Skip to content

Commit 66cb29f

Browse files
jokestaxjokestax
authored
feat: add physical gitlab support in gcp and vultr (#861)
1 parent ad0afa2 commit 66cb29f

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+1902
-0
lines changed

‎google-gitlab/templates/workload-cluster/0-providerconfig.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: <WORKLOAD_CLUSTER_NAME>-provider-config
5+
namespace: argocd
6+
finalizers:
7+
- resources-finalizer.argocd.argoproj.io
8+
annotations:
9+
argocd.argoproj.io/sync-wave: '0'
10+
spec:
11+
project: default
12+
source:
13+
repoURL: <GITOPS_REPO_URL>
14+
path: registry/clusters/<WORKLOAD_CLUSTER_NAME>/provider-config
15+
targetRevision: HEAD
16+
destination:
17+
name: in-cluster
18+
namespace: crossplane-system
19+
syncPolicy:
20+
automated:
21+
prune: true
22+
selfHeal: true
23+
syncOptions:
24+
- CreateNamespace=true

‎google-gitlab/templates/workload-cluster/10-infrastructure.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: <WORKLOAD_CLUSTER_NAME>-infrastructure
5+
namespace: argocd
6+
finalizers:
7+
- resources-finalizer.argocd.argoproj.io
8+
annotations:
9+
argocd.argoproj.io/sync-wave: '10'
10+
spec:
11+
project: default
12+
source:
13+
repoURL: <GITOPS_REPO_URL>
14+
path: registry/clusters/<WORKLOAD_CLUSTER_NAME>/infrastructure
15+
targetRevision: HEAD
16+
destination:
17+
name: in-cluster
18+
namespace: <WORKLOAD_CLUSTER_NAME>
19+
syncPolicy:
20+
automated:
21+
prune: true
22+
selfHeal: true
23+
syncOptions:
24+
- CreateNamespace=true

‎google-gitlab/templates/workload-cluster/20-argocd-connection.yaml

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
apiVersion: "external-secrets.io/v1beta1"
2+
kind: ExternalSecret
3+
metadata:
4+
name: <WORKLOAD_CLUSTER_NAME>
5+
annotations:
6+
argocd.argoproj.io/sync-wave: '20'
7+
labels:
8+
app.kubernetes.io/part-of: argocd
9+
spec:
10+
target:
11+
name: <WORKLOAD_CLUSTER_NAME>
12+
template:
13+
metadata:
14+
labels:
15+
argocd.argoproj.io/secret-type: cluster
16+
engineVersion: v2
17+
data:
18+
name: "{{ .cluster_name }}"
19+
server: "{{ .host }}"
20+
clusterResources: "true"
21+
config: |
22+
{
23+
"execProviderConfig": {
24+
"command": "argocd-k8s-auth",
25+
"args": ["gcp"],
26+
"apiVersion": "client.authentication.k8s.io/v1beta1"
27+
},
28+
"bearerToken": "{{ .argocd_manager_sa_token }}",
29+
"tlsClientConfig": {
30+
"caData": "{{ .cluster_ca_certificate | b64enc }}",
31+
"insecure": false
32+
}
33+
}
34+
secretStoreRef:
35+
kind: ClusterSecretStore
36+
name: vault-kv-secret
37+
refreshInterval: 10s
38+
data:
39+
- remoteRef:
40+
key: clusters/<WORKLOAD_CLUSTER_NAME>
41+
property: argocd_manager_sa_token
42+
secretKey: argocd_manager_sa_token
43+
- remoteRef:
44+
key: clusters/<WORKLOAD_CLUSTER_NAME>
45+
property: host
46+
secretKey: host
47+
- remoteRef:
48+
key: clusters/<WORKLOAD_CLUSTER_NAME>
49+
property: cluster_name
50+
secretKey: cluster_name
51+
- remoteRef:
52+
key: clusters/<WORKLOAD_CLUSTER_NAME>
53+
property: cluster_ca_certificate
54+
conversionStrategy: Default
55+
secretKey: cluster_ca_certificate

‎google-gitlab/templates/workload-cluster/30-cert-manager.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: <WORKLOAD_CLUSTER_NAME>-cert-manager
5+
namespace: argocd
6+
finalizers:
7+
- resources-finalizer.argocd.argoproj.io
8+
annotations:
9+
argocd.argoproj.io/sync-wave: '30'
10+
spec:
11+
project: <WORKLOAD_CLUSTER_NAME>
12+
source:
13+
repoURL: https://charts.jetstack.io
14+
targetRevision: v1.14.4
15+
helm:
16+
values: |-
17+
serviceAccount:
18+
create: true
19+
name: cert-manager
20+
installCRDs: true
21+
chart: cert-manager
22+
destination:
23+
name: <WORKLOAD_CLUSTER_NAME>
24+
namespace: cert-manager
25+
syncPolicy:
26+
automated:
27+
prune: true
28+
selfHeal: true
29+
syncOptions:
30+
- CreateNamespace=true

‎google-gitlab/templates/workload-cluster/30-external-dns.yaml

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: <WORKLOAD_CLUSTER_NAME>-external-dns
5+
namespace: argocd
6+
annotations:
7+
argocd.argoproj.io/sync-wave: '30'
8+
spec:
9+
project: <WORKLOAD_CLUSTER_NAME>
10+
source:
11+
repoURL: https://kubernetes-sigs.github.io/external-dns
12+
targetRevision: 1.14.4
13+
helm:
14+
releaseName: external-dns
15+
values: |
16+
image:
17+
repository: registry.k8s.io/external-dns/external-dns
18+
tag: "v0.13.2"
19+
serviceAccount:
20+
create: true
21+
name: external-dns
22+
provider: google
23+
sources:
24+
- ingress
25+
env:
26+
- name: GOOGLE_APPLICATION_CREDENTIALS
27+
value: "/tmp/credentials.json"
28+
domainFilters:
29+
- <WORKLOAD_EXTERNAL_DNS_DOMAIN_NAME>
30+
extraVolumes:
31+
- name: secrets
32+
secret:
33+
secretName: external-dns
34+
extraVolumeMounts:
35+
- name: secrets
36+
mountPath: /tmp
37+
chart: external-dns
38+
destination:
39+
name: <WORKLOAD_CLUSTER_NAME>
40+
namespace: external-dns
41+
syncPolicy:
42+
automated:
43+
prune: true
44+
selfHeal: true
45+
syncOptions:
46+
- CreateNamespace=true

‎google-gitlab/templates/workload-cluster/30-external-secrets-operator.yaml

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: <WORKLOAD_CLUSTER_NAME>-external-secrets-operator
5+
namespace: argocd
6+
finalizers:
7+
- resources-finalizer.argocd.argoproj.io
8+
annotations:
9+
argocd.argoproj.io/sync-wave: '30'
10+
spec:
11+
project: <WORKLOAD_CLUSTER_NAME>
12+
source:
13+
repoURL: https://charts.external-secrets.io
14+
targetRevision: 0.8.1
15+
helm:
16+
values: |-
17+
serviceAccount:
18+
create: false
19+
name: external-secrets
20+
chart: external-secrets
21+
destination:
22+
name: <WORKLOAD_CLUSTER_NAME>
23+
namespace: external-secrets-operator
24+
syncPolicy:
25+
automated:
26+
prune: true
27+
selfHeal: true
28+
syncOptions:
29+
- CreateNamespace=true
30+
- RespectIgnoreDifferences=true
31+
ignoreDifferences:
32+
- group: apiextensions.k8s.io
33+
kind: CustomResourceDefinition
34+
jqPathExpressions:
35+
- .spec.conversion.webhook.clientConfig.caBundle
36+
- .spec.conversion.webhook.clientConfig.service.name
37+
- .spec.conversion.webhook.clientConfig.service.namespace
38+
- group: admissionregistration.k8s.io
39+
kind: ValidatingWebhookConfiguration
40+
jqPathExpressions:
41+
- .webhooks[]?.clientConfig.caBundle
42+
---
43+
apiVersion: rbac.authorization.k8s.io/v1
44+
kind: ClusterRoleBinding
45+
metadata:
46+
name: <WORKLOAD_CLUSTER_NAME>-eso-kubernetes-external-secrets-auth
47+
annotations:
48+
argocd.argoproj.io/sync-wave: '40'
49+
roleRef:
50+
apiGroup: rbac.authorization.k8s.io
51+
kind: ClusterRole
52+
name: 'system:auth-delegator'
53+
subjects:
54+
- kind: ServiceAccount
55+
name: external-secrets
56+
namespace: external-secrets-operator
57+
---
58+
apiVersion: rbac.authorization.k8s.io/v1
59+
kind: ClusterRoleBinding
60+
metadata:
61+
name: <WORKLOAD_CLUSTER_NAME>-eso-kubernetes-external-secrets-auth2
62+
annotations:
63+
argocd.argoproj.io/sync-wave: '40'
64+
roleRef:
65+
apiGroup: rbac.authorization.k8s.io
66+
kind: ClusterRole
67+
name: 'cluster-admin'
68+
subjects:
69+
- kind: ServiceAccount
70+
name: external-secrets
71+
namespace: external-secrets-operator

‎google-gitlab/templates/workload-cluster/30-ingress-nginx.yaml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: <WORKLOAD_CLUSTER_NAME>-ingress-nginx
5+
namespace: argocd
6+
finalizers:
7+
- resources-finalizer.argocd.argoproj.io
8+
annotations:
9+
argocd.argoproj.io/sync-wave: '30'
10+
spec:
11+
project: <WORKLOAD_CLUSTER_NAME>
12+
source:
13+
repoURL: https://kubernetes.github.io/ingress-nginx
14+
targetRevision: 4.10.0
15+
helm:
16+
values: |-
17+
controller:
18+
podAnnotations:
19+
linkerd.io/inject: enabled
20+
ingressClass: nginx
21+
publishService:
22+
enabled: true
23+
service:
24+
annotations:
25+
service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"
26+
service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "60"
27+
extraArgs:
28+
enable-ssl-passthrough: true
29+
chart: ingress-nginx
30+
destination:
31+
name: <WORKLOAD_CLUSTER_NAME>
32+
namespace: ingress-nginx
33+
syncPolicy:
34+
automated:
35+
prune: true
36+
selfHeal: true
37+
syncOptions:
38+
- CreateNamespace=true

‎google-gitlab/templates/workload-cluster/30-reloader.yaml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: <WORKLOAD_CLUSTER_NAME>-reloader
5+
namespace: argocd
6+
annotations:
7+
argocd.argoproj.io/sync-wave: '30'
8+
spec:
9+
project: <WORKLOAD_CLUSTER_NAME>
10+
source:
11+
repoURL: 'https://stakater.github.io/stakater-charts'
12+
targetRevision: v1.0.10
13+
chart: reloader
14+
helm:
15+
values: |-
16+
ignoreSecrets: false
17+
destination:
18+
name: <WORKLOAD_CLUSTER_NAME>
19+
namespace: reloader
20+
syncPolicy:
21+
automated:
22+
prune: true
23+
selfHeal: true
24+
syncOptions:
25+
- CreateNamespace=true
26+
retry:
27+
limit: 5
28+
backoff:
29+
duration: 5s
30+
maxDuration: 5m0s
31+
factor: 2

‎google-gitlab/templates/workload-cluster/40-clusterissuers.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: <WORKLOAD_CLUSTER_NAME>-cert-issuers
5+
namespace: argocd
6+
finalizers:
7+
- resources-finalizer.argocd.argoproj.io
8+
annotations:
9+
argocd.argoproj.io/sync-wave: '40'
10+
spec:
11+
project: <WORKLOAD_CLUSTER_NAME>
12+
source:
13+
repoURL: <GITOPS_REPO_URL>
14+
path: registry/clusters/<WORKLOAD_CLUSTER_NAME>/cert-issuers
15+
targetRevision: HEAD
16+
destination:
17+
name: <WORKLOAD_CLUSTER_NAME>
18+
namespace: cert-manager
19+
syncPolicy:
20+
automated:
21+
prune: true
22+
selfHeal: true
23+
syncOptions:
24+
- CreateNamespace=true

‎google-gitlab/templates/workload-cluster/40-clustersecretstore.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: <WORKLOAD_CLUSTER_NAME>-cluster-secret-store
5+
namespace: argocd
6+
finalizers:
7+
- resources-finalizer.argocd.argoproj.io
8+
annotations:
9+
argocd.argoproj.io/sync-wave: '40'
10+
spec:
11+
project: <WORKLOAD_CLUSTER_NAME>
12+
source:
13+
repoURL: <GITOPS_REPO_URL>
14+
path: registry/clusters/<WORKLOAD_CLUSTER_NAME>/cluster-secret-store
15+
targetRevision: HEAD
16+
destination:
17+
name: <WORKLOAD_CLUSTER_NAME>
18+
namespace: external-secrets-operator
19+
syncPolicy:
20+
automated:
21+
prune: true
22+
selfHeal: true
23+
syncOptions:
24+
- CreateNamespace=true

0 commit comments

Comments
 (0)