admins group" +} + +resource "gitlab_group" "developers" { + name = "" + path = "" + parent_id = data.gitlab_group.owner.group_id + description = "developers group" +} + +resource "gitlab_group_share_group" "admins" { + group_id = data.gitlab_group.owner.id + share_group_id = gitlab_group.admins.id + group_access = "owner" +} + +resource "gitlab_group_share_group" "developers" { + group_id = data.gitlab_group.owner.id + share_group_id = gitlab_group.developers.id + group_access = "maintainer" +} diff --git a/akamai-gitlab/terraform/gitlab/main.tf b/akamai-gitlab/terraform/gitlab/main.tf new file mode 100644 index 000000000..a5e31ef65 --- /dev/null +++ b/akamai-gitlab/terraform/gitlab/main.tf @@ -0,0 +1,24 @@ +terraform { + backend "s3" { + bucket = "" + key = "terraform/gitlab/terraform.tfstate" + endpoint = "https://objectstore..civo.com" + + region = "" + + skip_credentials_validation = true + skip_metadata_api_check = true + skip_region_validation = true + force_path_style = true + } + required_providers { + gitlab = { + source = "gitlabhq/gitlab" + version = "15.8.0" + } + aws = { + source = "hashicorp/aws" + version = "~> 4.0" + } + } +} diff --git a/akamai-gitlab/terraform/gitlab/modules/project/main.tf b/akamai-gitlab/terraform/gitlab/modules/project/main.tf new file mode 100644 index 000000000..dd07ab656 --- /dev/null +++ b/akamai-gitlab/terraform/gitlab/modules/project/main.tf @@ -0,0 +1,23 @@ +terraform { + required_providers { + gitlab = { + source = "gitlabhq/gitlab" + version = "15.8.0" + } + } +} + +resource "gitlab_project" "project" { + name = var.project_name + archived = var.archived + visibility_level = "private" + default_branch = var.default_branch + namespace_id = var.group_name + import_url = var.import_url + initialize_with_readme = var.initialize_with_readme + shared_runners_enabled = false + # https://docs.gitlab.com/ee/user/packages/container_registry/ + only_allow_merge_if_all_discussions_are_resolved = true + only_allow_merge_if_pipeline_succeeds = var.only_allow_merge_if_pipeline_succeeds + remove_source_branch_after_merge = var.remove_source_branch_after_merge +} diff --git a/akamai-gitlab/terraform/gitlab/modules/project/outputs.tf b/akamai-gitlab/terraform/gitlab/modules/project/outputs.tf new file mode 100644 index 000000000..2f1cbfd56 --- /dev/null +++ b/akamai-gitlab/terraform/gitlab/modules/project/outputs.tf @@ -0,0 +1,8 @@ +output "repo_url" { + value = gitlab_project.project.web_url + description = "gitlab project url" +} + +output "path" { + value = gitlab_project.project.path_with_namespace +} diff --git a/akamai-gitlab/terraform/gitlab/modules/project/variables.tf b/akamai-gitlab/terraform/gitlab/modules/project/variables.tf new file mode 100644 index 000000000..9fcea95e2 --- /dev/null +++ b/akamai-gitlab/terraform/gitlab/modules/project/variables.tf @@ -0,0 +1,54 @@ +variable "archived" { + description = "whether to archive the repo (make it readonly)" + type = bool + default = false +} + +variable "create_deploy_key" { + description = "whether or not to create a deploy key for ci to commit to the repo" + type = bool + default = false +} + +variable "create_ecr" { + description = "whether or not to create the ecr repository" + type = bool + default = false +} + +variable "default_branch" { + description = "specifies what the default branch is for the repository" + type = string + default = "main" +} + +variable "group_name" { + description = "the group name the repository belongs to" + type = string +} + +variable "import_url" { + description = "import url of the git repository" + type = string + default = null +} +variable "initialize_with_readme" { + description = "whether or not to add a readme at project creation" + type = bool + default = true +} + +variable "only_allow_merge_if_pipeline_succeeds" { + description = "set to true once your branch or mr has a successful pipeline you can depend on" + type = bool +} + +variable "project_name" { + description = "the name of the project" + type = string +} + +variable "remove_source_branch_after_merge" { + description = "whether or not we should remove source branch after a merge" + type = bool +} diff --git a/akamai-gitlab/terraform/gitlab/projects.tf b/akamai-gitlab/terraform/gitlab/projects.tf new file mode 100644 index 000000000..bbf5c01b5 --- /dev/null +++ b/akamai-gitlab/terraform/gitlab/projects.tf @@ -0,0 +1,29 @@ +module "metaphor" { + source = "./modules/project" + group_name = data.gitlab_group.owner.id + project_name = "" + # create_ecr = true + initialize_with_readme = false + only_allow_merge_if_pipeline_succeeds = false + remove_source_branch_after_merge = true +} + +module "gitops" { + source = "./modules/project" + group_name = data.gitlab_group.owner.id + project_name = " " + # create_ecr = true + initialize_with_readme = false + only_allow_merge_if_pipeline_succeeds = false + remove_source_branch_after_merge = true +} + +resource "gitlab_project_hook" "atlantis" { + project = module.gitops.path + url = var.atlantis_repo_webhook_url + token = var.atlantis_repo_webhook_secret + merge_requests_events = true + push_events = true + note_events = true +} + diff --git a/akamai-gitlab/terraform/gitlab/vars.tf b/akamai-gitlab/terraform/gitlab/vars.tf new file mode 100644 index 000000000..c35c799ac --- /dev/null +++ b/akamai-gitlab/terraform/gitlab/vars.tf @@ -0,0 +1,13 @@ +variable "owner_group_id" { + description = "gitlab owner group id" + type = string +} +variable "atlantis_repo_webhook_url" { + description = "webhook url for atlantis for the gitops project" + type = string +} + +variable "atlantis_repo_webhook_secret" { + description = "webhook secret for atlantis for the gitops project" + type = string +} diff --git a/akamai-gitlab/terraform/users/admins/admin-one.tf b/akamai-gitlab/terraform/users/admins/admin-one.tf new file mode 100644 index 000000000..556ad5ff4 --- /dev/null +++ b/akamai-gitlab/terraform/users/admins/admin-one.tf @@ -0,0 +1,19 @@ +# # note: uncomment the below to create a new admin, and be sure to +# # adjust module name admin_one below to your admin's firstname_lastname. +# # create as many admin modules files as you have admin personnel. + +# # For Single Sign On: be sure to also add the new user to the admins-outputs.tf + +# module "admin_one" { +# source = "../modules/user/github" + +# acl_policies = ["admin"] +# email = "your.admin@your-company.io" +# first_name = "Admin" +# github_username = "admin-one-github-username" +# last_name = "One" +# team_id = data.github_team.admins.id +# username = "aone" +# user_disabled = false +# userpass_accessor = data.vault_auth_backend.userpass.accessor +# } diff --git a/akamai-gitlab/terraform/users/admins/admins-outputs.tf b/akamai-gitlab/terraform/users/admins/admins-outputs.tf new file mode 100644 index 000000000..8fe585e05 --- /dev/null +++ b/akamai-gitlab/terraform/users/admins/admins-outputs.tf @@ -0,0 +1,8 @@ +# every admin that is added to the platform will need to have their ID +# added to this list so that its client id is added to the group in vault +output "vault_identity_entity_ids" { + value = [ + module.kbot.vault_identity_entity_id, + # module.admin_one.vault_identity_entity_id, + ] +} diff --git a/akamai-gitlab/terraform/users/admins/data_sources.tf b/akamai-gitlab/terraform/users/admins/data_sources.tf new file mode 100644 index 000000000..1331a4653 --- /dev/null +++ b/akamai-gitlab/terraform/users/admins/data_sources.tf @@ -0,0 +1,7 @@ +data "github_team" "admins" { + slug = "" +} + +data "vault_auth_backend" "userpass" { + path = "userpass" +} diff --git a/akamai-gitlab/terraform/users/admins/kbot.tf b/akamai-gitlab/terraform/users/admins/kbot.tf new file mode 100644 index 000000000..3ffdc1ea0 --- /dev/null +++ b/akamai-gitlab/terraform/users/admins/kbot.tf @@ -0,0 +1,20 @@ +module "kbot" { + # kbot is your automation user for all automation + # on the platform that needs a bot account + source = "../modules/user/github" + + acl_policies = ["admin"] + email = "" + first_name = "K" + github_username = "" + last_name = "Bot" + team_id = data.github_team.admins.id + initial_password = var.initial_password + username = "kbot" + user_disabled = false + userpass_accessor = data.vault_auth_backend.userpass.accessor +} + +variable "initial_password" { + type = string +} diff --git a/akamai-gitlab/terraform/users/developers/data_sources.tf b/akamai-gitlab/terraform/users/developers/data_sources.tf new file mode 100644 index 000000000..471e1c444 --- /dev/null +++ b/akamai-gitlab/terraform/users/developers/data_sources.tf @@ -0,0 +1,7 @@ +data "github_team" "developers" { + slug = "" +} + +data "vault_auth_backend" "userpass" { + path = "userpass" +} diff --git a/akamai-gitlab/terraform/users/developers/developer-one.tf b/akamai-gitlab/terraform/users/developers/developer-one.tf new file mode 100644 index 000000000..7ee54eb6a --- /dev/null +++ b/akamai-gitlab/terraform/users/developers/developer-one.tf @@ -0,0 +1,20 @@ +# # note: uncomment the below to create a new developer, and be sure to +# # adjust module name developer_one below to your developer's firstname_lastname. +# # create as many developer module files as you have developer personnel. + +# # For Single Sign On: be sure to also add the new user to the developers-outputs.tf + +# module "developer_one" { +# source = "../modules/user/github" +# +# acl_policies = ["developer"] +# email = "dev.one@example.com" +# first_name = "Dev" +# github_username = "developer-ones-github-username" +# team_id = data.github_team.developers.id +# last_name = "One" +# username = "done" +# user_disabled = false +# userpass_accessor = data.vault_auth_backend.userpass.accessor +# } +# diff --git a/akamai-gitlab/terraform/users/developers/developers-outputs.tf b/akamai-gitlab/terraform/users/developers/developers-outputs.tf new file mode 100644 index 000000000..f70604e7e --- /dev/null +++ b/akamai-gitlab/terraform/users/developers/developers-outputs.tf @@ -0,0 +1,7 @@ +# every developer that is added to the platform will need to have their ID +# added to this list so that its client id is added to the group in vault +output "vault_identity_entity_ids" { + value = [ + # module.developer_one.vault_identity_entity_id, + ] +} diff --git a/akamai-gitlab/terraform/users/modules/user/github/main.tf b/akamai-gitlab/terraform/users/modules/user/github/main.tf new file mode 100644 index 000000000..1ee0d08a3 --- /dev/null +++ b/akamai-gitlab/terraform/users/modules/user/github/main.tf @@ -0,0 +1,115 @@ +resource "vault_identity_entity" "user" { + name = var.username + disabled = var.user_disabled + metadata = { + email = var.email + first_name = var.first_name + last_name = var.last_name + } +} + +output "vault_identity_entity_id" { + value = vault_identity_entity.user.id +} + +resource "vault_identity_entity_alias" "user" { + name = var.username + mount_accessor = var.userpass_accessor + canonical_id = vault_identity_entity.user.id +} + +resource "random_password" "password" { + length = 25 + special = true + override_special = "!#$@" +} + +resource "vault_generic_endpoint" "user" { + depends_on = [vault_generic_endpoint.user_password] # avoids race condition + path = "auth/userpass/users/${var.username}" + ignore_absent_fields = true + + data_json = jsonencode( + { + policies = var.acl_policies, + token_ttl = "1h" + } + ) +} + +resource "vault_generic_endpoint" "user_password" { + path = "auth/userpass/users/${var.username}" + ignore_absent_fields = true + lifecycle { + ignore_changes = [data_json] + } + + # note: this resource includes the initial password and only gets applied once + # changes to the user should be managed by the vault_generic_endpoint named "user" above + data_json = jsonencode( + { + password = var.initial_password != "" ? var.initial_password : random_password.password.result, + policies = var.acl_policies, + token_ttl = "1h" + } + ) +} + +resource "vault_generic_secret" "user" { + path = "users/${var.username}" + + data_json = <"] + } +} + +data "linode_lke_cluster" "kubefirst" { + id = data.linode_lke_clusters.kubefirst.lke_clusters.0.id +} +resource "vault_auth_backend" "k8s" { + type = "kubernetes" + path = "kubernetes/kubefirst" +} + +resource "vault_kubernetes_auth_backend_config" "k8s" { + backend = vault_auth_backend.k8s.path + kubernetes_host = data.linode_lke_cluster.kubefirst.api_endpoints[0] +} + +resource "vault_kubernetes_auth_backend_role" "k8s_atlantis" { + backend = vault_auth_backend.k8s.path + role_name = "atlantis" + bound_service_account_names = ["atlantis"] + bound_service_account_namespaces = ["*"] + token_ttl = 86400 + token_policies = ["admin", "default"] +} + +resource "vault_kubernetes_auth_backend_role" "k8s_external_secrets" { + backend = vault_auth_backend.k8s.path + role_name = "external-secrets" + bound_service_account_names = ["external-secrets"] + bound_service_account_namespaces = ["*"] + token_ttl = 86400 + token_policies = ["admin", "default"] +} diff --git a/akamai-gitlab/terraform/vault/kv-mounts.tf b/akamai-gitlab/terraform/vault/kv-mounts.tf new file mode 100644 index 000000000..5ff07d6b8 --- /dev/null +++ b/akamai-gitlab/terraform/vault/kv-mounts.tf @@ -0,0 +1,11 @@ +resource "vault_mount" "secret" { + path = "secret" + type = "kv-v2" + description = "the default vault kv v2 backend" +} + +resource "vault_mount" "users" { + path = "users" + type = "kv-v2" + description = "kv v2 backend" +} diff --git a/akamai-gitlab/terraform/vault/main.tf b/akamai-gitlab/terraform/vault/main.tf new file mode 100644 index 000000000..e36f11b0e --- /dev/null +++ b/akamai-gitlab/terraform/vault/main.tf @@ -0,0 +1,27 @@ +terraform { + backend "s3" { + bucket = "" + key = "terraform/vault/terraform.tfstate" + endpoint = "https://.us-east-1.linodeobjects.com" #! edit + + region = "us-east-1" #! edit + + skip_credentials_validation = true + skip_metadata_api_check = true + skip_region_validation = true + force_path_style = true + } + required_providers { + linode = { + source = "linode/linode" + version = "2.16.0" + } + vault = { + source = "hashicorp/vault" + } + } +} + +provider "vault" { + skip_tls_verify = "true" +} diff --git a/akamai-gitlab/terraform/vault/modules/oidc-client/main.tf b/akamai-gitlab/terraform/vault/modules/oidc-client/main.tf new file mode 100644 index 000000000..d9d6be803 --- /dev/null +++ b/akamai-gitlab/terraform/vault/modules/oidc-client/main.tf @@ -0,0 +1,64 @@ +resource "vault_identity_oidc_assignment" "app" { + name = var.app_name + group_ids = var.identity_group_ids +} + +resource "vault_identity_oidc_client" "app" { + name = var.app_name + key = var.oidc_provider_key_name + redirect_uris = var.redirect_uris + assignments = [ + vault_identity_oidc_assignment.app.name, + ] + id_token_ttl = 2400 + access_token_ttl = 7200 + client_type = "confidential" +} + +output "vault_oidc_app_name" { + value = vault_identity_oidc_client.app.name +} + +variable "app_name" { + type = string +} + +variable "identity_group_ids" { + type = list(string) +} + +variable "oidc_provider_key_name" { + type = string +} + +variable "redirect_uris" { + type = list(string) +} + +variable "secret_mount_path" { + type = string +} + +data "vault_identity_oidc_client_creds" "creds" { + name = var.app_name + + depends_on = [ + vault_identity_oidc_client.app + ] + +} + +resource "vault_generic_secret" "creds" { + path = "${var.secret_mount_path}/oidc/${var.app_name}" + + depends_on = [ + vault_identity_oidc_client.app + ] + + data_json = </oauth2/callback", + ] + secret_mount_path = "secret" +} + +module "argocd" { + source = "./modules/oidc-client" + + depends_on = [ + vault_identity_oidc_provider.kubefirst + ] + + app_name = "argocd" + identity_group_ids = [vault_identity_group.admins.id, vault_identity_group.developers.id] + oidc_provider_key_name = vault_identity_oidc_key.key.name + redirect_uris = [ + "/auth/callback", + ] + secret_mount_path = "secret" +} + +module "console" { + source = "./modules/oidc-client" + + depends_on = [ + vault_identity_oidc_provider.kubefirst + ] + + app_name = "console" + identity_group_ids = [vault_identity_group.admins.id, vault_identity_group.developers.id] + oidc_provider_key_name = vault_identity_oidc_key.key.name + redirect_uris = [ + "https://kubefirst./api/auth/callback/vault", + ] + secret_mount_path = "secret" +} + +# todo kubectl-oidc diff --git a/akamai-gitlab/terraform/vault/oidc-groups.tf b/akamai-gitlab/terraform/vault/oidc-groups.tf new file mode 100644 index 000000000..b2cc82df9 --- /dev/null +++ b/akamai-gitlab/terraform/vault/oidc-groups.tf @@ -0,0 +1,33 @@ +resource "vault_identity_group" "developers" { + name = "" + type = "internal" + policies = ["developer"] + + # `resource "vault_identity_group_member_entity_ids"` manages this in `developers.tf` + lifecycle { + ignore_changes = [ + member_entity_ids + ] + } + + metadata = { + version = "2" + } +} + +resource "vault_identity_group" "admins" { + name = "" + type = "internal" + policies = ["admin"] + + # `resource "vault_identity_group_member_entity_ids"` manages this in `admins.tf` + lifecycle { + ignore_changes = [ + member_entity_ids + ] + } + + metadata = { + version = "2" + } +} diff --git a/akamai-gitlab/terraform/vault/oidc-provider.tf b/akamai-gitlab/terraform/vault/oidc-provider.tf new file mode 100644 index 000000000..2d976df8e --- /dev/null +++ b/akamai-gitlab/terraform/vault/oidc-provider.tf @@ -0,0 +1,20 @@ +resource "vault_identity_oidc_key" "key" { + name = "kubefirst" + algorithm = "RS256" + allowed_client_ids = ["*"] # todo make explicit list of client ids +} + +resource "vault_identity_oidc_provider" "kubefirst" { + name = "kubefirst" + https_enabled = true + issuer_host = "" + allowed_client_ids = [ + "*" # todo make explicit list of client ids + ] + scopes_supported = [ + vault_identity_oidc_scope.group_scope.name, + vault_identity_oidc_scope.user_scope.name, + vault_identity_oidc_scope.email_scope.name, + vault_identity_oidc_scope.profile_scope.name + ] +} diff --git a/akamai-gitlab/terraform/vault/oidc-scopes.tf b/akamai-gitlab/terraform/vault/oidc-scopes.tf new file mode 100644 index 000000000..989ac7f30 --- /dev/null +++ b/akamai-gitlab/terraform/vault/oidc-scopes.tf @@ -0,0 +1,42 @@ +resource "vault_identity_oidc_scope" "group_scope" { + name = "groups" + template = <"] @@ -122,6 +100,42 @@ module "eks" { } } + # Enable admin permissions for the cluster creator + enable_cluster_creator_admin_permissions = true + + access_entries = { + + argocd_ = { + cluster_name = "" + principal_arn = "arn:aws:iam:::role/argocd-" + username = "arn:aws:iam:::role/argocd-" + policy_associations = { + view_deployments = { + policy_arn = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSViewPolicy" + access_scope = { + namespaces = ["default"] + type = "namespace" + } + } + } + } + + atlantis_ = { + cluster_name = "" + principal_arn = "arn:aws:iam:::role/atlantis-" + username = "arn:aws:iam:::role/atlantis-" + policy_associations = { + view_deployments = { + policy_arn = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSViewPolicy" + access_scope = { + namespaces = ["default"] + type = "namespace" + } + } + } + } + } + tags = local.tags } @@ -165,7 +179,7 @@ module "vpc" { module "vpc_cni_irsa" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "5.40.0" role_name = upper("VPC-CNI-IRSA-") attach_vpc_cni_policy = true @@ -186,7 +200,7 @@ module "vpc_cni_irsa" { module "aws_ebs_csi_driver" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "5.40.0" role_name = upper("EBS-CSI-DRIVER-") @@ -348,7 +362,7 @@ EOT module "argo_workflows" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "5.40.0" role_name = "argo-${local.name}" role_policy_arns = { @@ -367,7 +381,7 @@ module "argo_workflows" { module "argocd" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "5.40.0" role_name = "argocd-${local.name}" role_policy_arns = { @@ -387,7 +401,7 @@ module "argocd" { module "atlantis" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "5.40.0" role_name = "atlantis-${local.name}" role_policy_arns = { @@ -405,7 +419,7 @@ module "atlantis" { module "cert_manager" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "5.40.0" role_name = "cert-manager-${local.name}" role_policy_arns = { @@ -455,7 +469,7 @@ EOT module "chartmuseum" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "5.40.0" role_name = "chartmuseum-${local.name}" role_policy_arns = { @@ -528,7 +542,7 @@ data "aws_iam_policy_document" "crossplane_custom_trust_policy" { module "ecr_publish_permissions_sync" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "5.40.0" role_name = "ecr-publish-permissions-sync-${local.name}" role_policy_arns = { @@ -547,7 +561,7 @@ module "ecr_publish_permissions_sync" { module "external_dns" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "5.40.0" role_name = "external-dns-${local.name}" role_policy_arns = { @@ -598,7 +612,7 @@ EOT module "kubefirst_api" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "5.40.0" role_name = "kubefirst-api-${local.name}" role_policy_arns = { @@ -618,7 +632,7 @@ module "kubefirst_api" { module "vault" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "5.40.0" role_name = "vault-${local.name}" role_policy_arns = { diff --git a/aws-github/terraform/aws/modules/workload-cluster/main.tf b/aws-github/terraform/aws/modules/workload-cluster/main.tf index c95b575a6..2b5da2eb2 100644 --- a/aws-github/terraform/aws/modules/workload-cluster/main.tf +++ b/aws-github/terraform/aws/modules/workload-cluster/main.tf @@ -1,8 +1,7 @@ -data "aws_caller_identity" "current" {} data "aws_availability_zones" "available" {} locals { - cluster_version = "1.26" + cluster_version = "1.29" vpc_cidr = "10.0.0.0/16" azs = slice(data.aws_availability_zones.available.names, 0, 3) tags = { @@ -13,38 +12,17 @@ locals { ################################################################################ # EKS Module ################################################################################ -module "iam_node_group_role" { - source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role" - - create_role = true - - role_name_prefix = "${var.cluster_name}-node-group" - - custom_role_policy_arns = [ - "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", - "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", - "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", - ] - number_of_custom_role_policy_arns = 3 -} - module "eks" { source = "terraform-aws-modules/eks/aws" - version = "19.10.0" + version = "~> 20.0" cluster_name = var.cluster_name cluster_version = local.cluster_version cluster_endpoint_public_access = true create_kms_key = false cluster_encryption_config = {} - create_iam_role = false - iam_role_arn = module.iam_node_group_role.iam_role_arn + cluster_addons = { - # AWS launch CoreDNS itself with their add-on https://docs.aws.amazon.com/eks/latest/userguide/managing-coredns.html - # coredns = { - # most_recent = true - # resolve_conflicts = "OVERWRITE" - # } aws-ebs-csi-driver = { most_recent = true service_account_role_arn = module.aws_ebs_csi_driver.iam_role_arn @@ -70,21 +48,9 @@ module "eks" { subnet_ids = module.vpc.private_subnets control_plane_subnet_ids = module.vpc.intra_subnets - manage_aws_auth_configmap = false - - # aws_auth_roles = [ - # # managed node group is automatically added to the configmap - # { - # rolearn = "" - # username = "" - # groups = ["system:masters"] - # }, - # ] - eks_managed_node_group_defaults = { ami_type = "AL2_x86_64" instance_types = [var.node_type] - # We are using the IRSA created below for permissions # However, we have to deploy with the policy attached FIRST (when creating a fresh cluster) # and then turn this off after the cluster/node group is created. Without this initial policy, @@ -107,16 +73,23 @@ module "eks" { } } - tags = local.tags + enable_cluster_creator_admin_permissions = true + tags = local.tags } ################################################################################ # Supporting Resources ################################################################################ +# Avoid collisions for generated values +resource "random_integer" "id" { + min = 1000 + max = 9999 +} + module "vpc" { source = "terraform-aws-modules/vpc/aws" - version = "4.0.2" + version = "~> 5.9.0" name = var.cluster_name cidr = local.vpc_cidr @@ -150,7 +123,7 @@ module "vpc" { module "vpc_cni_irsa" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "~> 5.42.0" role_name = upper("VPC-CNI-IRSA-${var.cluster_name}") attach_vpc_cni_policy = true @@ -158,7 +131,6 @@ module "vpc_cni_irsa" { AmazonEKS_CNI_Policy = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy" } - oidc_providers = { main = { provider_arn = module.eks.oidc_provider_arn @@ -171,7 +143,7 @@ module "vpc_cni_irsa" { module "aws_ebs_csi_driver" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "~> 5.42.0" role_name = upper("EBS-CSI-DRIVER-${var.cluster_name}") @@ -190,7 +162,7 @@ module "aws_ebs_csi_driver" { } resource "aws_iam_policy" "aws_ebs_csi_driver" { - name = "aws-ebs-csi-driver-${var.cluster_name}" + name = "aws-ebs-csi-driver-${var.cluster_name}-${random_integer.id.result}" path = "/" description = "policy for aws ebs csi driver" @@ -331,9 +303,10 @@ resource "aws_iam_policy" "aws_ebs_csi_driver" { EOT } + module "cert_manager" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "~> 5.42.0" role_name = "cert-manager-${var.cluster_name}" role_policy_arns = { @@ -350,7 +323,7 @@ module "cert_manager" { } resource "aws_iam_policy" "cert_manager" { - name = "cert-manager-${var.cluster_name}" + name = "cert-manager-${var.cluster_name}-${random_integer.id.result}" path = "/" description = "policy for external dns to access route53 resources" @@ -381,9 +354,10 @@ resource "aws_iam_policy" "cert_manager" { EOT } + module "external_dns" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "~> 5.42.0" role_name = "external-dns-${var.cluster_name}" role_policy_arns = { @@ -400,7 +374,7 @@ module "external_dns" { } resource "aws_iam_policy" "external_dns" { - name = "external-dns-${var.cluster_name}" + name = "external-dns-${var.cluster_name}-${random_integer.id.result}" path = "/" description = "policy for external dns to access route53 resources" diff --git a/aws-github/terraform/aws/modules/workload-cluster/variables.tf b/aws-github/terraform/aws/modules/workload-cluster/variables.tf index b809c8039..01c8d01ea 100644 --- a/aws-github/terraform/aws/modules/workload-cluster/variables.tf +++ b/aws-github/terraform/aws/modules/workload-cluster/variables.tf @@ -19,4 +19,3 @@ variable "node_type" { default = "t3.medium" type = string } - diff --git a/aws-github/terraform/github/repos.tf b/aws-github/terraform/github/repos.tf index 1c3f320ce..c04c7b891 100644 --- a/aws-github/terraform/github/repos.tf +++ b/aws-github/terraform/github/repos.tf @@ -21,7 +21,7 @@ terraform { module "gitops" { source = "./modules/repository" - repo_name = "gitops" + repo_name = "" archive_on_destroy = false auto_init = false # set to false if importing an existing repository team_developers_id = github_team.developers.id @@ -50,7 +50,7 @@ variable "atlantis_repo_webhook_secret" { module "metaphor" { source = "./modules/repository" - repo_name = "metaphor" + repo_name = "" archive_on_destroy = false auto_init = false # set to false if importing an existing repository create_ecr = true diff --git a/aws-github/terraform/github/teams.tf b/aws-github/terraform/github/teams.tf index 355d21b5f..a77f9bae9 100644 --- a/aws-github/terraform/github/teams.tf +++ b/aws-github/terraform/github/teams.tf @@ -1,11 +1,11 @@ resource "github_team" "admins" { - name = "admins" + name = "" description = "administrators of the kubefirst platform" privacy = "closed" } resource "github_team" "developers" { - name = "developers" + name = "" description = "developers using the kubefirst plaftform" privacy = "closed" } diff --git a/aws-github/terraform/users/admins/data_sources.tf b/aws-github/terraform/users/admins/data_sources.tf index a454eea5f..1331a4653 100644 --- a/aws-github/terraform/users/admins/data_sources.tf +++ b/aws-github/terraform/users/admins/data_sources.tf @@ -1,5 +1,5 @@ data "github_team" "admins" { - slug = "admins" + slug = "" } data "vault_auth_backend" "userpass" { diff --git a/aws-github/terraform/users/developers/data_sources.tf b/aws-github/terraform/users/developers/data_sources.tf index 9c5d5c625..471e1c444 100644 --- a/aws-github/terraform/users/developers/data_sources.tf +++ b/aws-github/terraform/users/developers/data_sources.tf @@ -1,5 +1,5 @@ data "github_team" "developers" { - slug = "developers" + slug = "" } data "vault_auth_backend" "userpass" { diff --git a/aws-github/terraform/users/users.tf b/aws-github/terraform/users/users.tf index ec25ff5c8..0cd2fb72d 100644 --- a/aws-github/terraform/users/users.tf +++ b/aws-github/terraform/users/users.tf @@ -15,11 +15,11 @@ terraform { } data "github_team" "admins" { - slug = "admins" + slug = "" } data "github_team" "developers" { - slug = "developers" + slug = "" } data "vault_auth_backend" "userpass" { @@ -27,7 +27,7 @@ data "vault_auth_backend" "userpass" { } data "vault_identity_group" "admins" { - group_name = "admins" + group_name = "" } variable "initial_password" { @@ -52,7 +52,7 @@ resource "vault_identity_group_member_entity_ids" "admins_membership" { # # developers module # data "vault_identity_group" "developers" { -# group_name = "developers" +# group_name = "" # } # module "developers" { diff --git a/aws-github/terraform/vault/oidc-groups.tf b/aws-github/terraform/vault/oidc-groups.tf index 4da060600..b2cc82df9 100644 --- a/aws-github/terraform/vault/oidc-groups.tf +++ b/aws-github/terraform/vault/oidc-groups.tf @@ -1,5 +1,5 @@ resource "vault_identity_group" "developers" { - name = "developers" + name = "" type = "internal" policies = ["developer"] @@ -16,7 +16,7 @@ resource "vault_identity_group" "developers" { } resource "vault_identity_group" "admins" { - name = "admins" + name = "" type = "internal" policies = ["admin"] diff --git a/aws-gitlab/templates/mgmt/components/argo-workflows/vault-wait.yaml b/aws-gitlab/templates/mgmt/components/argo-workflows/vault-wait.yaml index 47beecc62..bde31a201 100644 --- a/aws-gitlab/templates/mgmt/components/argo-workflows/vault-wait.yaml +++ b/aws-gitlab/templates/mgmt/components/argo-workflows/vault-wait.yaml @@ -22,4 +22,3 @@ spec: selfHeal: true syncOptions: - CreateNamespace=true - - Replace=true diff --git a/aws-gitlab/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml b/aws-gitlab/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml index c90d10ff9..d0f9b3f66 100644 --- a/aws-gitlab/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml +++ b/aws-gitlab/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml @@ -23,6 +23,7 @@ kind: Job metadata: annotations: argocd.argoproj.io/sync-wave: '0' + argocd.argoproj.io/sync-options: Force=true,Replace=true name: wait-vault-tls namespace: vault spec: diff --git a/aws-gitlab/templates/mgmt/components/argocd/kustomization.yaml b/aws-gitlab/templates/mgmt/components/argocd/kustomization.yaml index ef44dac20..1b7fd9651 100644 --- a/aws-gitlab/templates/mgmt/components/argocd/kustomization.yaml +++ b/aws-gitlab/templates/mgmt/components/argocd/kustomization.yaml @@ -5,7 +5,7 @@ namespace: argocd # To upgrade ArgoCD, increment the version here # https://github.com/argoproj/argo-cd/tags resources: - - github.com:kubefirst/manifests.git/argocd/cloud?ref=main + - github.com:konstructio/manifests.git/argocd/cloud?ref=v1.1.0 - argocd-ui-ingress.yaml - externalsecrets.yaml - argocd-oidc-restart-job.yaml diff --git a/aws-gitlab/templates/mgmt/components/crossplane/crossplane-system/crossplane-secrets.yaml b/aws-gitlab/templates/mgmt/components/crossplane/crossplane-system/crossplane-secrets.yaml index 72e3d807f..f8ec71b45 100644 --- a/aws-gitlab/templates/mgmt/components/crossplane/crossplane-system/crossplane-secrets.yaml +++ b/aws-gitlab/templates/mgmt/components/crossplane/crossplane-system/crossplane-secrets.yaml @@ -33,7 +33,7 @@ spec: engineVersion: v2 data: creds: | - https://{{ .username }}:{{ .password }}@github.com + https://{{ .username }}:{{ .password }}@gitlab.com secretStoreRef: kind: ClusterSecretStore name: vault-kv-secret @@ -48,4 +48,4 @@ spec: key: crossplane property: password conversionStrategy: Default - secretKey: password \ No newline at end of file + secretKey: password diff --git a/aws-gitlab/templates/mgmt/components/kubefirst/console.yaml b/aws-gitlab/templates/mgmt/components/kubefirst/console.yaml index f9d950528..7d1da9696 100644 --- a/aws-gitlab/templates/mgmt/components/kubefirst/console.yaml +++ b/aws-gitlab/templates/mgmt/components/kubefirst/console.yaml @@ -8,8 +8,8 @@ metadata: spec: project: default source: - repoURL: https://charts.kubefirst.com - targetRevision: 2.4.14-rc39 + repoURL: https://charts.konstruct.io + targetRevision: 2.5.12-rc3 chart: kubefirst helm: values: |- @@ -34,6 +34,10 @@ spec: IN_CLUSTER: "true" CLUSTER_NAME: "" ENTERPRISE_API_URL: "http://kubefirst-kubefirst-api-ee.kubefirst.svc.cluster.local" + serviceAccount: + create: true + annotations: + eks.amazonaws.com/role-arn: arn:aws:iam:::role/kubefirst-api- console: isClusterZero: "false" domain: "" diff --git a/aws-gitlab/templates/workload-cluster/0-providerconfig.yaml b/aws-gitlab/templates/workload-cluster/0-providerconfig.yaml new file mode 100644 index 000000000..cac4df032 --- /dev/null +++ b/aws-gitlab/templates/workload-cluster/0-providerconfig.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -provider-config + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '0' +spec: + project: default + source: + repoURL: + path: registry/clusters//provider-config + targetRevision: HEAD + destination: + name: in-cluster + namespace: crossplane-system + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/aws-gitlab/templates/workload-cluster/10-infrastructure.yaml b/aws-gitlab/templates/workload-cluster/10-infrastructure.yaml new file mode 100644 index 000000000..5e2a0defc --- /dev/null +++ b/aws-gitlab/templates/workload-cluster/10-infrastructure.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -infrastructure + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: + path: registry/clusters//infrastructure + targetRevision: HEAD + destination: + name: in-cluster + namespace: + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/aws-gitlab/templates/workload-cluster/15-infrastructure-bootstrap.yaml b/aws-gitlab/templates/workload-cluster/15-infrastructure-bootstrap.yaml new file mode 100644 index 000000000..73c759631 --- /dev/null +++ b/aws-gitlab/templates/workload-cluster/15-infrastructure-bootstrap.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -infrastructure-bootstrap + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '15' +spec: + project: default + source: + repoURL: + path: registry/clusters//infrastructure-bootstrap + targetRevision: HEAD + destination: + name: in-cluster + namespace: + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/aws-gitlab/templates/workload-cluster/20-argocd-connection.yaml b/aws-gitlab/templates/workload-cluster/20-argocd-connection.yaml new file mode 100644 index 000000000..263636c88 --- /dev/null +++ b/aws-gitlab/templates/workload-cluster/20-argocd-connection.yaml @@ -0,0 +1,54 @@ +apiVersion: "external-secrets.io/v1beta1" +kind: ExternalSecret +metadata: + name: + annotations: + argocd.argoproj.io/sync-wave: '20' + labels: + app.kubernetes.io/part-of: argocd +spec: + target: + name: + template: + metadata: + labels: + argocd.argoproj.io/secret-type: cluster + engineVersion: v2 + data: + name: "{{ .cluster_name }}" + server: "{{ .host }}" + clusterResources: "true" + config: | + { + "awsAuthConfig": { + "clusterName": "{{ .cluster_name }}", + "roleARN": "{{ .argocd_role_arn }}" + }, + "tlsClientConfig": { + "insecure": false, + "caData": "{{ .cluster_ca_certificate }}" + } + } + secretStoreRef: + kind: ClusterSecretStore + name: vault-kv-secret + refreshInterval: 10s + data: + - remoteRef: + key: clusters/ + property: argocd_role_arn + conversionStrategy: Default + secretKey: argocd_role_arn + - remoteRef: + key: clusters/ + property: cluster_ca_certificate + conversionStrategy: Default + secretKey: cluster_ca_certificate + - remoteRef: + key: clusters/ + property: cluster_name + secretKey: cluster_name + - remoteRef: + key: clusters/ + property: host + secretKey: host diff --git a/aws-gitlab/templates/workload-cluster/30-cert-manager.yaml b/aws-gitlab/templates/workload-cluster/30-cert-manager.yaml new file mode 100644 index 000000000..676bfa216 --- /dev/null +++ b/aws-gitlab/templates/workload-cluster/30-cert-manager.yaml @@ -0,0 +1,32 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -cert-manager + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: + source: + repoURL: https://charts.jetstack.io + targetRevision: v1.14.4 + helm: + values: |- + serviceAccount: + create: true + name: cert-manager + annotations: + eks.amazonaws.com/role-arn: 'arn:aws:iam:::role/cert-manager-' + installCRDs: true + chart: cert-manager + destination: + name: + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/aws-gitlab/templates/workload-cluster/30-external-dns.yaml b/aws-gitlab/templates/workload-cluster/30-external-dns.yaml new file mode 100644 index 000000000..f19ed5c5e --- /dev/null +++ b/aws-gitlab/templates/workload-cluster/30-external-dns.yaml @@ -0,0 +1,44 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -external-dns + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: + source: + repoURL: https://kubernetes-sigs.github.io/external-dns + targetRevision: 1.14.4 + helm: + releaseName: external-dns + values: | + image: + repository: registry.k8s.io/external-dns/external-dns + tag: "v0.13.2" + serviceAccount: + create: true + name: external-dns + annotations: + eks.amazonaws.com/role-arn: 'arn:aws:iam:::role/external-dns-' + provider: + sources: + - ingress + domainFilters: + - + env: + - name: + valueFrom: + secretKeyRef: + name: external-dns-secrets + key: token + chart: external-dns + destination: + name: + namespace: external-dns + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/aws-gitlab/templates/workload-cluster/30-external-secrets-operator.yaml b/aws-gitlab/templates/workload-cluster/30-external-secrets-operator.yaml new file mode 100644 index 000000000..c09c2bc73 --- /dev/null +++ b/aws-gitlab/templates/workload-cluster/30-external-secrets-operator.yaml @@ -0,0 +1,71 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -external-secrets-operator + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: + source: + repoURL: https://charts.external-secrets.io + targetRevision: 0.8.1 + helm: + values: |- + serviceAccount: + create: false + name: external-secrets + chart: external-secrets + destination: + name: + namespace: external-secrets-operator + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - RespectIgnoreDifferences=true + ignoreDifferences: + - group: apiextensions.k8s.io + kind: CustomResourceDefinition + jqPathExpressions: + - .spec.conversion.webhook.clientConfig.caBundle + - .spec.conversion.webhook.clientConfig.service.name + - .spec.conversion.webhook.clientConfig.service.namespace + - group: admissionregistration.k8s.io + kind: ValidatingWebhookConfiguration + jqPathExpressions: + - .webhooks[]?.clientConfig.caBundle +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: -eso-kubernetes-external-secrets-auth + annotations: + argocd.argoproj.io/sync-wave: '40' +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: 'system:auth-delegator' +subjects: + - kind: ServiceAccount + name: external-secrets + namespace: external-secrets-operator +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: -eso-kubernetes-external-secrets-auth2 + annotations: + argocd.argoproj.io/sync-wave: '40' +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: 'cluster-admin' +subjects: + - kind: ServiceAccount + name: external-secrets + namespace: external-secrets-operator diff --git a/aws-gitlab/templates/workload-cluster/30-ingress-nginx.yaml b/aws-gitlab/templates/workload-cluster/30-ingress-nginx.yaml new file mode 100644 index 000000000..b858bdf69 --- /dev/null +++ b/aws-gitlab/templates/workload-cluster/30-ingress-nginx.yaml @@ -0,0 +1,36 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -ingress-nginx + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: + source: + repoURL: https://kubernetes.github.io/ingress-nginx + targetRevision: 4.10.0 + helm: + values: |- + controller: + ingressClass: nginx + publishService: + enabled: true + service: + annotations: + service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" + service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "60" + extraArgs: + enable-ssl-passthrough: true + chart: ingress-nginx + destination: + name: + namespace: ingress-nginx + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/aws-gitlab/templates/workload-cluster/30-reloader.yaml b/aws-gitlab/templates/workload-cluster/30-reloader.yaml new file mode 100644 index 000000000..2336f6b12 --- /dev/null +++ b/aws-gitlab/templates/workload-cluster/30-reloader.yaml @@ -0,0 +1,31 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -reloader + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: + source: + repoURL: 'https://stakater.github.io/stakater-charts' + targetRevision: v1.0.10 + chart: reloader + helm: + values: |- + ignoreSecrets: false + destination: + name: + namespace: reloader + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/aws-gitlab/templates/workload-cluster/40-clusterissuers.yaml b/aws-gitlab/templates/workload-cluster/40-clusterissuers.yaml new file mode 100644 index 000000000..e45d89d86 --- /dev/null +++ b/aws-gitlab/templates/workload-cluster/40-clusterissuers.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -cert-issuers + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '40' +spec: + project: + source: + repoURL: + path: registry/clusters//cert-issuers + targetRevision: HEAD + destination: + name: + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/aws-gitlab/templates/workload-cluster/40-clustersecretstore.yaml b/aws-gitlab/templates/workload-cluster/40-clustersecretstore.yaml new file mode 100644 index 000000000..82bbdf5e3 --- /dev/null +++ b/aws-gitlab/templates/workload-cluster/40-clustersecretstore.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -cluster-secret-store + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '40' +spec: + project: + source: + repoURL: + path: registry/clusters//cluster-secret-store + targetRevision: HEAD + destination: + name: + namespace: external-secrets-operator + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/aws-gitlab/templates/workload-cluster/45-environment.yaml b/aws-gitlab/templates/workload-cluster/45-environment.yaml new file mode 100644 index 000000000..0b6165033 --- /dev/null +++ b/aws-gitlab/templates/workload-cluster/45-environment.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: -environment + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '45' +spec: + project: default + source: + repoURL: + path: registry/environments/ + targetRevision: HEAD + destination: + name: in-cluster + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/aws-gitlab/templates/workload-cluster/appproject-workload-cluster.yaml b/aws-gitlab/templates/workload-cluster/appproject-workload-cluster.yaml new file mode 100644 index 000000000..cca9c21f2 --- /dev/null +++ b/aws-gitlab/templates/workload-cluster/appproject-workload-cluster.yaml @@ -0,0 +1,55 @@ +apiVersion: argoproj.io/v1alpha1 +kind: AppProject +metadata: + name: + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "-1" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + description: description + sourceRepos: + - '' + - 'https://kubernetes.github.io/ingress-nginx' + - 'https://kubernetes-sigs.github.io/external-dns' + - 'https://charts.jetstack.io' + - 'https://charts.external-secrets.io' + - 'https://helm.datadoghq.com' + - 'https://stakater.github.io/stakater-charts' + - 'https://chartmuseum.feedkray.one' + - 'https://charts.loft.sh' + - 'https://github.com/cloudflare/origin-ca-issuer' + - 'https://cloudflare.github.io/origin-ca-issuer/charts' + - '*' # Adding wildcard for the gitops catalog. This wildcard can be removed from the template or after provisioning + destinations: + - namespace: external-dns + name: + - namespace: datadog + name: + - namespace: default + name: + - namespace: + name: + - namespace: external-secrets-operator + name: + - namespace: reloader + name: + - namespace: cert-manager + name: + - namespace: ingress-nginx + name: + - namespace: kube-system + name: + - namespace: '*' # Adding wildcard for the gitops catalog. This wildcard can be removed from the template or after provisioning + server: '*' # Adding wildcard for the gitops catalog. This wildcard can be removed from the template or after provisioning + clusterResourceWhitelist: + - group: '*' + kind: '*' + roles: + - description: -admin-role + groups: + - admins + name: admin-role + policies: + - p, proj::admin-role, applications, *, /*, allow \ No newline at end of file diff --git a/aws-gitlab/templates/workload-cluster/cert-issuers/clusterissuers.yaml b/aws-gitlab/templates/workload-cluster/cert-issuers/clusterissuers.yaml new file mode 100644 index 000000000..97711a762 --- /dev/null +++ b/aws-gitlab/templates/workload-cluster/cert-issuers/clusterissuers.yaml @@ -0,0 +1,29 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-staging +spec: + acme: + server: https://acme-staging-v02.api.letsencrypt.org/directory + email: + privateKeySecretRef: + name: letsencrypt-staging + solvers: + - http01: + ingress: + class: nginx +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-prod +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + email: + privateKeySecretRef: + name: letsencrypt-prod + solvers: + - http01: + ingress: + class: nginx diff --git a/aws-gitlab/templates/workload-cluster/cluster-secret-store/clustersecretstore.yaml b/aws-gitlab/templates/workload-cluster/cluster-secret-store/clustersecretstore.yaml new file mode 100644 index 000000000..b6e90f68a --- /dev/null +++ b/aws-gitlab/templates/workload-cluster/cluster-secret-store/clustersecretstore.yaml @@ -0,0 +1,18 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ClusterSecretStore +metadata: + name: -vault-kv-secret + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + provider: + vault: + server: 'https://vault.' + path: 'secret' + version: 'v2' + auth: + # points to a secret that contains a vault token + # https://www.vaultproject.io/docs/auth/token + tokenSecretRef: + name: "-cluster-vault-bootstrap" + key: "vault-token" diff --git a/aws-gitlab/templates/workload-cluster/infrastructure-bootstrap/wait.yaml b/aws-gitlab/templates/workload-cluster/infrastructure-bootstrap/wait.yaml new file mode 100644 index 000000000..fa6ee5794 --- /dev/null +++ b/aws-gitlab/templates/workload-cluster/infrastructure-bootstrap/wait.yaml @@ -0,0 +1,24 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: -infrastructure-bootstrap-wait + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "20" +spec: + template: + spec: + serviceAccountName: argocd-server + containers: + - name: wait + image: bitnami/kubectl:1.25.12 + command: + - /bin/sh + - -c + - | + while ! kubectl wait --for=jsonpath='{.status.conditions[0].status}'='True' workspace/-infrastructure-bootstrap; do echo "waiting for cluster to provision"; sleep 5; done + restartPolicy: Never + backoffLimit: 1 + + + diff --git a/aws-gitlab/templates/workload-cluster/infrastructure-bootstrap/workspace.yaml b/aws-gitlab/templates/workload-cluster/infrastructure-bootstrap/workspace.yaml new file mode 100644 index 000000000..c30fc4a41 --- /dev/null +++ b/aws-gitlab/templates/workload-cluster/infrastructure-bootstrap/workspace.yaml @@ -0,0 +1,13 @@ +apiVersion: tf.upbound.io/v1beta1 +kind: Workspace +metadata: + name: -infrastructure-bootstrap +spec: + providerConfigRef: + name: + forProvider: + source: Remote + module: + vars: + - key: cluster_name + value: "" \ No newline at end of file diff --git a/aws-gitlab/templates/workload-cluster/infrastructure/wait.yaml b/aws-gitlab/templates/workload-cluster/infrastructure/wait.yaml new file mode 100644 index 000000000..233111aaa --- /dev/null +++ b/aws-gitlab/templates/workload-cluster/infrastructure/wait.yaml @@ -0,0 +1,24 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: -infrastructure-wait + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "20" +spec: + template: + spec: + serviceAccountName: argocd-server + containers: + - name: wait + image: bitnami/kubectl:1.25.12 + command: + - /bin/sh + - -c + - | + while ! kubectl wait --for=jsonpath='{.status.conditions[0].status}'='True' workspace/-infrastructure; do echo "waiting for cluster to provision"; sleep 5; done + restartPolicy: Never + backoffLimit: 1 + + + diff --git a/aws-gitlab/templates/workload-cluster/infrastructure/workspace.yaml b/aws-gitlab/templates/workload-cluster/infrastructure/workspace.yaml new file mode 100644 index 000000000..786561e72 --- /dev/null +++ b/aws-gitlab/templates/workload-cluster/infrastructure/workspace.yaml @@ -0,0 +1,19 @@ +apiVersion: tf.upbound.io/v1beta1 +kind: Workspace +metadata: + name: -infrastructure +spec: + providerConfigRef: + name: + forProvider: + source: Remote + module: + vars: + - key: cluster_name + value: "" + - key: cluster_region + value: "" + - key: node_count + value: "" + - key: node_type + value: "" diff --git a/aws-gitlab/templates/workload-cluster/provider-config/providerconfig.yaml b/aws-gitlab/templates/workload-cluster/provider-config/providerconfig.yaml new file mode 100644 index 000000000..a9e5c13dc --- /dev/null +++ b/aws-gitlab/templates/workload-cluster/provider-config/providerconfig.yaml @@ -0,0 +1,46 @@ +apiVersion: tf.upbound.io/v1beta1 +kind: ProviderConfig +metadata: + name: + annotations: + argocd.argoproj.io/sync-wave: "-1" +spec: + configuration: | + terraform { + backend "s3" { + bucket = "" + key = "registry/clusters//infrastructure/provider-config/terraform.tfstate" + region = "" + encrypt = true + } + required_providers { + kubernetes = { + source = "hashicorp/kubernetes" + version = "2.23.0" + } + vault = { + source = "hashicorp/vault" + version = "3.19.0" + } + aws = { + source = "hashicorp/aws" + version = "5.30.0" + } + } + } + provider "aws" { + region = "" + } + credentials: + - filename: gen-nothing + source: None + secretRef: + namespace: crossplane-system + name: no-creds + key: token + - filename: .git-credentials + source: Secret + secretRef: + namespace: crossplane-system + name: git-credentials + key: creds diff --git a/aws-gitlab/templates/workload-cluster/registry-workload-cluster.yaml b/aws-gitlab/templates/workload-cluster/registry-workload-cluster.yaml new file mode 100644 index 000000000..f925b88dd --- /dev/null +++ b/aws-gitlab/templates/workload-cluster/registry-workload-cluster.yaml @@ -0,0 +1,30 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: registry- + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '100' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: default + source: + repoURL: + path: registry/clusters/ + targetRevision: HEAD + destination: + server: https://kubernetes.default.svc + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/aws-gitlab/terraform/aws/eks/main.tf b/aws-gitlab/terraform/aws/eks/main.tf index 8330ba014..40ddbe366 100644 --- a/aws-gitlab/terraform/aws/eks/main.tf +++ b/aws-gitlab/terraform/aws/eks/main.tf @@ -19,7 +19,7 @@ data "aws_availability_zones" "available" {} locals { name = "" - cluster_version = "1.26" + cluster_version = "1.29" region = "" vpc_cidr = "10.0.0.0/16" @@ -36,7 +36,7 @@ locals { module "eks" { source = "terraform-aws-modules/eks/aws" - version = "19.10.0" + version = "20.20.0" cluster_name = local.name cluster_version = local.cluster_version @@ -74,8 +74,6 @@ module "eks" { subnet_ids = module.vpc.private_subnets control_plane_subnet_ids = module.vpc.intra_subnets - manage_aws_auth_configmap = false - eks_managed_node_group_defaults = { ami_type = "AL2_x86_64" instance_types = [""] @@ -87,14 +85,8 @@ module "eks" { # See https://github.com/aws/containers-roadmap/issues/1666 for more context iam_role_attach_cni_policy = true } - iam_role_additional_policies = { - - } - + eks_managed_node_groups = { - iam_role_additional_policies = { - S3Access = "arn:aws:iam::126827061464:policy/cert-manager-cyje-77" - } # Default node group - as provided by AWS EKS default_node_group = { desired_size = tonumber("") # tonumber() is used for a string token value @@ -108,6 +100,42 @@ module "eks" { } } + # Enable admin permissions for the cluster creator + enable_cluster_creator_admin_permissions = true + + access_entries = { + + argocd_ = { + cluster_name = "" + principal_arn = "arn:aws:iam:::role/argocd-" + username = "arn:aws:iam:::role/argocd-" + policy_associations = { + view_deployments = { + policy_arn = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSViewPolicy" + access_scope = { + namespaces = ["default"] + type = "namespace" + } + } + } + } + + atlantis_ = { + cluster_name = "" + principal_arn = "arn:aws:iam:::role/atlantis-" + username = "arn:aws:iam:::role/atlantis-" + policy_associations = { + view_deployments = { + policy_arn = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSViewPolicy" + access_scope = { + namespaces = ["default"] + type = "namespace" + } + } + } + } + } + tags = local.tags } @@ -151,7 +179,7 @@ module "vpc" { module "vpc_cni_irsa" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "5.40.0" role_name = upper("VPC-CNI-IRSA-") attach_vpc_cni_policy = true @@ -159,6 +187,8 @@ module "vpc_cni_irsa" { AmazonEKS_CNI_Policy = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy" } + + oidc_providers = { main = { provider_arn = module.eks.oidc_provider_arn @@ -171,7 +201,7 @@ module "vpc_cni_irsa" { module "aws_ebs_csi_driver" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "5.40.0" role_name = upper("EBS-CSI-DRIVER-") @@ -333,7 +363,7 @@ EOT module "argo_workflows" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "5.40.0" role_name = "argo-${local.name}" role_policy_arns = { @@ -350,9 +380,29 @@ module "argo_workflows" { tags = local.tags } +module "argocd" { + source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" + version = "5.40.0" + + role_name = "argocd-${local.name}" + role_policy_arns = { + argocd = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess", + } + assume_role_condition_test = "StringLike" + allow_self_assume_role = true + oidc_providers = { + main = { + provider_arn = module.eks.oidc_provider_arn + namespace_service_accounts = ["argocd:argocd-application-controller", "argocd:argocd-server"] + } + } + + tags = local.tags +} + module "atlantis" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "5.40.0" role_name = "atlantis-${local.name}" role_policy_arns = { @@ -370,7 +420,7 @@ module "atlantis" { module "cert_manager" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "5.40.0" role_name = "cert-manager-${local.name}" role_policy_arns = { @@ -420,7 +470,7 @@ EOT module "chartmuseum" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "5.40.0" role_name = "chartmuseum-${local.name}" role_policy_arns = { @@ -436,29 +486,92 @@ module "chartmuseum" { tags = local.tags } -module "crossplane" { - source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" +module "crossplane_custom_trust" { + source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role" + version = "5.33.0" +module "crossplane_custom_trust" { + source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role" + version = "5.33.0" + create_role = true + create_role = true role_name = "crossplane-${local.name}" - role_policy_arns = { - crossplane = "arn:aws:iam::aws:policy/AdministratorAccess", + + create_custom_role_trust_policy = true + custom_role_trust_policy = data.aws_iam_policy_document.crossplane_custom_trust_policy.json + custom_role_policy_arns = ["arn:aws:iam::aws:policy/AdministratorAccess"] +} + +data "aws_iam_policy_document" "crossplane_custom_trust_policy" { + statement { + effect = "Allow" + actions = ["sts:AssumeRoleWithWebIdentity"] + + condition { + test = "StringEquals" + variable = "${split("arn:aws:iam:::oidc-provider/", module.eks.oidc_provider_arn)[1]}:aud" + values = ["sts.amazonaws.com"] + } + + condition { + test = "StringLike" + variable = "${split("arn:aws:iam:::oidc-provider/", module.eks.oidc_provider_arn)[1]}:sub" + values = ["system:serviceaccount:crossplane-system:crossplane-provider-terraform-"] + } + + principals { + type = "Federated" + identifiers = [module.eks.oidc_provider_arn] + } } - assume_role_condition_test = "StringLike" - oidc_providers = { - main = { - provider_arn = module.eks.oidc_provider_arn - namespace_service_accounts = ["crossplane-system:crossplane-provider-terraform-*"] + statement { + effect = "Allow" + actions = ["sts:AssumeRole"] + + principals { + type = "AWS" + identifiers = ["arn:aws:iam:::role/KubernetesAdmin"] } } + statement { + effect = "Allow" + actions = ["sts:AssumeRole"] - tags = local.tags + principals { + type = "AWS" + identifiers = ["arn:aws:iam:::role/argocd-${local.name}"] + } + } + + principals { + type = "Federated" + identifiers = [module.eks.oidc_provider_arn] + } + } + statement { + effect = "Allow" + actions = ["sts:AssumeRole"] + + principals { + type = "AWS" + identifiers = ["arn:aws:iam:::role/KubernetesAdmin"] + } + } + statement { + effect = "Allow" + actions = ["sts:AssumeRole"] + + principals { + type = "AWS" + identifiers = ["arn:aws:iam:::role/argocd-${local.name}"] + } + } } module "ecr_publish_permissions_sync" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "5.40.0" role_name = "ecr-publish-permissions-sync-${local.name}" role_policy_arns = { @@ -477,7 +590,7 @@ module "ecr_publish_permissions_sync" { module "external_dns" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "5.40.0" role_name = "external-dns-${local.name}" role_policy_arns = { @@ -526,9 +639,29 @@ resource "aws_iam_policy" "external_dns" { EOT } +module "kubefirst_api" { + source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" + version = "5.40.0" + + role_name = "kubefirst-api-${local.name}" + role_policy_arns = { + kubefirst = "arn:aws:iam::aws:policy/AmazonEC2FullAccess", + } + assume_role_condition_test = "StringLike" + allow_self_assume_role = true + oidc_providers = { + main = { + provider_arn = module.eks.oidc_provider_arn + namespace_service_accounts = ["kubefirst:kubefirst-kubefirst-api"] + } + } + + tags = local.tags +} + module "vault" { source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "5.32.0" + version = "5.40.0" role_name = "vault-${local.name}" role_policy_arns = { diff --git a/aws-gitlab/terraform/aws/modules/bootstrap/bootstrap.tf b/aws-gitlab/terraform/aws/modules/bootstrap/bootstrap.tf new file mode 100644 index 000000000..08465c502 --- /dev/null +++ b/aws-gitlab/terraform/aws/modules/bootstrap/bootstrap.tf @@ -0,0 +1,127 @@ + +data "vault_generic_secret" "cluster" { + path = "secret/clusters/${var.cluster_name}" +} + +data "aws_eks_cluster" "cluster" { + name = var.cluster_name +} + +data "aws_eks_cluster_auth" "cluster" { + name = var.cluster_name +} + +provider "kubernetes" { + host = data.vault_generic_secret.cluster.data["host"] + cluster_ca_certificate = base64decode(data.vault_generic_secret.cluster.data["cluster_ca_certificate"]) + token = data.aws_eks_cluster_auth.cluster.token +} + +resource "kubernetes_namespace_v1" "external_dns" { + metadata { + name = "external-dns" + } +} + +data "vault_generic_secret" "external_dns" { + path = "secret/external-dns" +} + +resource "kubernetes_secret_v1" "external_dns" { + metadata { + name = "external-dns-secrets" + namespace = kubernetes_namespace_v1.external_dns.metadata.0.name + } + data = { + token = data.vault_generic_secret.external_dns.data["token"] + } + type = "Opaque" +} + +resource "kubernetes_namespace_v1" "external_secrets_operator" { + metadata { + name = "external-secrets-operator" + } +} + +resource "kubernetes_namespace_v1" "environment" { + metadata { + name = var.cluster_name + } +} + +data "vault_generic_secret" "docker_config" { + path = "secret/dockerconfigjson" +} + +resource "kubernetes_secret_v1" "image_pull" { + metadata { + name = "docker-config" + namespace = kubernetes_namespace_v1.environment.metadata.0.name + } + + data = { + ".dockerconfigjson" = data.vault_generic_secret.docker_config.data["dockerconfig"] + } + + type = "kubernetes.io/dockerconfigjson" +} + +data "vault_generic_secret" "external_secrets_operator" { + path = "secret/atlantis" +} + +resource "kubernetes_secret_v1" "external_secrets_operator_environment" { + metadata { + name = "${var.cluster_name}-cluster-vault-bootstrap" + namespace = kubernetes_namespace_v1.environment.metadata.0.name + } + data = { + vault-token = data.vault_generic_secret.external_secrets_operator.data["VAULT_TOKEN"] + } + type = "Opaque" +} + +resource "kubernetes_secret_v1" "external_secrets_operator" { + metadata { + name = "${var.cluster_name}-cluster-vault-bootstrap" + namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name + } + data = { + vault-token = data.vault_generic_secret.external_secrets_operator.data["VAULT_TOKEN"] + } + type = "Opaque" +} + +resource "kubernetes_service_account_v1" "external_secrets" { + metadata { + name = "external-secrets" + namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name + } + secret { + name = "external-secrets-token" + } +} + +resource "kubernetes_secret_v1" "external_secrets" { + metadata { + name = "external-secrets-token" + namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name + annotations = { + "kubernetes.io/service-account.name" = "external-secrets" + } + } + type = "kubernetes.io/service-account-token" + depends_on = [kubernetes_service_account_v1.external_secrets] +} + +resource "kubernetes_config_map" "kubefirst_cm" { + metadata { + name = "kubefirst-cm" + namespace = "kube-system" + } + + data = { + mgmt_cluster_id = "8ikfaj" + } +} diff --git a/aws-gitlab/terraform/aws/modules/bootstrap/variables.tf b/aws-gitlab/terraform/aws/modules/bootstrap/variables.tf new file mode 100644 index 000000000..880ddbcf0 --- /dev/null +++ b/aws-gitlab/terraform/aws/modules/bootstrap/variables.tf @@ -0,0 +1,4 @@ +variable "cluster_name" { + description = "the name of the cluster" + type = string +} diff --git a/aws-gitlab/terraform/aws/modules/workload-cluster/main.tf b/aws-gitlab/terraform/aws/modules/workload-cluster/main.tf new file mode 100644 index 000000000..c95b575a6 --- /dev/null +++ b/aws-gitlab/terraform/aws/modules/workload-cluster/main.tf @@ -0,0 +1,447 @@ +data "aws_caller_identity" "current" {} +data "aws_availability_zones" "available" {} + +locals { + cluster_version = "1.26" + vpc_cidr = "10.0.0.0/16" + azs = slice(data.aws_availability_zones.available.names, 0, 3) + tags = { + kubefirst = "true" + } +} + +################################################################################ +# EKS Module +################################################################################ +module "iam_node_group_role" { + source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role" + + create_role = true + + role_name_prefix = "${var.cluster_name}-node-group" + + custom_role_policy_arns = [ + "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", + "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", + "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy", + ] + number_of_custom_role_policy_arns = 3 +} + +module "eks" { + source = "terraform-aws-modules/eks/aws" + version = "19.10.0" + + cluster_name = var.cluster_name + cluster_version = local.cluster_version + cluster_endpoint_public_access = true + create_kms_key = false + cluster_encryption_config = {} + create_iam_role = false + iam_role_arn = module.iam_node_group_role.iam_role_arn + cluster_addons = { + # AWS launch CoreDNS itself with their add-on https://docs.aws.amazon.com/eks/latest/userguide/managing-coredns.html + # coredns = { + # most_recent = true + # resolve_conflicts = "OVERWRITE" + # } + aws-ebs-csi-driver = { + most_recent = true + service_account_role_arn = module.aws_ebs_csi_driver.iam_role_arn + } + kube-proxy = { + most_recent = true + } + vpc-cni = { + most_recent = true + before_compute = true + service_account_role_arn = module.vpc_cni_irsa.iam_role_arn + configuration_values = jsonencode({ + env = { + # Reference docs https://docs.aws.amazon.com/eks/latest/userguide/cni-increase-ip-addresses.html + ENABLE_PREFIX_DELEGATION = "true" + WARM_PREFIX_TARGET = "1" + } + }) + } + } + + vpc_id = module.vpc.vpc_id + subnet_ids = module.vpc.private_subnets + control_plane_subnet_ids = module.vpc.intra_subnets + + manage_aws_auth_configmap = false + + # aws_auth_roles = [ + # # managed node group is automatically added to the configmap + # { + # rolearn = "" + # username = "" + # groups = ["system:masters"] + # }, + # ] + + eks_managed_node_group_defaults = { + ami_type = "AL2_x86_64" + instance_types = [var.node_type] + + # We are using the IRSA created below for permissions + # However, we have to deploy with the policy attached FIRST (when creating a fresh cluster) + # and then turn this off after the cluster/node group is created. Without this initial policy, + # the VPC CNI fails to assign IPs and nodes cannot join the cluster + # See https://github.com/aws/containers-roadmap/issues/1666 for more context + iam_role_attach_cni_policy = true + } + + eks_managed_node_groups = { + # Default node group - as provided by AWS EKS + default_node_group = { + desired_size = tonumber(var.node_count) # tonumber() is used for a string token value + min_size = tonumber(var.node_count) # tonumber() is used for a string token value + max_size = tonumber(var.node_count) # tonumber() is used for a string token value + # By default, the module creates a launch template to ensure tags are propagated to instances, etc., + # so we need to disable it to use the default template provided by the AWS EKS managed node group service + use_custom_launch_template = false + + disk_size = 50 + } + } + + tags = local.tags +} + +################################################################################ +# Supporting Resources +################################################################################ + +module "vpc" { + source = "terraform-aws-modules/vpc/aws" + version = "4.0.2" + + name = var.cluster_name + cidr = local.vpc_cidr + + azs = local.azs + private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)] + public_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 48)] + intra_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 52)] + + enable_ipv6 = true + create_egress_only_igw = true + + public_subnet_ipv6_prefixes = [0, 1, 2] + private_subnet_ipv6_prefixes = [3, 4, 5] + intra_subnet_ipv6_prefixes = [6, 7, 8] + + enable_nat_gateway = true + single_nat_gateway = true + enable_dns_hostnames = true + + public_subnet_tags = { + "kubernetes.io/role/elb" = 1 + } + + private_subnet_tags = { + "kubernetes.io/role/internal-elb" = 1 + } + + tags = local.tags +} + +module "vpc_cni_irsa" { + source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" + version = "5.32.0" + + role_name = upper("VPC-CNI-IRSA-${var.cluster_name}") + attach_vpc_cni_policy = true + role_policy_arns = { + AmazonEKS_CNI_Policy = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy" + } + + + oidc_providers = { + main = { + provider_arn = module.eks.oidc_provider_arn + namespace_service_accounts = ["kube-system:aws-node"] + } + } + + tags = local.tags +} + +module "aws_ebs_csi_driver" { + source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" + version = "5.32.0" + + role_name = upper("EBS-CSI-DRIVER-${var.cluster_name}") + + role_policy_arns = { + admin = aws_iam_policy.aws_ebs_csi_driver.arn + } + + oidc_providers = { + main = { + provider_arn = module.eks.oidc_provider_arn + namespace_service_accounts = ["kube-system:aws-node", "kube-system:ebs-csi-controller-sa"] + } + } + + tags = local.tags +} + +resource "aws_iam_policy" "aws_ebs_csi_driver" { + name = "aws-ebs-csi-driver-${var.cluster_name}" + path = "/" + description = "policy for aws ebs csi driver" + + policy = <; do echo "waiting for cluster to provision"; sleep 5; done + while ! kubectl wait --for=jsonpath='{.status.conditions[0].status}'='True' workspace/-infrastructure; do echo "waiting for cluster to provision"; sleep 5; done restartPolicy: Never backoffLimit: 1 diff --git a/civo-github/templates/workload-cluster/infrastructure/workspace.yaml b/civo-github/templates/workload-cluster/infrastructure/workspace.yaml index 8aba21372..e5835a10a 100644 --- a/civo-github/templates/workload-cluster/infrastructure/workspace.yaml +++ b/civo-github/templates/workload-cluster/infrastructure/workspace.yaml @@ -1,235 +1,21 @@ apiVersion: tf.upbound.io/v1beta1 kind: Workspace metadata: - name: - annotations: - argocd.argoproj.io/sync-wave: "10" - crossplane.io/external-name: + name: -infrastructure spec: - providerConfigRef: + providerConfigRef: name: forProvider: - source: Inline - module: | - variable "instance_size" { - type = string - default = "g4s.kube.medium" - } - - variable "node_count" { - type = number - default = "" - } - - locals { - cluster_name = "" - } - - resource "civo_network" "kubefirst" { - label = local.cluster_name - } - - resource "civo_firewall" "kubefirst" { - name = local.cluster_name - network_id = civo_network.kubefirst.id - create_default_rules = true - } - - resource "civo_kubernetes_cluster" "kubefirst" { - name = local.cluster_name - network_id = civo_network.kubefirst.id - firewall_id = civo_firewall.kubefirst.id - pools { - label = local.cluster_name - size = var.instance_size - node_count = var.node_count - } - } - - resource "vault_generic_secret" "clusters" { - path = "secret/clusters/${local.cluster_name}" - - data_json = jsonencode( - { - kubeconfig = civo_kubernetes_cluster.kubefirst.kubeconfig - client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-certificate-data) - client_key = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-key-data) - cluster_ca_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).clusters[0].cluster.certificate-authority-data) - host = civo_kubernetes_cluster.kubefirst.api_endpoint - cluster_name = local.cluster_name - argocd_manager_sa_token = kubernetes_secret_v1.argocd_manager.data.token - } - ) - } - - provider "kubernetes" { - host = civo_kubernetes_cluster.kubefirst.api_endpoint - client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-certificate-data) - client_key = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-key-data) - cluster_ca_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).clusters[0].cluster.certificate-authority-data) - } - - resource "kubernetes_cluster_role_v1" "argocd_manager" { - metadata { - name = "argocd-manager-role" - } - - rule { - api_groups = ["*"] - resources = ["*"] - verbs = ["*"] - } - rule { - non_resource_urls = ["*"] - verbs = ["*"] - } - } - - - resource "kubernetes_cluster_role_binding_v1" "argocd_manager" { - metadata { - name = "argocd-manager-role-binding" - } - role_ref { - api_group = "rbac.authorization.k8s.io" - kind = "ClusterRole" - name = kubernetes_cluster_role_v1.argocd_manager.metadata.0.name - } - subject { - kind = "ServiceAccount" - name = kubernetes_service_account_v1.argocd_manager.metadata.0.name - namespace = "kube-system" - } - } - - resource "kubernetes_service_account_v1" "argocd_manager" { - metadata { - name = "argocd-manager" - namespace = "kube-system" - } - secret { - name = "argocd-manager-token" - } - } - - resource "kubernetes_secret_v1" "argocd_manager" { - metadata { - name = "argocd-manager-token" - namespace = "kube-system" - annotations = { - "kubernetes.io/service-account.name" = "argocd-manager" - } - } - type = "kubernetes.io/service-account-token" - depends_on = [ kubernetes_service_account_v1.argocd_manager ] - } - - resource "kubernetes_namespace_v1" "external_dns" { - metadata { - name = "external-dns" - } - } - - data "vault_generic_secret" "external_dns" { - path = "secret/external-dns" - } - - resource "kubernetes_secret_v1" "external_dns" { - metadata { - name = "external-dns-secrets" - namespace = kubernetes_namespace_v1.external_dns.metadata.0.name - } - data = { - token = data.vault_generic_secret.external_dns.data["token"] - } - type = "Opaque" - } - - - resource "kubernetes_namespace_v1" "external_secrets_operator" { - metadata { - name = "external-secrets-operator" - } - } - - resource "kubernetes_namespace_v1" "environment" { - metadata { - name = "" - } - } - - data "vault_generic_secret" "docker_config" { - path = "secret/dockerconfigjson" - } - - resource "kubernetes_secret_v1" "image_pull" { - metadata { - name = "docker-config" - namespace = kubernetes_namespace_v1.environment.metadata.0.name - } - - data = { - ".dockerconfigjson" = data.vault_generic_secret.docker_config.data["dockerconfig"] - } - - type = "kubernetes.io/dockerconfigjson" - } - - data "vault_generic_secret" "external_secrets_operator" { - path = "secret/atlantis" - } - - resource "kubernetes_secret_v1" "external_secrets_operator_environment" { - metadata { - name = "${local.cluster_name}-cluster-vault-bootstrap" - namespace = kubernetes_namespace_v1.environment.metadata.0.name - } - data = { - vault-token = data.vault_generic_secret.external_secrets_operator.data["VAULT_TOKEN"] - } - type = "Opaque" - } - - resource "kubernetes_secret_v1" "external_secrets_operator" { - metadata { - name = "${local.cluster_name}-cluster-vault-bootstrap" - namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name - } - data = { - vault-token = data.vault_generic_secret.external_secrets_operator.data["VAULT_TOKEN"] - } - type = "Opaque" - } - - resource "kubernetes_service_account_v1" "external_secrets" { - metadata { - name = "external-secrets" - namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name - } - secret { - name = "external-secrets-token" - } - } - - resource "kubernetes_secret_v1" "external_secrets" { - metadata { - name = "external-secrets-token" - namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name - annotations = { - "kubernetes.io/service-account.name" = "external-secrets" - } - } - type = "kubernetes.io/service-account-token" - depends_on = [ kubernetes_service_account_v1.external_secrets ] - } - - resource "kubernetes_config_map" "kubefirst_cm" { - metadata { - name = "kubefirst-cm" - namespace = "kube-system" - } - - data = { - mgmt_cluster_id = "" - } - } \ No newline at end of file + source: Remote + module: + vars: + - key: cluster_name + value: + - key: cluster_region + value: + - key: environment + value: + - key: node_count + value: "" + - key: node_type + value: diff --git a/civo-github/templates/workload-cluster/provider-config/providerconfig.yaml b/civo-github/templates/workload-cluster/provider-config/providerconfig.yaml index 89d124839..066cdfee3 100644 --- a/civo-github/templates/workload-cluster/provider-config/providerconfig.yaml +++ b/civo-github/templates/workload-cluster/provider-config/providerconfig.yaml @@ -21,15 +21,8 @@ spec: } required_providers { civo = { - source = "civo/civo" - } - kubernetes = { - source = "hashicorp/kubernetes" - version = "2.23.0" - } - vault = { - source = "hashicorp/vault" - version = "3.19.0" + source = "civo/civo" + version = "~> 1.1.0" } } } diff --git a/civo-github/terraform/civo/main.tf b/civo-github/terraform/civo/main.tf index 59fe87f8a..0b6188a24 100644 --- a/civo-github/terraform/civo/main.tf +++ b/civo-github/terraform/civo/main.tf @@ -14,14 +14,7 @@ terraform { required_providers { civo = { source = "civo/civo" - } - kubernetes = { - source = "hashicorp/kubernetes" - version = "2.23.0" - } - vault = { - source = "hashicorp/vault" - version = "3.19.0" + version = "~> 1.1.0" } } } @@ -45,10 +38,11 @@ resource "civo_firewall" "kubefirst" { } resource "civo_kubernetes_cluster" "kubefirst" { - name = local.cluster_name - network_id = civo_network.kubefirst.id - firewall_id = civo_firewall.kubefirst.id - cluster_type = "talos" + name = local.cluster_name + network_id = civo_network.kubefirst.id + firewall_id = civo_firewall.kubefirst.id + kubernetes_version = "1.28.7-k3s1" + write_kubeconfig = true pools { label = local.cluster_name size = "" diff --git a/civo-github/terraform/civo/modules/workload-cluster/main.tf b/civo-github/terraform/civo/modules/workload-cluster/main.tf new file mode 100644 index 000000000..5117608d7 --- /dev/null +++ b/civo-github/terraform/civo/modules/workload-cluster/main.tf @@ -0,0 +1,210 @@ +resource "civo_network" "kubefirst" { + label = var.cluster_name +} + +resource "civo_firewall" "kubefirst" { + name = var.cluster_name + network_id = civo_network.kubefirst.id + create_default_rules = true +} + +resource "civo_kubernetes_cluster" "kubefirst" { + name = var.cluster_name + network_id = civo_network.kubefirst.id + firewall_id = civo_firewall.kubefirst.id + kubernetes_version = "1.28.7-k3s1" + write_kubeconfig = true + pools { + label = var.cluster_name + size = var.node_type + node_count = var.node_count + } +} + +resource "vault_generic_secret" "clusters" { + path = "secret/clusters/${var.cluster_name}" + + data_json = jsonencode( + { + kubeconfig = civo_kubernetes_cluster.kubefirst.kubeconfig + client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-certificate-data) + client_key = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-key-data) + cluster_ca_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).clusters[0].cluster.certificate-authority-data) + host = civo_kubernetes_cluster.kubefirst.api_endpoint + cluster_name = var.cluster_name + argocd_manager_sa_token = kubernetes_secret_v1.argocd_manager.data.token + } + ) +} + +provider "kubernetes" { + host = civo_kubernetes_cluster.kubefirst.api_endpoint + client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-certificate-data) + client_key = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-key-data) + cluster_ca_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).clusters[0].cluster.certificate-authority-data) +} + +resource "kubernetes_cluster_role_v1" "argocd_manager" { + metadata { + name = "argocd-manager-role" + } + + rule { + api_groups = ["*"] + resources = ["*"] + verbs = ["*"] + } + rule { + non_resource_urls = ["*"] + verbs = ["*"] + } +} + + +resource "kubernetes_cluster_role_binding_v1" "argocd_manager" { + metadata { + name = "argocd-manager-role-binding" + } + role_ref { + api_group = "rbac.authorization.k8s.io" + kind = "ClusterRole" + name = kubernetes_cluster_role_v1.argocd_manager.metadata.0.name + } + subject { + kind = "ServiceAccount" + name = kubernetes_service_account_v1.argocd_manager.metadata.0.name + namespace = "kube-system" + } +} + +resource "kubernetes_service_account_v1" "argocd_manager" { + metadata { + name = "argocd-manager" + namespace = "kube-system" + } + secret { + name = "argocd-manager-token" + } +} + +resource "kubernetes_secret_v1" "argocd_manager" { + metadata { + name = "argocd-manager-token" + namespace = "kube-system" + annotations = { + "kubernetes.io/service-account.name" = "argocd-manager" + } + } + type = "kubernetes.io/service-account-token" + depends_on = [kubernetes_service_account_v1.argocd_manager] +} + +resource "kubernetes_namespace_v1" "external_dns" { + metadata { + name = "external-dns" + } +} + +data "vault_generic_secret" "external_dns" { + path = "secret/external-dns" +} + +resource "kubernetes_secret_v1" "external_dns" { + metadata { + name = "external-dns-secrets" + namespace = kubernetes_namespace_v1.external_dns.metadata.0.name + } + data = { + token = data.vault_generic_secret.external_dns.data["token"] + } + type = "Opaque" +} + + +resource "kubernetes_namespace_v1" "external_secrets_operator" { + metadata { + name = "external-secrets-operator" + } +} + +resource "kubernetes_namespace_v1" "environment" { + metadata { + name = var.cluster_name + } +} + +data "vault_generic_secret" "docker_config" { + path = "secret/dockerconfigjson" +} + +resource "kubernetes_secret_v1" "image_pull" { + metadata { + name = "docker-config" + namespace = kubernetes_namespace_v1.environment.metadata.0.name + } + + data = { + ".dockerconfigjson" = data.vault_generic_secret.docker_config.data["dockerconfig"] + } + + type = "kubernetes.io/dockerconfigjson" +} + +data "vault_generic_secret" "external_secrets_operator" { + path = "secret/atlantis" +} + +resource "kubernetes_secret_v1" "external_secrets_operator_environment" { + metadata { + name = "${var.cluster_name}-cluster-vault-bootstrap" + namespace = kubernetes_namespace_v1.environment.metadata.0.name + } + data = { + vault-token = data.vault_generic_secret.external_secrets_operator.data["VAULT_TOKEN"] + } + type = "Opaque" +} + +resource "kubernetes_secret_v1" "external_secrets_operator" { + metadata { + name = "${var.cluster_name}-cluster-vault-bootstrap" + namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name + } + data = { + vault-token = data.vault_generic_secret.external_secrets_operator.data["VAULT_TOKEN"] + } + type = "Opaque" +} + +resource "kubernetes_service_account_v1" "external_secrets" { + metadata { + name = "external-secrets" + namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name + } + secret { + name = "external-secrets-token" + } +} + +resource "kubernetes_secret_v1" "external_secrets" { + metadata { + name = "external-secrets-token" + namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name + annotations = { + "kubernetes.io/service-account.name" = "external-secrets" + } + } + type = "kubernetes.io/service-account-token" + depends_on = [kubernetes_service_account_v1.external_secrets] +} + +resource "kubernetes_config_map" "kubefirst_cm" { + metadata { + name = "kubefirst-cm" + namespace = "kube-system" + } + + data = { + mgmt_cluster_id = "" + } +} diff --git a/civo-github/terraform/civo/modules/workload-cluster/variables.tf b/civo-github/terraform/civo/modules/workload-cluster/variables.tf new file mode 100644 index 000000000..7a7c18c00 --- /dev/null +++ b/civo-github/terraform/civo/modules/workload-cluster/variables.tf @@ -0,0 +1,19 @@ +variable "cluster_name" { + type = string +} + +variable "cluster_region" { + type = string +} + +variable "environment" { + type = string +} + +variable "node_count" { + type = number +} + +variable "node_type" { + type = string +} diff --git a/civo-github/terraform/github/repos.tf b/civo-github/terraform/github/repos.tf index 0d101ee8f..03feb8a7c 100644 --- a/civo-github/terraform/github/repos.tf +++ b/civo-github/terraform/github/repos.tf @@ -26,7 +26,7 @@ terraform { module "gitops" { source = "./modules/repository" - repo_name = "gitops" + repo_name = "" archive_on_destroy = false auto_init = false # set to false if importing an existing repository team_developers_id = github_team.developers.id @@ -55,7 +55,7 @@ variable "atlantis_repo_webhook_secret" { module "metaphor" { source = "./modules/repository" - repo_name = "metaphor" + repo_name = "" archive_on_destroy = false auto_init = false # set to false if importing an existing repository create_ecr = true diff --git a/civo-github/terraform/github/teams.tf b/civo-github/terraform/github/teams.tf index 355d21b5f..a77f9bae9 100644 --- a/civo-github/terraform/github/teams.tf +++ b/civo-github/terraform/github/teams.tf @@ -1,11 +1,11 @@ resource "github_team" "admins" { - name = "admins" + name = "" description = "administrators of the kubefirst platform" privacy = "closed" } resource "github_team" "developers" { - name = "developers" + name = "" description = "developers using the kubefirst plaftform" privacy = "closed" } diff --git a/civo-github/terraform/users/admins/data_sources.tf b/civo-github/terraform/users/admins/data_sources.tf index a454eea5f..1331a4653 100644 --- a/civo-github/terraform/users/admins/data_sources.tf +++ b/civo-github/terraform/users/admins/data_sources.tf @@ -1,5 +1,5 @@ data "github_team" "admins" { - slug = "admins" + slug = "" } data "vault_auth_backend" "userpass" { diff --git a/civo-github/terraform/users/developers/data_sources.tf b/civo-github/terraform/users/developers/data_sources.tf index 9c5d5c625..471e1c444 100644 --- a/civo-github/terraform/users/developers/data_sources.tf +++ b/civo-github/terraform/users/developers/data_sources.tf @@ -1,5 +1,5 @@ data "github_team" "developers" { - slug = "developers" + slug = "" } data "vault_auth_backend" "userpass" { diff --git a/civo-github/terraform/users/users.tf b/civo-github/terraform/users/users.tf index efe3e31db..35f254f88 100644 --- a/civo-github/terraform/users/users.tf +++ b/civo-github/terraform/users/users.tf @@ -20,11 +20,11 @@ terraform { } data "github_team" "admins" { - slug = "admins" + slug = "" } data "github_team" "developers" { - slug = "developers" + slug = "" } data "vault_auth_backend" "userpass" { diff --git a/civo-gitlab/templates/mgmt/components/argo-workflows/vault-wait.yaml b/civo-gitlab/templates/mgmt/components/argo-workflows/vault-wait.yaml index 47beecc62..bde31a201 100644 --- a/civo-gitlab/templates/mgmt/components/argo-workflows/vault-wait.yaml +++ b/civo-gitlab/templates/mgmt/components/argo-workflows/vault-wait.yaml @@ -22,4 +22,3 @@ spec: selfHeal: true syncOptions: - CreateNamespace=true - - Replace=true diff --git a/civo-gitlab/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml b/civo-gitlab/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml index c90d10ff9..d0f9b3f66 100644 --- a/civo-gitlab/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml +++ b/civo-gitlab/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml @@ -23,6 +23,7 @@ kind: Job metadata: annotations: argocd.argoproj.io/sync-wave: '0' + argocd.argoproj.io/sync-options: Force=true,Replace=true name: wait-vault-tls namespace: vault spec: diff --git a/civo-gitlab/templates/mgmt/components/argocd/kustomization.yaml b/civo-gitlab/templates/mgmt/components/argocd/kustomization.yaml index 362b89122..907f8ba77 100644 --- a/civo-gitlab/templates/mgmt/components/argocd/kustomization.yaml +++ b/civo-gitlab/templates/mgmt/components/argocd/kustomization.yaml @@ -5,7 +5,7 @@ namespace: argocd # To upgrade ArgoCD, increment the version here # https://github.com/argoproj/argo-cd/tags resources: - - github.com:kubefirst/manifests.git/argocd/cloud?ref=main + - github.com:konstructio/manifests.git/argocd/cloud?ref=v1.1.0 - argocd-ui-ingress.yaml - externalsecrets.yaml - argocd-oidc-restart-job.yaml diff --git a/civo-gitlab/templates/mgmt/components/kubefirst/console.yaml b/civo-gitlab/templates/mgmt/components/kubefirst/console.yaml index f9d950528..df130b7f1 100644 --- a/civo-gitlab/templates/mgmt/components/kubefirst/console.yaml +++ b/civo-gitlab/templates/mgmt/components/kubefirst/console.yaml @@ -8,8 +8,8 @@ metadata: spec: project: default source: - repoURL: https://charts.kubefirst.com - targetRevision: 2.4.14-rc39 + repoURL: https://charts.konstruct.io + targetRevision: 2.5.12-rc3 chart: kubefirst helm: values: |- diff --git a/civo-gitlab/templates/workload-cluster/infrastructure/wait.yaml b/civo-gitlab/templates/workload-cluster/infrastructure/wait.yaml index 1268e3396..4f0da73bc 100644 --- a/civo-gitlab/templates/workload-cluster/infrastructure/wait.yaml +++ b/civo-gitlab/templates/workload-cluster/infrastructure/wait.yaml @@ -16,6 +16,6 @@ spec: - /bin/sh - -c - | - while ! kubectl wait --for=jsonpath='{.status.conditions[0].status}'='True' workspace/; do echo "waiting for cluster to provision"; sleep 5; done + while ! kubectl wait --for=jsonpath='{.status.conditions[0].status}'='True' workspace/-infrastructure; do echo "waiting for cluster to provision"; sleep 5; done restartPolicy: Never backoffLimit: 1 diff --git a/civo-gitlab/templates/workload-cluster/infrastructure/workspace.yaml b/civo-gitlab/templates/workload-cluster/infrastructure/workspace.yaml index 02168bff9..e5835a10a 100644 --- a/civo-gitlab/templates/workload-cluster/infrastructure/workspace.yaml +++ b/civo-gitlab/templates/workload-cluster/infrastructure/workspace.yaml @@ -1,195 +1,21 @@ apiVersion: tf.upbound.io/v1beta1 kind: Workspace metadata: - name: - annotations: - argocd.argoproj.io/sync-wave: "10" - crossplane.io/external-name: + name: -infrastructure spec: - providerConfigRef: + providerConfigRef: name: forProvider: - source: Inline - module: | - variable "instance_size" { - type = string - default = "g4s.kube.medium" - } - variable "node_count" { - type = number - default = "" - } - locals { - cluster_name = "" - } - resource "civo_network" "kubefirst" { - label = local.cluster_name - } - resource "civo_firewall" "kubefirst" { - name = local.cluster_name - network_id = civo_network.kubefirst.id - create_default_rules = true - } - resource "civo_kubernetes_cluster" "kubefirst" { - name = local.cluster_name - network_id = civo_network.kubefirst.id - firewall_id = civo_firewall.kubefirst.id - pools { - label = local.cluster_name - size = var.instance_size - node_count = var.node_count - } - } - resource "vault_generic_secret" "clusters" { - path = "secret/clusters/${local.cluster_name}" - data_json = jsonencode( - { - kubeconfig = civo_kubernetes_cluster.kubefirst.kubeconfig - client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-certificate-data) - client_key = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-key-data) - cluster_ca_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).clusters[0].cluster.certificate-authority-data) - host = civo_kubernetes_cluster.kubefirst.api_endpoint - cluster_name = local.cluster_name - argocd_manager_sa_token = kubernetes_secret_v1.argocd_manager.data.token - } - ) - } - provider "kubernetes" { - host = civo_kubernetes_cluster.kubefirst.api_endpoint - client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-certificate-data) - client_key = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-key-data) - cluster_ca_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).clusters[0].cluster.certificate-authority-data) - } - resource "kubernetes_cluster_role_v1" "argocd_manager" { - metadata { - name = "argocd-manager-role" - } - rule { - api_groups = ["*"] - resources = ["*"] - verbs = ["*"] - } - rule { - non_resource_urls = ["*"] - verbs = ["*"] - } - } - resource "kubernetes_cluster_role_binding_v1" "argocd_manager" { - metadata { - name = "argocd-manager-role-binding" - } - role_ref { - api_group = "rbac.authorization.k8s.io" - kind = "ClusterRole" - name = kubernetes_cluster_role_v1.argocd_manager.metadata.0.name - } - subject { - kind = "ServiceAccount" - name = kubernetes_service_account_v1.argocd_manager.metadata.0.name - namespace = "kube-system" - } - } - resource "kubernetes_service_account_v1" "argocd_manager" { - metadata { - name = "argocd-manager" - namespace = "kube-system" - } - secret { - name = "argocd-manager-token" - } - } - resource "kubernetes_secret_v1" "argocd_manager" { - metadata { - name = "argocd-manager-token" - namespace = "kube-system" - annotations = { - "kubernetes.io/service-account.name" = "argocd-manager" - } - } - type = "kubernetes.io/service-account-token" - depends_on = [ kubernetes_service_account_v1.argocd_manager ] - } - resource "kubernetes_namespace_v1" "external_dns" { - metadata { - name = "external-dns" - } - } - data "vault_generic_secret" "external_dns" { - path = "secret/external-dns" - } - resource "kubernetes_secret_v1" "external_dns" { - metadata { - name = "external-dns-secrets" - namespace = kubernetes_namespace_v1.external_dns.metadata.0.name - } - data = { - token = data.vault_generic_secret.external_dns.data["token"] - } - type = "Opaque" - } - resource "kubernetes_namespace_v1" "external_secrets_operator" { - metadata { - name = "external-secrets-operator" - } - } - resource "kubernetes_namespace_v1" "environment" { - metadata { - name = "" - } - } - data "vault_generic_secret" "docker_config" { - path = "secret/dockerconfigjson" - } - resource "kubernetes_secret_v1" "image_pull" { - metadata { - name = "docker-config" - namespace = kubernetes_namespace_v1.environment.metadata.0.name - } - data = { - ".dockerconfigjson" = data.vault_generic_secret.docker_config.data["dockerconfig"] - } - type = "kubernetes.io/dockerconfigjson" - } - data "vault_generic_secret" "external_secrets_operator" { - path = "secret/atlantis" - } - resource "kubernetes_secret_v1" "external_secrets_operator_environment" { - metadata { - name = "${local.cluster_name}-cluster-vault-bootstrap" - namespace = kubernetes_namespace_v1.environment.metadata.0.name - } - data = { - vault-token = data.vault_generic_secret.external_secrets_operator.data["VAULT_TOKEN"] - } - type = "Opaque" - } - resource "kubernetes_secret_v1" "external_secrets_operator" { - metadata { - name = "${local.cluster_name}-cluster-vault-bootstrap" - namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name - } - data = { - vault-token = data.vault_generic_secret.external_secrets_operator.data["VAULT_TOKEN"] - } - type = "Opaque" - } - resource "kubernetes_service_account_v1" "external_secrets" { - metadata { - name = "external-secrets" - namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name - } - secret { - name = "external-secrets-token" - } - } - resource "kubernetes_secret_v1" "external_secrets" { - metadata { - name = "external-secrets-token" - namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name - annotations = { - "kubernetes.io/service-account.name" = "external-secrets" - } - } - type = "kubernetes.io/service-account-token" - depends_on = [ kubernetes_service_account_v1.external_secrets ] - } \ No newline at end of file + source: Remote + module: + vars: + - key: cluster_name + value: + - key: cluster_region + value: + - key: environment + value: + - key: node_count + value: "" + - key: node_type + value: diff --git a/civo-gitlab/templates/workload-cluster/provider-config/providerconfig.yaml b/civo-gitlab/templates/workload-cluster/provider-config/providerconfig.yaml index d9860350d..51ba58329 100644 --- a/civo-gitlab/templates/workload-cluster/provider-config/providerconfig.yaml +++ b/civo-gitlab/templates/workload-cluster/provider-config/providerconfig.yaml @@ -20,6 +20,7 @@ spec: required_providers { civo = { source = "civo/civo" + version = "~> 1.1.0" } kubernetes = { source = "hashicorp/kubernetes" diff --git a/civo-gitlab/terraform/civo/main.tf b/civo-gitlab/terraform/civo/main.tf index 5c6698545..4be8c5b4d 100644 --- a/civo-gitlab/terraform/civo/main.tf +++ b/civo-gitlab/terraform/civo/main.tf @@ -14,6 +14,7 @@ terraform { required_providers { civo = { source = "civo/civo" + version = "~> 1.1.0" } } } @@ -39,10 +40,11 @@ resource "civo_firewall" "kubefirst" { } resource "civo_kubernetes_cluster" "kubefirst" { - name = local.cluster_name - network_id = civo_network.kubefirst.id - firewall_id = civo_firewall.kubefirst.id - cluster_type = "talos" + name = local.cluster_name + network_id = civo_network.kubefirst.id + firewall_id = civo_firewall.kubefirst.id + kubernetes_version = "1.28.7-k3s1" + write_kubeconfig = true pools { label = local.cluster_name size = "" diff --git a/civo-gitlab/terraform/civo/modules/workload-cluster/main.tf b/civo-gitlab/terraform/civo/modules/workload-cluster/main.tf new file mode 100644 index 000000000..5117608d7 --- /dev/null +++ b/civo-gitlab/terraform/civo/modules/workload-cluster/main.tf @@ -0,0 +1,210 @@ +resource "civo_network" "kubefirst" { + label = var.cluster_name +} + +resource "civo_firewall" "kubefirst" { + name = var.cluster_name + network_id = civo_network.kubefirst.id + create_default_rules = true +} + +resource "civo_kubernetes_cluster" "kubefirst" { + name = var.cluster_name + network_id = civo_network.kubefirst.id + firewall_id = civo_firewall.kubefirst.id + kubernetes_version = "1.28.7-k3s1" + write_kubeconfig = true + pools { + label = var.cluster_name + size = var.node_type + node_count = var.node_count + } +} + +resource "vault_generic_secret" "clusters" { + path = "secret/clusters/${var.cluster_name}" + + data_json = jsonencode( + { + kubeconfig = civo_kubernetes_cluster.kubefirst.kubeconfig + client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-certificate-data) + client_key = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-key-data) + cluster_ca_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).clusters[0].cluster.certificate-authority-data) + host = civo_kubernetes_cluster.kubefirst.api_endpoint + cluster_name = var.cluster_name + argocd_manager_sa_token = kubernetes_secret_v1.argocd_manager.data.token + } + ) +} + +provider "kubernetes" { + host = civo_kubernetes_cluster.kubefirst.api_endpoint + client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-certificate-data) + client_key = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-key-data) + cluster_ca_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).clusters[0].cluster.certificate-authority-data) +} + +resource "kubernetes_cluster_role_v1" "argocd_manager" { + metadata { + name = "argocd-manager-role" + } + + rule { + api_groups = ["*"] + resources = ["*"] + verbs = ["*"] + } + rule { + non_resource_urls = ["*"] + verbs = ["*"] + } +} + + +resource "kubernetes_cluster_role_binding_v1" "argocd_manager" { + metadata { + name = "argocd-manager-role-binding" + } + role_ref { + api_group = "rbac.authorization.k8s.io" + kind = "ClusterRole" + name = kubernetes_cluster_role_v1.argocd_manager.metadata.0.name + } + subject { + kind = "ServiceAccount" + name = kubernetes_service_account_v1.argocd_manager.metadata.0.name + namespace = "kube-system" + } +} + +resource "kubernetes_service_account_v1" "argocd_manager" { + metadata { + name = "argocd-manager" + namespace = "kube-system" + } + secret { + name = "argocd-manager-token" + } +} + +resource "kubernetes_secret_v1" "argocd_manager" { + metadata { + name = "argocd-manager-token" + namespace = "kube-system" + annotations = { + "kubernetes.io/service-account.name" = "argocd-manager" + } + } + type = "kubernetes.io/service-account-token" + depends_on = [kubernetes_service_account_v1.argocd_manager] +} + +resource "kubernetes_namespace_v1" "external_dns" { + metadata { + name = "external-dns" + } +} + +data "vault_generic_secret" "external_dns" { + path = "secret/external-dns" +} + +resource "kubernetes_secret_v1" "external_dns" { + metadata { + name = "external-dns-secrets" + namespace = kubernetes_namespace_v1.external_dns.metadata.0.name + } + data = { + token = data.vault_generic_secret.external_dns.data["token"] + } + type = "Opaque" +} + + +resource "kubernetes_namespace_v1" "external_secrets_operator" { + metadata { + name = "external-secrets-operator" + } +} + +resource "kubernetes_namespace_v1" "environment" { + metadata { + name = var.cluster_name + } +} + +data "vault_generic_secret" "docker_config" { + path = "secret/dockerconfigjson" +} + +resource "kubernetes_secret_v1" "image_pull" { + metadata { + name = "docker-config" + namespace = kubernetes_namespace_v1.environment.metadata.0.name + } + + data = { + ".dockerconfigjson" = data.vault_generic_secret.docker_config.data["dockerconfig"] + } + + type = "kubernetes.io/dockerconfigjson" +} + +data "vault_generic_secret" "external_secrets_operator" { + path = "secret/atlantis" +} + +resource "kubernetes_secret_v1" "external_secrets_operator_environment" { + metadata { + name = "${var.cluster_name}-cluster-vault-bootstrap" + namespace = kubernetes_namespace_v1.environment.metadata.0.name + } + data = { + vault-token = data.vault_generic_secret.external_secrets_operator.data["VAULT_TOKEN"] + } + type = "Opaque" +} + +resource "kubernetes_secret_v1" "external_secrets_operator" { + metadata { + name = "${var.cluster_name}-cluster-vault-bootstrap" + namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name + } + data = { + vault-token = data.vault_generic_secret.external_secrets_operator.data["VAULT_TOKEN"] + } + type = "Opaque" +} + +resource "kubernetes_service_account_v1" "external_secrets" { + metadata { + name = "external-secrets" + namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name + } + secret { + name = "external-secrets-token" + } +} + +resource "kubernetes_secret_v1" "external_secrets" { + metadata { + name = "external-secrets-token" + namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name + annotations = { + "kubernetes.io/service-account.name" = "external-secrets" + } + } + type = "kubernetes.io/service-account-token" + depends_on = [kubernetes_service_account_v1.external_secrets] +} + +resource "kubernetes_config_map" "kubefirst_cm" { + metadata { + name = "kubefirst-cm" + namespace = "kube-system" + } + + data = { + mgmt_cluster_id = "" + } +} diff --git a/civo-gitlab/terraform/civo/modules/workload-cluster/variables.tf b/civo-gitlab/terraform/civo/modules/workload-cluster/variables.tf new file mode 100644 index 000000000..7a7c18c00 --- /dev/null +++ b/civo-gitlab/terraform/civo/modules/workload-cluster/variables.tf @@ -0,0 +1,19 @@ +variable "cluster_name" { + type = string +} + +variable "cluster_region" { + type = string +} + +variable "environment" { + type = string +} + +variable "node_count" { + type = number +} + +variable "node_type" { + type = string +} diff --git a/civo-gitlab/terraform/gitlab/groups.tf b/civo-gitlab/terraform/gitlab/groups.tf index c5c5f16f4..da300caa0 100644 --- a/civo-gitlab/terraform/gitlab/groups.tf +++ b/civo-gitlab/terraform/gitlab/groups.tf @@ -3,15 +3,15 @@ data "gitlab_group" "owner" { } resource "gitlab_group" "admins" { - name = "admins" - path = "admins" + name = "" + path = "" parent_id = data.gitlab_group.owner.group_id description = "admins group" } resource "gitlab_group" "developers" { - name = "developers" - path = "developers" + name = "" + path = "" parent_id = data.gitlab_group.owner.group_id description = "developers group" } diff --git a/civo-gitlab/terraform/gitlab/projects.tf b/civo-gitlab/terraform/gitlab/projects.tf index 7e87a373b..bbf5c01b5 100644 --- a/civo-gitlab/terraform/gitlab/projects.tf +++ b/civo-gitlab/terraform/gitlab/projects.tf @@ -1,7 +1,7 @@ module "metaphor" { source = "./modules/project" group_name = data.gitlab_group.owner.id - project_name = "metaphor" + project_name = "" # create_ecr = true initialize_with_readme = false only_allow_merge_if_pipeline_succeeds = false @@ -11,7 +11,7 @@ module "metaphor" { module "gitops" { source = "./modules/project" group_name = data.gitlab_group.owner.id - project_name = "gitops" + project_name = " " # create_ecr = true initialize_with_readme = false only_allow_merge_if_pipeline_succeeds = false @@ -26,3 +26,4 @@ resource "gitlab_project_hook" "atlantis" { push_events = true note_events = true } + diff --git a/civo-gitlab/terraform/users/admins/main.tf b/civo-gitlab/terraform/users/admins/main.tf index c15703de5..cdc94d28b 100644 --- a/civo-gitlab/terraform/users/admins/main.tf +++ b/civo-gitlab/terraform/users/admins/main.tf @@ -1,5 +1,5 @@ data "vault_identity_group" "admins" { - group_name = "admins" + group_name = "" } data "vault_auth_backend" "userpass" { diff --git a/civo-gitlab/terraform/users/developers/data-sources.tf b/civo-gitlab/terraform/users/developers/data-sources.tf index b162542c0..1a5265189 100644 --- a/civo-gitlab/terraform/users/developers/data-sources.tf +++ b/civo-gitlab/terraform/users/developers/data-sources.tf @@ -1,3 +1,3 @@ data "vault_identity_group" "developers" { - group_name = "developers" + group_name = "" } diff --git a/civo-gitlab/terraform/users/modules/user/main.tf b/civo-gitlab/terraform/users/modules/user/main.tf index 7ad950860..fb091f121 100644 --- a/civo-gitlab/terraform/users/modules/user/main.tf +++ b/civo-gitlab/terraform/users/modules/user/main.tf @@ -133,15 +133,15 @@ variable "group_id" { } data "vault_identity_group" "admins" { - group_name = "admins" + group_name = "" } data "gitlab_group" "admins" { - full_path = "/admins" + full_path = "/" } data "gitlab_group" "developers" { - full_path = "/developers" + full_path = "/" } data "gitlab_user" "user" { diff --git a/civo-gitlab/terraform/users/users.tf b/civo-gitlab/terraform/users/users.tf index 4c7ad999c..ffa2080a9 100644 --- a/civo-gitlab/terraform/users/users.tf +++ b/civo-gitlab/terraform/users/users.tf @@ -23,11 +23,11 @@ terraform { } data "gitlab_group" "admins" { - full_path = "/admins" + full_path = "/" } data "gitlab_group" "developers" { - full_path = "/developers" + full_path = "/" } @@ -36,7 +36,7 @@ data "vault_auth_backend" "userpass" { } data "vault_identity_group" "admins" { - group_name = "admins" + group_name = "" } variable "initial_password" { @@ -45,7 +45,7 @@ variable "initial_password" { } data "vault_identity_group" "developers" { - group_name = "developers" + group_name = "" } module "admins" { diff --git a/civo-gitlab/terraform/vault/oidc-groups.tf b/civo-gitlab/terraform/vault/oidc-groups.tf index 4da060600..b2cc82df9 100644 --- a/civo-gitlab/terraform/vault/oidc-groups.tf +++ b/civo-gitlab/terraform/vault/oidc-groups.tf @@ -1,5 +1,5 @@ resource "vault_identity_group" "developers" { - name = "developers" + name = "" type = "internal" policies = ["developer"] @@ -16,7 +16,7 @@ resource "vault_identity_group" "developers" { } resource "vault_identity_group" "admins" { - name = "admins" + name = "" type = "internal" policies = ["admin"] diff --git a/digitalocean-github/templates/mgmt/components/argo-workflows/vault-wait.yaml b/digitalocean-github/templates/mgmt/components/argo-workflows/vault-wait.yaml index 47beecc62..bde31a201 100644 --- a/digitalocean-github/templates/mgmt/components/argo-workflows/vault-wait.yaml +++ b/digitalocean-github/templates/mgmt/components/argo-workflows/vault-wait.yaml @@ -22,4 +22,3 @@ spec: selfHeal: true syncOptions: - CreateNamespace=true - - Replace=true diff --git a/digitalocean-github/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml b/digitalocean-github/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml index c90d10ff9..d0f9b3f66 100644 --- a/digitalocean-github/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml +++ b/digitalocean-github/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml @@ -23,6 +23,7 @@ kind: Job metadata: annotations: argocd.argoproj.io/sync-wave: '0' + argocd.argoproj.io/sync-options: Force=true,Replace=true name: wait-vault-tls namespace: vault spec: diff --git a/digitalocean-github/templates/mgmt/components/argocd/kustomization.yaml b/digitalocean-github/templates/mgmt/components/argocd/kustomization.yaml index 362b89122..907f8ba77 100644 --- a/digitalocean-github/templates/mgmt/components/argocd/kustomization.yaml +++ b/digitalocean-github/templates/mgmt/components/argocd/kustomization.yaml @@ -5,7 +5,7 @@ namespace: argocd # To upgrade ArgoCD, increment the version here # https://github.com/argoproj/argo-cd/tags resources: - - github.com:kubefirst/manifests.git/argocd/cloud?ref=main + - github.com:konstructio/manifests.git/argocd/cloud?ref=v1.1.0 - argocd-ui-ingress.yaml - externalsecrets.yaml - argocd-oidc-restart-job.yaml diff --git a/digitalocean-github/templates/mgmt/components/kubefirst/console.yaml b/digitalocean-github/templates/mgmt/components/kubefirst/console.yaml index f9d950528..df130b7f1 100644 --- a/digitalocean-github/templates/mgmt/components/kubefirst/console.yaml +++ b/digitalocean-github/templates/mgmt/components/kubefirst/console.yaml @@ -8,8 +8,8 @@ metadata: spec: project: default source: - repoURL: https://charts.kubefirst.com - targetRevision: 2.4.14-rc39 + repoURL: https://charts.konstruct.io + targetRevision: 2.5.12-rc3 chart: kubefirst helm: values: |- diff --git a/digitalocean-github/terraform/digitalocean/main.tf b/digitalocean-github/terraform/digitalocean/main.tf index 115deefcd..c30c89757 100644 --- a/digitalocean-github/terraform/digitalocean/main.tf +++ b/digitalocean-github/terraform/digitalocean/main.tf @@ -34,7 +34,7 @@ locals { } data "digitalocean_kubernetes_versions" "versions" { - version_prefix = "1.27." + version_prefix = "1.29." } resource "digitalocean_kubernetes_cluster" "kubefirst" { diff --git a/digitalocean-github/terraform/digitalocean/modules/workload-cluster/main.tf b/digitalocean-github/terraform/digitalocean/modules/workload-cluster/main.tf index ed230f48a..2ce39e995 100644 --- a/digitalocean-github/terraform/digitalocean/modules/workload-cluster/main.tf +++ b/digitalocean-github/terraform/digitalocean/modules/workload-cluster/main.tf @@ -1,6 +1,6 @@ data "digitalocean_kubernetes_versions" "versions" { - version_prefix = "1.27." + version_prefix = "1.29." } resource "digitalocean_kubernetes_cluster" "cluster" { diff --git a/digitalocean-github/terraform/github/repos.tf b/digitalocean-github/terraform/github/repos.tf index 8136a5e11..0dbce9f38 100644 --- a/digitalocean-github/terraform/github/repos.tf +++ b/digitalocean-github/terraform/github/repos.tf @@ -26,7 +26,7 @@ terraform { module "gitops" { source = "./modules/repository" - repo_name = "gitops" + repo_name = " " archive_on_destroy = false auto_init = false # set to false if importing an existing repository team_developers_id = github_team.developers.id @@ -56,7 +56,7 @@ variable "atlantis_repo_webhook_secret" { module "metaphor" { source = "./modules/repository" - repo_name = "metaphor" + repo_name = "" archive_on_destroy = false auto_init = false # set to false if importing an existing repository create_ecr = true diff --git a/digitalocean-github/terraform/github/teams.tf b/digitalocean-github/terraform/github/teams.tf index 355d21b5f..a77f9bae9 100644 --- a/digitalocean-github/terraform/github/teams.tf +++ b/digitalocean-github/terraform/github/teams.tf @@ -1,11 +1,11 @@ resource "github_team" "admins" { - name = "admins" + name = "" description = "administrators of the kubefirst platform" privacy = "closed" } resource "github_team" "developers" { - name = "developers" + name = "" description = "developers using the kubefirst plaftform" privacy = "closed" } diff --git a/digitalocean-github/terraform/users/admins/data_sources.tf b/digitalocean-github/terraform/users/admins/data_sources.tf index a454eea5f..1331a4653 100644 --- a/digitalocean-github/terraform/users/admins/data_sources.tf +++ b/digitalocean-github/terraform/users/admins/data_sources.tf @@ -1,5 +1,5 @@ data "github_team" "admins" { - slug = "admins" + slug = "" } data "vault_auth_backend" "userpass" { diff --git a/digitalocean-github/terraform/users/developers/data_sources.tf b/digitalocean-github/terraform/users/developers/data_sources.tf index 9c5d5c625..471e1c444 100644 --- a/digitalocean-github/terraform/users/developers/data_sources.tf +++ b/digitalocean-github/terraform/users/developers/data_sources.tf @@ -1,5 +1,5 @@ data "github_team" "developers" { - slug = "developers" + slug = "" } data "vault_auth_backend" "userpass" { diff --git a/digitalocean-github/terraform/users/users.tf b/digitalocean-github/terraform/users/users.tf index 49aa0b6f0..c72c50f82 100644 --- a/digitalocean-github/terraform/users/users.tf +++ b/digitalocean-github/terraform/users/users.tf @@ -23,11 +23,11 @@ terraform { } data "github_team" "admins" { - slug = "admins" + slug = "" } data "github_team" "developers" { - slug = "developers" + slug = "" } data "vault_auth_backend" "userpass" { @@ -35,7 +35,7 @@ data "vault_auth_backend" "userpass" { } data "vault_identity_group" "admins" { - group_name = "admins" + group_name = "" } variable "initial_password" { @@ -60,7 +60,7 @@ resource "vault_identity_group_member_entity_ids" "admins_membership" { # # developers module # data "vault_identity_group" "developers" { -# group_name = "developers" +# group_name = "" # } # module "developers" { diff --git a/digitalocean-github/terraform/vault/oidc-groups.tf b/digitalocean-github/terraform/vault/oidc-groups.tf index 4da060600..b2cc82df9 100644 --- a/digitalocean-github/terraform/vault/oidc-groups.tf +++ b/digitalocean-github/terraform/vault/oidc-groups.tf @@ -1,5 +1,5 @@ resource "vault_identity_group" "developers" { - name = "developers" + name = "" type = "internal" policies = ["developer"] @@ -16,7 +16,7 @@ resource "vault_identity_group" "developers" { } resource "vault_identity_group" "admins" { - name = "admins" + name = "" type = "internal" policies = ["admin"] diff --git a/digitalocean-gitlab/templates/mgmt/components/argo-workflows/vault-wait.yaml b/digitalocean-gitlab/templates/mgmt/components/argo-workflows/vault-wait.yaml index 47beecc62..bde31a201 100644 --- a/digitalocean-gitlab/templates/mgmt/components/argo-workflows/vault-wait.yaml +++ b/digitalocean-gitlab/templates/mgmt/components/argo-workflows/vault-wait.yaml @@ -22,4 +22,3 @@ spec: selfHeal: true syncOptions: - CreateNamespace=true - - Replace=true diff --git a/digitalocean-gitlab/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml b/digitalocean-gitlab/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml index c90d10ff9..d0f9b3f66 100644 --- a/digitalocean-gitlab/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml +++ b/digitalocean-gitlab/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml @@ -23,6 +23,7 @@ kind: Job metadata: annotations: argocd.argoproj.io/sync-wave: '0' + argocd.argoproj.io/sync-options: Force=true,Replace=true name: wait-vault-tls namespace: vault spec: diff --git a/digitalocean-gitlab/templates/mgmt/components/argocd/kustomization.yaml b/digitalocean-gitlab/templates/mgmt/components/argocd/kustomization.yaml index 362b89122..907f8ba77 100644 --- a/digitalocean-gitlab/templates/mgmt/components/argocd/kustomization.yaml +++ b/digitalocean-gitlab/templates/mgmt/components/argocd/kustomization.yaml @@ -5,7 +5,7 @@ namespace: argocd # To upgrade ArgoCD, increment the version here # https://github.com/argoproj/argo-cd/tags resources: - - github.com:kubefirst/manifests.git/argocd/cloud?ref=main + - github.com:konstructio/manifests.git/argocd/cloud?ref=v1.1.0 - argocd-ui-ingress.yaml - externalsecrets.yaml - argocd-oidc-restart-job.yaml diff --git a/digitalocean-gitlab/templates/mgmt/components/kubefirst/console.yaml b/digitalocean-gitlab/templates/mgmt/components/kubefirst/console.yaml index f9d950528..df130b7f1 100644 --- a/digitalocean-gitlab/templates/mgmt/components/kubefirst/console.yaml +++ b/digitalocean-gitlab/templates/mgmt/components/kubefirst/console.yaml @@ -8,8 +8,8 @@ metadata: spec: project: default source: - repoURL: https://charts.kubefirst.com - targetRevision: 2.4.14-rc39 + repoURL: https://charts.konstruct.io + targetRevision: 2.5.12-rc3 chart: kubefirst helm: values: |- diff --git a/digitalocean-gitlab/terraform/digitalocean/main.tf b/digitalocean-gitlab/terraform/digitalocean/main.tf index 84f56398b..da45b731a 100644 --- a/digitalocean-gitlab/terraform/digitalocean/main.tf +++ b/digitalocean-gitlab/terraform/digitalocean/main.tf @@ -33,7 +33,7 @@ locals { } data "digitalocean_kubernetes_versions" "versions" { - version_prefix = "1.27." + version_prefix = "1.29." } resource "digitalocean_kubernetes_cluster" "kubefirst" { diff --git a/digitalocean-gitlab/terraform/digitalocean/modules/workload-cluster/main.tf b/digitalocean-gitlab/terraform/digitalocean/modules/workload-cluster/main.tf index ed230f48a..2ce39e995 100644 --- a/digitalocean-gitlab/terraform/digitalocean/modules/workload-cluster/main.tf +++ b/digitalocean-gitlab/terraform/digitalocean/modules/workload-cluster/main.tf @@ -1,6 +1,6 @@ data "digitalocean_kubernetes_versions" "versions" { - version_prefix = "1.27." + version_prefix = "1.29." } resource "digitalocean_kubernetes_cluster" "cluster" { diff --git a/digitalocean-gitlab/terraform/gitlab/groups.tf b/digitalocean-gitlab/terraform/gitlab/groups.tf index c5c5f16f4..da300caa0 100644 --- a/digitalocean-gitlab/terraform/gitlab/groups.tf +++ b/digitalocean-gitlab/terraform/gitlab/groups.tf @@ -3,15 +3,15 @@ data "gitlab_group" "owner" { } resource "gitlab_group" "admins" { - name = "admins" - path = "admins" + name = "" + path = "" parent_id = data.gitlab_group.owner.group_id description = "admins group" } resource "gitlab_group" "developers" { - name = "developers" - path = "developers" + name = "" + path = "" parent_id = data.gitlab_group.owner.group_id description = "developers group" } diff --git a/digitalocean-gitlab/terraform/gitlab/projects.tf b/digitalocean-gitlab/terraform/gitlab/projects.tf index 7e87a373b..c3455aefe 100644 --- a/digitalocean-gitlab/terraform/gitlab/projects.tf +++ b/digitalocean-gitlab/terraform/gitlab/projects.tf @@ -1,7 +1,7 @@ module "metaphor" { source = "./modules/project" group_name = data.gitlab_group.owner.id - project_name = "metaphor" + project_name = "" # create_ecr = true initialize_with_readme = false only_allow_merge_if_pipeline_succeeds = false @@ -11,7 +11,7 @@ module "metaphor" { module "gitops" { source = "./modules/project" group_name = data.gitlab_group.owner.id - project_name = "gitops" + project_name = " " # create_ecr = true initialize_with_readme = false only_allow_merge_if_pipeline_succeeds = false diff --git a/digitalocean-gitlab/terraform/users/admins/main.tf b/digitalocean-gitlab/terraform/users/admins/main.tf index c15703de5..cdc94d28b 100644 --- a/digitalocean-gitlab/terraform/users/admins/main.tf +++ b/digitalocean-gitlab/terraform/users/admins/main.tf @@ -1,5 +1,5 @@ data "vault_identity_group" "admins" { - group_name = "admins" + group_name = "" } data "vault_auth_backend" "userpass" { diff --git a/digitalocean-gitlab/terraform/users/developers/data-sources.tf b/digitalocean-gitlab/terraform/users/developers/data-sources.tf index b162542c0..1a5265189 100644 --- a/digitalocean-gitlab/terraform/users/developers/data-sources.tf +++ b/digitalocean-gitlab/terraform/users/developers/data-sources.tf @@ -1,3 +1,3 @@ data "vault_identity_group" "developers" { - group_name = "developers" + group_name = "" } diff --git a/digitalocean-gitlab/terraform/users/modules/user/main.tf b/digitalocean-gitlab/terraform/users/modules/user/main.tf index 7ad950860..97b920292 100644 --- a/digitalocean-gitlab/terraform/users/modules/user/main.tf +++ b/digitalocean-gitlab/terraform/users/modules/user/main.tf @@ -133,7 +133,7 @@ variable "group_id" { } data "vault_identity_group" "admins" { - group_name = "admins" + group_name = "" } data "gitlab_group" "admins" { diff --git a/digitalocean-gitlab/terraform/users/users.tf b/digitalocean-gitlab/terraform/users/users.tf index 941e37494..185767e9f 100644 --- a/digitalocean-gitlab/terraform/users/users.tf +++ b/digitalocean-gitlab/terraform/users/users.tf @@ -21,11 +21,11 @@ terraform { } data "gitlab_group" "admins" { - full_path = "/admins" + full_path = "/" } data "gitlab_group" "developers" { - full_path = "/developers" + full_path = "/" } @@ -34,7 +34,7 @@ data "vault_auth_backend" "userpass" { } data "vault_identity_group" "admins" { - group_name = "admins" + group_name = "" } variable "initial_password" { @@ -43,7 +43,7 @@ variable "initial_password" { } data "vault_identity_group" "developers" { - group_name = "developers" + group_name = "" } module "admins" { diff --git a/digitalocean-gitlab/terraform/vault/oidc-groups.tf b/digitalocean-gitlab/terraform/vault/oidc-groups.tf index 4da060600..b2cc82df9 100644 --- a/digitalocean-gitlab/terraform/vault/oidc-groups.tf +++ b/digitalocean-gitlab/terraform/vault/oidc-groups.tf @@ -1,5 +1,5 @@ resource "vault_identity_group" "developers" { - name = "developers" + name = "" type = "internal" policies = ["developer"] @@ -16,7 +16,7 @@ resource "vault_identity_group" "developers" { } resource "vault_identity_group" "admins" { - name = "admins" + name = "" type = "internal" policies = ["admin"] diff --git a/google-github/templates/mgmt/components/argo-workflows/vault-wait.yaml b/google-github/templates/mgmt/components/argo-workflows/vault-wait.yaml index 47beecc62..7c6908e3a 100644 --- a/google-github/templates/mgmt/components/argo-workflows/vault-wait.yaml +++ b/google-github/templates/mgmt/components/argo-workflows/vault-wait.yaml @@ -22,4 +22,4 @@ spec: selfHeal: true syncOptions: - CreateNamespace=true - - Replace=true + \ No newline at end of file diff --git a/google-github/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml b/google-github/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml index c90d10ff9..d0f9b3f66 100644 --- a/google-github/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml +++ b/google-github/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml @@ -23,6 +23,7 @@ kind: Job metadata: annotations: argocd.argoproj.io/sync-wave: '0' + argocd.argoproj.io/sync-options: Force=true,Replace=true name: wait-vault-tls namespace: vault spec: diff --git a/google-github/templates/mgmt/components/argocd/kustomization.yaml b/google-github/templates/mgmt/components/argocd/kustomization.yaml index ef44dac20..1b7fd9651 100644 --- a/google-github/templates/mgmt/components/argocd/kustomization.yaml +++ b/google-github/templates/mgmt/components/argocd/kustomization.yaml @@ -5,7 +5,7 @@ namespace: argocd # To upgrade ArgoCD, increment the version here # https://github.com/argoproj/argo-cd/tags resources: - - github.com:kubefirst/manifests.git/argocd/cloud?ref=main + - github.com:konstructio/manifests.git/argocd/cloud?ref=v1.1.0 - argocd-ui-ingress.yaml - externalsecrets.yaml - argocd-oidc-restart-job.yaml diff --git a/google-github/templates/mgmt/components/kubefirst/console.yaml b/google-github/templates/mgmt/components/kubefirst/console.yaml index f9d950528..df130b7f1 100644 --- a/google-github/templates/mgmt/components/kubefirst/console.yaml +++ b/google-github/templates/mgmt/components/kubefirst/console.yaml @@ -8,8 +8,8 @@ metadata: spec: project: default source: - repoURL: https://charts.kubefirst.com - targetRevision: 2.4.14-rc39 + repoURL: https://charts.konstruct.io + targetRevision: 2.5.12-rc3 chart: kubefirst helm: values: |- diff --git a/google-github/terraform/github/repos.tf b/google-github/terraform/github/repos.tf index f3b41c16e..a85ea51a9 100644 --- a/google-github/terraform/github/repos.tf +++ b/google-github/terraform/github/repos.tf @@ -18,7 +18,7 @@ terraform { module "gitops" { source = "./modules/repository" - repo_name = "gitops" + repo_name = "" archive_on_destroy = false auto_init = false # set to false if importing an existing repository team_developers_id = github_team.developers.id @@ -47,7 +47,7 @@ variable "atlantis_repo_webhook_secret" { module "metaphor" { source = "./modules/repository" - repo_name = "metaphor" + repo_name = "" archive_on_destroy = false auto_init = false # set to false if importing an existing repository create_ecr = true diff --git a/google-github/terraform/github/teams.tf b/google-github/terraform/github/teams.tf index 355d21b5f..a77f9bae9 100644 --- a/google-github/terraform/github/teams.tf +++ b/google-github/terraform/github/teams.tf @@ -1,11 +1,11 @@ resource "github_team" "admins" { - name = "admins" + name = "" description = "administrators of the kubefirst platform" privacy = "closed" } resource "github_team" "developers" { - name = "developers" + name = "" description = "developers using the kubefirst plaftform" privacy = "closed" } diff --git a/google-github/terraform/users/admins/data_sources.tf b/google-github/terraform/users/admins/data_sources.tf index a454eea5f..1331a4653 100644 --- a/google-github/terraform/users/admins/data_sources.tf +++ b/google-github/terraform/users/admins/data_sources.tf @@ -1,5 +1,5 @@ data "github_team" "admins" { - slug = "admins" + slug = "" } data "vault_auth_backend" "userpass" { diff --git a/google-github/terraform/users/developers/data_sources.tf b/google-github/terraform/users/developers/data_sources.tf index 9c5d5c625..471e1c444 100644 --- a/google-github/terraform/users/developers/data_sources.tf +++ b/google-github/terraform/users/developers/data_sources.tf @@ -1,5 +1,5 @@ data "github_team" "developers" { - slug = "developers" + slug = "" } data "vault_auth_backend" "userpass" { diff --git a/google-github/terraform/users/users.tf b/google-github/terraform/users/users.tf index 52183ae5a..bf4b7b10e 100644 --- a/google-github/terraform/users/users.tf +++ b/google-github/terraform/users/users.tf @@ -19,11 +19,11 @@ terraform { } data "github_team" "admins" { - slug = "admins" + slug = "" } data "github_team" "developers" { - slug = "developers" + slug = "" } data "vault_auth_backend" "userpass" { @@ -31,7 +31,7 @@ data "vault_auth_backend" "userpass" { } data "vault_identity_group" "admins" { - group_name = "admins" + group_name = "" } variable "initial_password" { diff --git a/google-github/terraform/vault/oidc-groups.tf b/google-github/terraform/vault/oidc-groups.tf index 4da060600..b2cc82df9 100644 --- a/google-github/terraform/vault/oidc-groups.tf +++ b/google-github/terraform/vault/oidc-groups.tf @@ -1,5 +1,5 @@ resource "vault_identity_group" "developers" { - name = "developers" + name = "" type = "internal" policies = ["developer"] @@ -16,7 +16,7 @@ resource "vault_identity_group" "developers" { } resource "vault_identity_group" "admins" { - name = "admins" + name = "" type = "internal" policies = ["admin"] diff --git a/google-gitlab/templates/mgmt/components/argo-workflows/vault-wait.yaml b/google-gitlab/templates/mgmt/components/argo-workflows/vault-wait.yaml index 47beecc62..bde31a201 100644 --- a/google-gitlab/templates/mgmt/components/argo-workflows/vault-wait.yaml +++ b/google-gitlab/templates/mgmt/components/argo-workflows/vault-wait.yaml @@ -22,4 +22,3 @@ spec: selfHeal: true syncOptions: - CreateNamespace=true - - Replace=true diff --git a/google-gitlab/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml b/google-gitlab/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml index c90d10ff9..d0f9b3f66 100644 --- a/google-gitlab/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml +++ b/google-gitlab/templates/mgmt/components/argo-workflows/wait/vault-tls.yaml @@ -23,6 +23,7 @@ kind: Job metadata: annotations: argocd.argoproj.io/sync-wave: '0' + argocd.argoproj.io/sync-options: Force=true,Replace=true name: wait-vault-tls namespace: vault spec: diff --git a/google-gitlab/templates/mgmt/components/argocd/kustomization.yaml b/google-gitlab/templates/mgmt/components/argocd/kustomization.yaml index ef44dac20..1b7fd9651 100644 --- a/google-gitlab/templates/mgmt/components/argocd/kustomization.yaml +++ b/google-gitlab/templates/mgmt/components/argocd/kustomization.yaml @@ -5,7 +5,7 @@ namespace: argocd # To upgrade ArgoCD, increment the version here # https://github.com/argoproj/argo-cd/tags resources: - - github.com:kubefirst/manifests.git/argocd/cloud?ref=main + - github.com:konstructio/manifests.git/argocd/cloud?ref=v1.1.0 - argocd-ui-ingress.yaml - externalsecrets.yaml - argocd-oidc-restart-job.yaml diff --git a/google-gitlab/templates/mgmt/components/kubefirst/console.yaml b/google-gitlab/templates/mgmt/components/kubefirst/console.yaml index f9d950528..df130b7f1 100644 --- a/google-gitlab/templates/mgmt/components/kubefirst/console.yaml +++ b/google-gitlab/templates/mgmt/components/kubefirst/console.yaml @@ -8,8 +8,8 @@ metadata: spec: project: default source: - repoURL: https://charts.kubefirst.com - targetRevision: 2.4.14-rc39 + repoURL: https://charts.konstruct.io + targetRevision: 2.5.12-rc3 chart: kubefirst helm: values: |- diff --git a/google-gitlab/terraform/gitlab/groups.tf b/google-gitlab/terraform/gitlab/groups.tf index c5c5f16f4..da300caa0 100644 --- a/google-gitlab/terraform/gitlab/groups.tf +++ b/google-gitlab/terraform/gitlab/groups.tf @@ -3,15 +3,15 @@ data "gitlab_group" "owner" { } resource "gitlab_group" "admins" { - name = "admins" - path = "admins" + name = "" + path = "" parent_id = data.gitlab_group.owner.group_id description = "admins group" } resource "gitlab_group" "developers" { - name = "developers" - path = "developers" + name = "" + path = "" parent_id = data.gitlab_group.owner.group_id description = "developers group" } diff --git a/google-gitlab/terraform/gitlab/projects.tf b/google-gitlab/terraform/gitlab/projects.tf index f91932cac..22266ddef 100644 --- a/google-gitlab/terraform/gitlab/projects.tf +++ b/google-gitlab/terraform/gitlab/projects.tf @@ -1,7 +1,7 @@ module "metaphor" { source = "./modules/project" group_name = data.gitlab_group.owner.id - project_name = "metaphor" + project_name = "" initialize_with_readme = false only_allow_merge_if_pipeline_succeeds = false remove_source_branch_after_merge = true @@ -10,7 +10,7 @@ module "metaphor" { module "gitops" { source = "./modules/project" group_name = data.gitlab_group.owner.id - project_name = "gitops" + project_name = " " initialize_with_readme = false only_allow_merge_if_pipeline_succeeds = false remove_source_branch_after_merge = true diff --git a/google-gitlab/terraform/users/admins/data-sources.tf b/google-gitlab/terraform/users/admins/data-sources.tf index c15703de5..cdc94d28b 100644 --- a/google-gitlab/terraform/users/admins/data-sources.tf +++ b/google-gitlab/terraform/users/admins/data-sources.tf @@ -1,5 +1,5 @@ data "vault_identity_group" "admins" { - group_name = "admins" + group_name = "" } data "vault_auth_backend" "userpass" { diff --git a/google-gitlab/terraform/users/developers/data-sources.tf b/google-gitlab/terraform/users/developers/data-sources.tf index d05780273..ab3d1abd8 100644 --- a/google-gitlab/terraform/users/developers/data-sources.tf +++ b/google-gitlab/terraform/users/developers/data-sources.tf @@ -1,3 +1,3 @@ data "vault_identity_group" "developers" { - group_name = "developers" + group_name = "" } \ No newline at end of file diff --git a/google-gitlab/terraform/users/modules/user/main.tf b/google-gitlab/terraform/users/modules/user/main.tf index 7ad950860..fb091f121 100644 --- a/google-gitlab/terraform/users/modules/user/main.tf +++ b/google-gitlab/terraform/users/modules/user/main.tf @@ -133,15 +133,15 @@ variable "group_id" { } data "vault_identity_group" "admins" { - group_name = "admins" + group_name = "" } data "gitlab_group" "admins" { - full_path = "/admins" + full_path = "/" } data "gitlab_group" "developers" { - full_path = "/developers" + full_path = "/" } data "gitlab_user" "user" { diff --git a/google-gitlab/terraform/users/users.tf b/google-gitlab/terraform/users/users.tf index 2e2ab8ff3..a3870d7a0 100644 --- a/google-gitlab/terraform/users/users.tf +++ b/google-gitlab/terraform/users/users.tf @@ -19,11 +19,11 @@ terraform { } data "gitlab_group" "admins" { - full_path = "/admins" + full_path = "/" } data "gitlab_group" "developers" { - full_path = "/developers" + full_path = "/" } @@ -32,7 +32,7 @@ data "vault_auth_backend" "userpass" { } data "vault_identity_group" "admins" { - group_name = "admins" + group_name = "" } variable "initial_password" { @@ -41,7 +41,7 @@ variable "initial_password" { } data "vault_identity_group" "developers" { - group_name = "developers" + group_name = "" } module "admins" { diff --git a/google-gitlab/terraform/vault/oidc-groups.tf b/google-gitlab/terraform/vault/oidc-groups.tf index 4da060600..b2cc82df9 100644 --- a/google-gitlab/terraform/vault/oidc-groups.tf +++ b/google-gitlab/terraform/vault/oidc-groups.tf @@ -1,5 +1,5 @@ resource "vault_identity_group" "developers" { - name = "developers" + name = "" type = "internal" policies = ["developer"] @@ -16,7 +16,7 @@ resource "vault_identity_group" "developers" { } resource "vault_identity_group" "admins" { - name = "admins" + name = "" type = "internal" policies = ["admin"] diff --git a/k3d-github/cluster-types/mgmt/components/argocd/kustomization.yaml b/k3d-github/cluster-types/mgmt/components/argocd/kustomization.yaml index 596551601..8b096b58c 100644 --- a/k3d-github/cluster-types/mgmt/components/argocd/kustomization.yaml +++ b/k3d-github/cluster-types/mgmt/components/argocd/kustomization.yaml @@ -5,7 +5,7 @@ namespace: argocd # To upgrade ArgoCD, increment the version here # https://github.com/argoproj/argo-cd/tags resources: - - github.com:argoproj/argo-cd.git/manifests/cluster-install?ref=v2.6.4 + - github.com:argoproj/argo-cd.git/manifests/cluster-install?ref=v2.12.0 - argocd-namespace.yaml - argocd-ui-ingress.yaml - argocd-ui-ingressroute.yaml diff --git a/k3d-github/cluster-types/mgmt/components/github-runner/runnerdeployment.yaml b/k3d-github/cluster-types/mgmt/components/github-runner/runnerdeployment.yaml index 0cfe46d1b..f2e1cc9da 100644 --- a/k3d-github/cluster-types/mgmt/components/github-runner/runnerdeployment.yaml +++ b/k3d-github/cluster-types/mgmt/components/github-runner/runnerdeployment.yaml @@ -8,7 +8,7 @@ spec: replicas: 1 template: spec: - repository: /metaphor + repository: / image: summerwind/actions-runner-dind serviceAccountName: github-runner dockerdWithinRunnerContainer: true diff --git a/k3d-github/cluster-types/mgmt/components/kubefirst/console-arm.yaml b/k3d-github/cluster-types/mgmt/components/kubefirst/console-arm.yaml index ec3c83216..617564add 100644 --- a/k3d-github/cluster-types/mgmt/components/kubefirst/console-arm.yaml +++ b/k3d-github/cluster-types/mgmt/components/kubefirst/console-arm.yaml @@ -8,8 +8,8 @@ metadata: spec: project: default source: - repoURL: https://charts.kubefirst.com - targetRevision: 2.4.14-rc39 + repoURL: https://charts.konstruct.io + targetRevision: 2.5.12-rc3 chart: kubefirst helm: values: |- diff --git a/k3d-github/cluster-types/mgmt/components/kubefirst/console.yaml b/k3d-github/cluster-types/mgmt/components/kubefirst/console.yaml index ec3c83216..617564add 100644 --- a/k3d-github/cluster-types/mgmt/components/kubefirst/console.yaml +++ b/k3d-github/cluster-types/mgmt/components/kubefirst/console.yaml @@ -8,8 +8,8 @@ metadata: spec: project: default source: - repoURL: https://charts.kubefirst.com - targetRevision: 2.4.14-rc39 + repoURL: https://charts.konstruct.io + targetRevision: 2.5.12-rc3 chart: kubefirst helm: values: |- diff --git a/k3d-github/terraform/github/repos.tf b/k3d-github/terraform/github/repos.tf index 80ba23763..467430f73 100644 --- a/k3d-github/terraform/github/repos.tf +++ b/k3d-github/terraform/github/repos.tf @@ -2,7 +2,7 @@ module "gitops" { source = "./modules/repository" visibility = "private" - repo_name = "gitops" + repo_name = "" archive_on_destroy = false auto_init = false # set to false if importing an existing repository } @@ -10,7 +10,7 @@ module "gitops" { module "metaphor" { source = "./modules/repository" - repo_name = "metaphor" + repo_name = "" archive_on_destroy = false auto_init = false # set to false if importing an existing repository } diff --git a/k3d-github/terraform/vault/policies.tf b/k3d-github/terraform/vault/policies.tf index 93bf58075..439ae5a8e 100644 --- a/k3d-github/terraform/vault/policies.tf +++ b/k3d-github/terraform/vault/policies.tf @@ -141,7 +141,7 @@ EOT } resource "vault_policy" "developer" { - name = "developer" + name = "developers" policy = <