Skip to content

Commit 71b78a1

Browse files
author
Martin Jackson
committed
Add 'common/' from commit '87776c67c95800b96bec329caeff95d9a55ff2bd'
git-subtree-dir: common git-subtree-mainline: 6a4c3e0 git-subtree-split: 87776c6
2 parents 6a4c3e0 + 87776c6 commit 71b78a1

27 files changed

+1310
-0
lines changed

‎common/.ansible-lint

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Vim filetype=yaml
2+
---
3+
offline: false
4+
skip_list:
5+
- name[template] # Allow Jinja templating inside task and play names
6+
- template-instead-of-copy # Templated files should use template instead of copy
7+
- yaml[line-length] # too long lines
8+
- yaml[indentation] # Forcing lists to be always indented by 2 chars is silly IMO
9+
- var-naming[no-role-prefix] # This would be too much churn for very little gain
10+
- no-changed-when
11+
- var-naming[no-role-prefix] # There are too many changes now and it would be too risky
12+
13+
# ansible-lint gh workflow cannot find ansible.cfg hence fails to import vault_utils role
14+
exclude_paths:
15+
- ./ansible/playbooks/vault/vault.yaml
16+
- ./ansible/playbooks/iib-ci/iib-ci.yaml
17+
- ./ansible/playbooks/k8s_secrets/k8s_secrets.yml
18+
- ./ansible/playbooks/process_secrets/process_secrets.yml
19+
- ./ansible/playbooks/write-token-kubeconfig/write-token-kubeconfig.yml
20+
- ./ansible/playbooks/process_secrets/display_secrets_info.yml
21+
- ./ansible/roles/vault_utils/tests/test.yml

‎common/.github/dependabot.yml

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
version: 2
3+
updates:
4+
# Check for updates to GitHub Actions every week
5+
- package-ecosystem: "github-actions"
6+
directory: "/"
7+
schedule:
8+
interval: "weekly"
9+

‎common/.github/linters/.gitleaks.toml

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
[whitelist]
2+
# As of v4, gitleaks only matches against filename, not path in the
3+
# files directive. Leaving content for backwards compatibility.
4+
files = [ ]

‎common/.github/linters/.markdown-lint.yml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"default": true,
3+
"MD003": false,
4+
"MD013": false,
5+
"MD033": false
6+
}

‎common/.github/workflows/superlinter.yml

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
name: Super linter
3+
4+
on: [push, pull_request]
5+
6+
jobs:
7+
build:
8+
# Name the Job
9+
name: Super linter
10+
# Set the agent to run on
11+
runs-on: ubuntu-latest
12+
13+
steps:
14+
- name: Checkout Code
15+
uses: actions/checkout@v4
16+
with:
17+
# Full git history is needed to get a proper list of changed files within `super-linter`
18+
fetch-depth: 0
19+
20+
################################
21+
# Run Linter against code base #
22+
################################
23+
- name: Lint Code Base
24+
uses: super-linter/super-linter/slim@v7
25+
env:
26+
VALIDATE_ALL_CODEBASE: true
27+
DEFAULT_BRANCH: main
28+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
29+
# These are the validation we disable atm
30+
VALIDATE_ANSIBLE: false
31+
VALIDATE_BASH: false
32+
VALIDATE_CHECKOV: false
33+
VALIDATE_JSCPD: false
34+
VALIDATE_JSON_PRETTIER: false
35+
VALIDATE_MARKDOWN_PRETTIER: false
36+
VALIDATE_KUBERNETES_KUBECONFORM: false
37+
VALIDATE_PYTHON_PYLINT: false
38+
VALIDATE_SHELL_SHFMT: false
39+
VALIDATE_YAML: false
40+
VALIDATE_YAML_PRETTIER: false
41+
# VALIDATE_DOCKERFILE_HADOLINT: false
42+
# VALIDATE_MARKDOWN: false
43+
# VALIDATE_NATURAL_LANGUAGE: false
44+
# VALIDATE_TEKTON: false

‎common/.gitignore

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
__pycache__/
2+
*.py[cod]
3+
*~
4+
*.swp
5+
*.swo
6+
values-secret.yaml
7+
.*.expected.yaml
8+
.vscode
9+
pattern-vault.init
10+
pattern-vault.init.bak
11+
super-linter.log
12+
golang-external-secrets/Chart.lock
13+
hashicorp-vault/Chart.lock

‎common/.gitleaks.toml

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
.github/linters/.gitleaks.toml

‎common/Changes.md

+153
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
# Changes
2+
3+
## Sep 24, 2024
4+
5+
* Ansible has been moved out of the common code tree, you must use a clustergroup chart that is >= 0.9.1
6+
7+
## Sep 6, 2024
8+
9+
* Most charts have been removed from the tree. To get the charts you now have to point to them
10+
11+
## Sep 25, 2023
12+
13+
* Upgraded ESO to v0.9.5
14+
15+
## Aug 17, 2023
16+
17+
* Introduced support for multisource applications via .chart + .chartVersion
18+
19+
## Jul 8, 2023
20+
21+
* Introduced a default of 20 for sync failures retries in argo applications (global override via global.options.applicationRetryLimit
22+
and per-app override via .syncPolicy)
23+
24+
## May 22, 2023
25+
26+
* Upgraded ESO to 0.8.2
27+
* *Important* we now use the newly blessed sso config for argo. This means that gitops < 1.8 are *unsupported*
28+
29+
## May 18, 2023
30+
31+
* Introduce a EXTRA_HELM_OPTS env variable that will be passed to the helm invocations
32+
33+
## April 21, 2023
34+
35+
* Added labels and annotation support to namespaces.yaml template
36+
37+
## Apr 11, 2023
38+
39+
* Apply the ACM ocp-gitops-policy everywhere but the hub
40+
41+
## Apr 7, 2023
42+
43+
* Moved to gitops-1.8 channel by default (stable is unmaintained and will be dropped starting with ocp-4.13)
44+
45+
## March 20, 2023
46+
47+
* Upgraded ESO to 0.8.1
48+
49+
## February 9, 2023
50+
51+
* Add support for /values-<platform>.yaml and for /values-<platform>-<clusterversion>.yaml
52+
53+
## January 29, 2023
54+
55+
* Stop extracting the HUB's CA via an imperative job running on the imported cluster.
56+
Just use ACM to push the HUB's CA out to the managed clusters.
57+
58+
## January 23, 2023
59+
60+
* Add initial support for running ESO on ACM-imported clusters
61+
62+
## January 18, 2023
63+
64+
* Add validate-schema target
65+
66+
## January 13, 2023
67+
68+
* Simplify the secrets paths when using argo hosted sites
69+
70+
## January 10, 2023
71+
72+
* vaultPrefixes is now optional in the v2 secret spec and defaults to ["hub"]
73+
74+
## December 9, 2022
75+
76+
* Dropped insecureUnsealVaultInsideCluster (and file_unseal) entirely. Now
77+
vault is always unsealed via a cronjob in the cluster. It is recommended to
78+
store the imperative/vaultkeys secret offline securely and then delete it.
79+
80+
## December 8, 2022
81+
82+
* Removed the legacy installation targets:
83+
`deploy upgrade legacy-deploy legacy-upgrade`
84+
Patterns must now use the operator-based installation
85+
86+
## November 29, 2022
87+
88+
* Upgraded vault-helm to 0.23.0
89+
* Enable vault-ssl by default
90+
91+
## November 22, 2022
92+
93+
* Implemented a new format for the values-secret.yaml. Example can be found in examples/ folder
94+
* Now the order of values-secret file lookup is the following:
95+
1. ~/values-secret-<patternname>.yaml
96+
2. ~/values-secret.yaml
97+
3. <patterngitrepo>/values-secret.yaml.template
98+
* Add support for ansible vault encrypted values-secret files. You can now encrypt your values-secret file
99+
at rest with `ansible-vault encrypt ~/values-secret.yaml`. When running `make load-secrets` if an encrypted
100+
file is encountered the user will be prompted automatically for the password to decrypt it.
101+
102+
## November 6, 2022
103+
104+
* Add support for /values-<CloudPlatform>-<clusterGroup>.yaml (e.g. /values-AWS-group-one.yaml)
105+
106+
## October 28, 2022
107+
108+
* Updated vault helm chart to v0.22.1 and vault containers to 1.12.0
109+
110+
## October 25, 2022
111+
112+
* Updated External Secrets Operator to v0.6.0
113+
* Moved to -UBI based ESO containers
114+
115+
## October 13, 2022
116+
117+
* Added global.clusterVersion as a new helm variable which represents the OCP
118+
Major.Minor cluster version. By default now a user can add a
119+
values-<ocpversion>-<clustergroup>.yaml file to have specific cluster version
120+
overrides (e.g. values-4.10-hub.yaml). Will need Validated Patterns Operator >= 0.0.6
121+
when deploying with the operator. Note: When using the ArgoCD Hub and spoke model,
122+
you cannot have spokes with a different version of OCP than the hub.
123+
124+
## October 4, 2022
125+
126+
* Extended the values-secret.yaml file to support multiple vault paths and re-wrote
127+
the push_secrets feature as python module plugin. This requires the following line
128+
in a pattern's ansible.cfg's '[defaults]' stanza:
129+
130+
`library=~/.ansible/plugins/modules:./ansible/plugins/modules:./common/ansible/plugins/modules:/usr/share/ansible/plugins/modules`
131+
132+
## October 3, 2022
133+
134+
* Restore the ability to install a non-default site: `make TARGET_SITE=mysite install`
135+
* Revised tests (new output and filenames, requires adding new result files to Git)
136+
* ACM 2.6 required for ACM-based managed sites
137+
* Introduced global.clusterDomain template variable (without the `apps.` prefix)
138+
* Removed the ability to send specific charts to another cluster, use hosted argo sites instead
139+
* Added the ability to have the hub host `values-{site}.yaml` for spoke clusters.
140+
141+
The following example would deploy the namespaces, subscriptions, and
142+
applications defined in `values-group-one.yaml` to the `perth` cluster
143+
directly from ArgoCD on the hub.
144+
145+
```yaml
146+
managedClusterGroups:
147+
- name: group-one
148+
hostedArgoSites:
149+
- name: perth
150+
domain: perth1.beekhof.net
151+
bearerKeyPath: secret/data/hub/cluster_perth
152+
caKeyPath: secret/data/hub/cluster_perth_ca
153+
```

0 commit comments

Comments
 (0)