[DO-1431] deploy ArgoCD (!6)
DO-1431 Co-authored-by: denis.patrakeev <denis.patrakeev@avroid.tech> Reviewed-on: https://git.avroid.tech/K8s/k8s-configs/pulls/6
This commit is contained in:
Denis Patrakeev
23
.editorconfig
Normal file
23
.editorconfig
Normal file
@@ -0,0 +1,23 @@
|
|||||||
|
# EditorConfig is awesome: https://editorconfig.org
|
||||||
|
|
||||||
|
# top-most EditorConfig file
|
||||||
|
root = true
|
||||||
|
|
||||||
|
# Unix-style newlines with a newline ending every file
|
||||||
|
[*]
|
||||||
|
end_of_line = lf
|
||||||
|
insert_final_newline = true
|
||||||
|
charset = utf-8
|
||||||
|
|
||||||
|
[*.sh]
|
||||||
|
# like -i=4
|
||||||
|
indent_style = space
|
||||||
|
indent_size = 4
|
||||||
|
|
||||||
|
# --language-variant
|
||||||
|
shell_variant = bash
|
||||||
|
binary_next_line = true
|
||||||
|
# --case-indent
|
||||||
|
switch_case_indent = true
|
||||||
|
space_redirects = true
|
||||||
|
keep_padding = true
|
||||||
13
.gitea/pull_request_template.md
Normal file
13
.gitea/pull_request_template.md
Normal file
@@ -0,0 +1,13 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
name: "Feature PR"
|
||||||
|
about: "Template feature PR"
|
||||||
|
title: "[DO-XXXX] New feature"
|
||||||
|
ref: "main"
|
||||||
|
assignees: ["svc-gitea-k8s-w"]
|
||||||
|
labels:
|
||||||
|
- "kind/Feature"
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
[DO-XXXX]
|
||||||
44
.gitea/workflows/check-shellscripts.yml
Normal file
44
.gitea/workflows/check-shellscripts.yml
Normal file
@@ -0,0 +1,44 @@
|
|||||||
|
---
|
||||||
|
name: Check ShellScripts
|
||||||
|
run-name: ${{ gitea.actor }} is start check shellscripts
|
||||||
|
on: [pull_request]
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
shellscripts:
|
||||||
|
name: Check shellscripts by shellcheck
|
||||||
|
runs-on: docker
|
||||||
|
container:
|
||||||
|
image: harbor.avroid.tech/docker-hub-proxy/library/node:20
|
||||||
|
steps:
|
||||||
|
- run: echo "Start job on ${{ runner.name }} with os ${{ runner.os }}"
|
||||||
|
- run: echo "Work with branch ${{ gitea.ref }} repository ${{ gitea.repository }}"
|
||||||
|
|
||||||
|
- name: Check out repository code
|
||||||
|
uses: https://git-mirrors.avroid.tech/Mirrors-actions/checkout.git@v4
|
||||||
|
|
||||||
|
- name: Check shellscripts by shellcheck
|
||||||
|
uses: https://git-mirrors.avroid.tech/Mirrors-actions/action-shellcheck.git@2.0.0
|
||||||
|
|
||||||
|
shfmt:
|
||||||
|
name: Check shellscript formatting
|
||||||
|
runs-on: docker
|
||||||
|
container:
|
||||||
|
image: harbor.avroid.tech/docker-hub-proxy/library/node:20
|
||||||
|
steps:
|
||||||
|
- run: echo "Start job on ${{ runner.name }} with os ${{ runner.os }}"
|
||||||
|
- run: echo "Work with branch ${{ gitea.ref }} repository ${{ gitea.repository }}"
|
||||||
|
|
||||||
|
- name: Check out repository code
|
||||||
|
uses: https://git-mirrors.avroid.tech/Mirrors-actions/checkout.git@v4
|
||||||
|
|
||||||
|
- name: Install Golang
|
||||||
|
uses: https://git-mirrors.avroid.tech/Mirrors-actions/setup-go.git@v5
|
||||||
|
with:
|
||||||
|
go-version: '1.22'
|
||||||
|
check-latest: true
|
||||||
|
|
||||||
|
- name: Install shfmt
|
||||||
|
run: go install mvdan.cc/sh/v3/cmd/shfmt@latest
|
||||||
|
|
||||||
|
- name: Check shellscripts by shfmt
|
||||||
|
run: shfmt -d .
|
||||||
37
.gitignore
vendored
Normal file
37
.gitignore
vendored
Normal file
@@ -0,0 +1,37 @@
|
|||||||
|
# ---> Ansible
|
||||||
|
*.retry
|
||||||
|
.vault_password_file
|
||||||
|
ansible_collections
|
||||||
|
|
||||||
|
# ---> JetBrains
|
||||||
|
# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio, WebStorm and Rider
|
||||||
|
# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
|
||||||
|
.idea
|
||||||
|
|
||||||
|
# File-based project format
|
||||||
|
*.iws
|
||||||
|
|
||||||
|
# ---> VisualStudioCode
|
||||||
|
.vscode
|
||||||
|
.history/
|
||||||
|
*.vsix
|
||||||
|
**/.DS_Store
|
||||||
|
|
||||||
|
|
||||||
|
# Other
|
||||||
|
.vagrant
|
||||||
|
|
||||||
|
.venv
|
||||||
|
venv*
|
||||||
|
.kubespray-venv
|
||||||
|
kubespray-venv*
|
||||||
|
**/.kubespray-venv
|
||||||
|
**/kubespray-venv*
|
||||||
|
|
||||||
|
__pycache__
|
||||||
|
*~
|
||||||
|
*.log
|
||||||
|
._*
|
||||||
|
|
||||||
|
.creds
|
||||||
|
.secrets
|
||||||
@@ -0,0 +1,39 @@
|
|||||||
|
# Argo CD
|
||||||
|
|
||||||
|
## Project structure
|
||||||
|
```text
|
||||||
|
.
|
||||||
|
├── README.md
|
||||||
|
├── argocd-namespace.yaml
|
||||||
|
├── .rbac
|
||||||
|
├── argo-cd
|
||||||
|
│ ├── README.md
|
||||||
|
│ ├── values-override.yml
|
||||||
|
│ ├── argocd_values_secrets_init.sh
|
||||||
|
│ └── .rbac
|
||||||
|
└── argocd-apps
|
||||||
|
├── README.md
|
||||||
|
└── values-override.yml
|
||||||
|
|
||||||
|
Назначение:
|
||||||
|
argo-cd - Helm-чарт для установки Argo CD
|
||||||
|
argocd-apps - Helm-чарт для развёртывания в Argo CD "корневого" приложения, которое будет разворачивать остальные приложения
|
||||||
|
argocd-namespace.yaml - манифест для создания namespace Argo CD
|
||||||
|
.rbac - кастомные правила для RBAC
|
||||||
|
```
|
||||||
|
## First install
|
||||||
|
Порядок развёртывания Argo CD:
|
||||||
|
1. Настраиваем для работы файл конфигурации kubectl для подключения к кластеру Kubernetes
|
||||||
|
|
||||||
|
2. Готовим namespace:
|
||||||
|
```bash
|
||||||
|
kubectl apply -f argocd-namespace.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
2. Разворачиваем Argo CD
|
||||||
|
|
||||||
|
[README.md](argo-cd/README.md)
|
||||||
|
|
||||||
|
3. Разворачиваем "корневое" приложение в Argo CD
|
||||||
|
|
||||||
|
[README.md](argocd-apps/README.md)
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: serviceaccount
|
||||||
|
app.kubernetes.io/instance: vault-sa
|
||||||
|
app.kubernetes.io/component: rbac
|
||||||
|
app.kubernetes.io/created-by: vault-operator
|
||||||
|
app.kubernetes.io/part-of: vault-operator
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: vault
|
||||||
|
namespace: argocd
|
||||||
@@ -0,0 +1,120 @@
|
|||||||
|
# Install Argo CD by [argo-cd in argo-helm](https://github.com/argoproj/argo-helm/tree/main/charts/argo-cd)
|
||||||
|
|
||||||
|
## Create from version
|
||||||
|
| Project | Version |
|
||||||
|
|---------------------|---------|
|
||||||
|
| ArgoCD Helm | 7.8.2 |
|
||||||
|
| ArgoCD | v2.14.2 |
|
||||||
|
| ArgoCD Vault Plugin | 1.18.1 |
|
||||||
|
|
||||||
|
|
||||||
|
## Plugins
|
||||||
|
1. Argo CD Vault Plugin
|
||||||
|
|
||||||
|
https://argocd-vault-plugin.readthedocs.io/en/stable/installation/#initcontainer-and-configuration-via-sidecar
|
||||||
|
|
||||||
|
https://github.com/argoproj-labs/argocd-vault-plugin/tree/main/manifests/cmp-sidecar
|
||||||
|
|
||||||
|
https://habr.com/ru/articles/645773/
|
||||||
|
|
||||||
|
|
||||||
|
## Install
|
||||||
|
Настраиваем для работы файл конфигурации kubectl для подключения к кластеру Kubernetes
|
||||||
|
|
||||||
|
Готовим служебную УЗ для vault:
|
||||||
|
```bash
|
||||||
|
kubectl apply -f .rbac/vault-service-account.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
Получаем из Vault секреты с паролями/токенами/сертификатами и выгружаем в окружение оболочки:
|
||||||
|
```bash
|
||||||
|
./argocd_values_secrets_init.sh
|
||||||
|
|
||||||
|
source .creds
|
||||||
|
```
|
||||||
|
|
||||||
|
Создаём секрет с сертификатами:
|
||||||
|
```bash
|
||||||
|
kubectl -n argocd create secret tls argocd-server-tls \
|
||||||
|
--cert=.secrets/argocd_cert.pem \
|
||||||
|
--key=.secrets/argocd_key.pem
|
||||||
|
```
|
||||||
|
|
||||||
|
Добавляем конфигурацию для плагина ArgoCD Vault:
|
||||||
|
```bash
|
||||||
|
kubectl -n argocd apply -f .secrets/argocd-vault-plugin-configmap.yaml
|
||||||
|
kubectl -n argocd apply -f .secrets/argocd-vault-plugin-secret.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
И производим непосредственную установку ArgoCD:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
helm repo add argo https://argoproj.github.io/argo-helm
|
||||||
|
helm repo update
|
||||||
|
|
||||||
|
helm install -n argocd argo-cd argo/argo-cd -f values-override.yaml \
|
||||||
|
--set configs.secret.argocdServerAdminPassword=$ARGOCD_ADMIN_PASSWORD_HASH \
|
||||||
|
--set configs.repositories.argocd-git-server.username=$ARGOCD_GIT_REPO_USER \
|
||||||
|
--set configs.repositories.argocd-git-server.password=$ARGOCD_GIT_REPO_USER_PASSWORD
|
||||||
|
```
|
||||||
|
|
||||||
|
Подпихиваем в секрет `argocd-secret` необходимые для конфигурации секреты:
|
||||||
|
```bash
|
||||||
|
kubectl -n argocd patch --patch-file .secrets/argocd-secret-path.yaml secret argocd-secret
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## Upgrade/Changes
|
||||||
|
Обновление настроек и чарта делаем так:
|
||||||
|
|
||||||
|
В начале сравниваем содержимое `values-override.yaml` с исходным файлом `values.yaml`
|
||||||
|
(ссылка на исходную версию зафиксирована в заголовке `values-override.yaml`) через diff (IDE лучше).
|
||||||
|
Или с новой версией `values.yaml` в Helm-чарте.
|
||||||
|
Вносим необходимые правки, новые опции или добавляем секреты.
|
||||||
|
|
||||||
|
Получаем из Vault секреты с паролями/токенами/сертификатами и выгружаем в окружение оболочки:
|
||||||
|
```bash
|
||||||
|
./argocd_values_secrets_init.sh
|
||||||
|
|
||||||
|
source .creds
|
||||||
|
```
|
||||||
|
|
||||||
|
Создаём секрет с сертификатами:
|
||||||
|
```bash
|
||||||
|
kubectl -n argocd create secret tls argocd-server-tls \
|
||||||
|
--cert=.secrets/argocd_cert.pem \
|
||||||
|
--key=.secrets/argocd_key.pem
|
||||||
|
```
|
||||||
|
|
||||||
|
Добавляем конфигурацию для плагина ArgoCD Vault:
|
||||||
|
```bash
|
||||||
|
kubectl -n argocd apply -f .secrets/argocd-vault-plugin-configmap.yaml
|
||||||
|
kubectl -n argocd apply -f .secrets/argocd-vault-plugin-secret.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
Подпихиваем в секрет argocd-secret необходимые для конфигурации секреты:
|
||||||
|
```bash
|
||||||
|
kubectl -n argocd patch --patch-file .secrets/argocd-secret-path.yaml secret argocd-secret
|
||||||
|
```
|
||||||
|
|
||||||
|
Затем применяем:
|
||||||
|
```bash
|
||||||
|
helm upgrade -n argocd argo-cd argo/argo-cd -f values-override.yaml \
|
||||||
|
--set configs.secret.argocdServerAdminPassword=$ARGOCD_ADMIN_PASSWORD_HASH \
|
||||||
|
--set configs.repositories.argocd-git-server.username=$ARGOCD_GIT_REPO_USER \
|
||||||
|
--set configs.repositories.argocd-git-server.password=$ARGOCD_GIT_REPO_USER_PASSWORD
|
||||||
|
```
|
||||||
|
|
||||||
|
## Установка и использование CLI Argo CD на локальной машине
|
||||||
|
https://argo-cd.readthedocs.io/en/stable/cli_installation
|
||||||
|
|
||||||
|
MacOS:
|
||||||
|
```bash
|
||||||
|
brew install argocd
|
||||||
|
```
|
||||||
|
|
||||||
|
Использование:
|
||||||
|
```bash
|
||||||
|
argocd login argocd.avroid.tech
|
||||||
|
```
|
||||||
@@ -0,0 +1,102 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
set -e
|
||||||
|
|
||||||
|
rm -rf .creds .secrets
|
||||||
|
|
||||||
|
argocd_admin_password=$(vault kv get team-devops/services/ci-cd/ArgoCD/argocd.avroid.tech | grep service.user.admin.password | awk '{print $2}')
|
||||||
|
|
||||||
|
# shellcheck disable=SC2016
|
||||||
|
argocd_admin_password_hash=$(htpasswd -nbBC 10 "" "${argocd_admin_password}" | tr -d ':\n' | sed 's/$2y/$2a/')
|
||||||
|
|
||||||
|
argocd_ldap_binddn=$(vault kv get team-devops/accounts/ldap/service_accounts/svc_argocd | grep dn | awk '{print $2}')
|
||||||
|
argocd_ldap_binddn_password=$(vault kv get team-devops/accounts/ldap/service_accounts/svc_argocd | grep password | awk '{print $2}')
|
||||||
|
|
||||||
|
argocd_tg_token=$(vault kv get team-devops/accounts/bots/telegram/alertmanager | grep bot.avroid_alerts_bot.token | awk '{print $2}')
|
||||||
|
|
||||||
|
argocd_repo_user=$(vault kv get team-devops/accounts/ldap/service_accounts/svc_argocd | grep login | awk '{print $2}')
|
||||||
|
argocd_repo_password=$(vault kv get team-devops/accounts/ldap/service_accounts/svc_argocd | grep password | awk '{print $2}')
|
||||||
|
|
||||||
|
argocd_cert_key=$(vault kv get -field="certificate.key" team-devops/ssl/avroid.tech/wildcard.avroid.tech)
|
||||||
|
argocd_cert_data=$(vault kv get -field="certificate_fullchain.crt" team-devops/ssl/avroid.tech/wildcard.avroid.tech)
|
||||||
|
|
||||||
|
argocd_avp_role_id=$(vault kv get team-devops/services/ci-cd/ArgoCD/argocd.avroid.tech | grep service.argocd_vault_plugin.vault.env.AVP_ROLE_ID | awk '{print $2}')
|
||||||
|
argocd_avp_secret_id=$(vault kv get team-devops/services/ci-cd/ArgoCD/argocd.avroid.tech | grep service.argocd_vault_plugin.vault.env.AVP_SECRET_ID | awk '{print $2}')
|
||||||
|
|
||||||
|
cat > .creds << EOF
|
||||||
|
export ARGOCD_ADMIN_PASSWORD='${argocd_admin_password}'
|
||||||
|
export ARGOCD_ADMIN_PASSWORD_HASH='${argocd_admin_password_hash}'
|
||||||
|
export ARGOCD_GIT_REPO_USER='${argocd_repo_user}'
|
||||||
|
export ARGOCD_GIT_REPO_USER_PASSWORD='${argocd_repo_password}'
|
||||||
|
EOF
|
||||||
|
|
||||||
|
mkdir .secrets
|
||||||
|
|
||||||
|
cat > .secrets/argocd_key.pem << EOF
|
||||||
|
${argocd_cert_key}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
cat > .secrets/argocd_cert.pem << EOF
|
||||||
|
${argocd_cert_data}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
cat > .secrets/argocd-secret-path.yaml << EOF
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: argocd-secret
|
||||||
|
namespace: argocd
|
||||||
|
type: Opaque
|
||||||
|
stringData:
|
||||||
|
admin.password: ${argocd_admin_password_hash}
|
||||||
|
dex.ldap.bindDN: ${argocd_ldap_binddn}
|
||||||
|
dex.ldap.bindPW: ${argocd_ldap_binddn_password}
|
||||||
|
telegram-token: ${argocd_tg_token}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
cat > .secrets/argocd-vault-plugin-configmap.yaml << EOF
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: cmp-plugin
|
||||||
|
namespace: argocd
|
||||||
|
data:
|
||||||
|
avp.yaml: |
|
||||||
|
apiVersion: argoproj.io/v1alpha1
|
||||||
|
kind: ConfigManagementPlugin
|
||||||
|
metadata:
|
||||||
|
name: argocd-vault-plugin
|
||||||
|
spec:
|
||||||
|
allowConcurrency: true
|
||||||
|
discover:
|
||||||
|
find:
|
||||||
|
command:
|
||||||
|
- sh
|
||||||
|
- "-c"
|
||||||
|
- "find . -name '*.yaml' | xargs -I {} grep \"<path\\\\|avp\\\\.kubernetes\\\\.io\" {} | grep ."
|
||||||
|
generate:
|
||||||
|
command:
|
||||||
|
- argocd-vault-plugin
|
||||||
|
- generate
|
||||||
|
- "."
|
||||||
|
lockRepo: false
|
||||||
|
EOF
|
||||||
|
|
||||||
|
cat > .secrets/argocd-vault-plugin-secret.yaml << EOF
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: argocd-vault-plugin-credentials
|
||||||
|
namespace: argocd
|
||||||
|
type: Opaque
|
||||||
|
stringData:
|
||||||
|
AVP_AUTH_TYPE: approle
|
||||||
|
AVP_TYPE: vault
|
||||||
|
VAULT_ADDR: "https://vault.avroid.tech"
|
||||||
|
AVP_ROLE_ID: ${argocd_avp_role_id}
|
||||||
|
AVP_SECRET_ID: ${argocd_avp_secret_id}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
echo "Run:"
|
||||||
|
echo ' 1. source .creds'
|
||||||
|
echo ' 2. kubectl -n argocd apply -f .secrets/argocd-vault-plugin-configmap.yaml'
|
||||||
|
echo ' 3. kubectl -n argocd apply -f .secrets/argocd-vault-plugin-secret.yaml'
|
||||||
@@ -0,0 +1,346 @@
|
|||||||
|
## Argo CD configuration
|
||||||
|
## Ref: https://github.com/argoproj/argo-cd
|
||||||
|
##
|
||||||
|
|
||||||
|
## Globally shared configuration
|
||||||
|
global:
|
||||||
|
# -- Default domain used by all components
|
||||||
|
## Used for ingresses, certificates, SSO, notifications, etc.
|
||||||
|
domain: argocd.avroid.tech
|
||||||
|
|
||||||
|
# Default image used by all components
|
||||||
|
image:
|
||||||
|
# -- If defined, a repository applied to all Argo CD deployments
|
||||||
|
repository: &global-image-repository "harbor.avroid.tech/quay-proxy/argoproj/argocd"
|
||||||
|
# -- Overrides the global Argo CD image tag whose default is the chart appVersion
|
||||||
|
tag: &global-image-tag "v2.14.2"
|
||||||
|
|
||||||
|
# -- Default node selector for all components
|
||||||
|
nodeSelector:
|
||||||
|
node-role.kubernetes.io/worker: ""
|
||||||
|
|
||||||
|
## Argo Configs
|
||||||
|
configs:
|
||||||
|
# General Argo CD configuration
|
||||||
|
## Ref: https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/argocd-cm.yaml
|
||||||
|
cm:
|
||||||
|
# Dex configuration
|
||||||
|
dex.config: |
|
||||||
|
connectors:
|
||||||
|
- type: ldap
|
||||||
|
name: avroid.tech
|
||||||
|
id: ldap_avroid_tech
|
||||||
|
config:
|
||||||
|
# Ldap server address
|
||||||
|
host: "ds-01.avroid.tech:636"
|
||||||
|
insecureNoSSL: false
|
||||||
|
insecureSkipVerify: true
|
||||||
|
# Variable name stores ldap bindDN in argocd-secret
|
||||||
|
bindDN: "$dex.ldap.bindDN"
|
||||||
|
# Variable name stores ldap bind password in argocd-secret
|
||||||
|
bindPW: "$dex.ldap.bindPW"
|
||||||
|
usernamePrompt: Username
|
||||||
|
# Ldap user serch attributes
|
||||||
|
userSearch:
|
||||||
|
baseDN: cn=users,cn=accounts,dc=avroid,dc=tech
|
||||||
|
filter: "(objectClass=inetorgperson)"
|
||||||
|
username: uid
|
||||||
|
idAttr: uid
|
||||||
|
emailAttr: mail
|
||||||
|
# Ldap group serch attributes
|
||||||
|
groupSearch:
|
||||||
|
baseDN: cn=groups,cn=accounts,dc=avroid,dc=tech
|
||||||
|
filter: "(|(objectClass=posixGroup)(objectClass=groupOfNames))"
|
||||||
|
userMatchers:
|
||||||
|
- userAttr: DN
|
||||||
|
groupAttr: member
|
||||||
|
# Represents group name.
|
||||||
|
nameAttr: cn
|
||||||
|
|
||||||
|
# Argo CD configuration parameters
|
||||||
|
## Ref: https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/argocd-cmd-params-cm.yaml
|
||||||
|
params:
|
||||||
|
## Server properties
|
||||||
|
# -- Run server without TLS
|
||||||
|
## NOTE: This value should be set when you generate params by other means as it changes ports used by ingress template.
|
||||||
|
server.insecure: true
|
||||||
|
|
||||||
|
# Argo CD RBAC policy configuration
|
||||||
|
## Ref: https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/rbac.md
|
||||||
|
rbac:
|
||||||
|
# -- The name of the default role which Argo CD will falls back to, when authorizing API requests (optional).
|
||||||
|
# If omitted or empty, users may be still be able to login, but will see no apps, projects, etc...
|
||||||
|
policy.default: 'role:deny'
|
||||||
|
|
||||||
|
# -- File containing user-defined policies and role definitions.
|
||||||
|
# @default -- `''` (See [values.yaml])
|
||||||
|
policy.csv: |
|
||||||
|
p, role:devops-admin, applications, *, */*, allow
|
||||||
|
p, role:devops-admin, applicationsets, *, */*, allow
|
||||||
|
p, role:devops-admin, clusters, *, *, allow
|
||||||
|
p, role:devops-admin, projects, *, *, allow
|
||||||
|
p, role:devops-admin, repositories, *, *, allow
|
||||||
|
p, role:devops-admin, accounts, *, *, allow
|
||||||
|
p, role:devops-admin, certificates, *, *, allow
|
||||||
|
p, role:devops-admin, gpgkeys, *, *, allow
|
||||||
|
p, role:devops-admin, logs, *, *, allow
|
||||||
|
p, role:devops-admin, exec, *, */*, allow
|
||||||
|
p, role:devops-admin, extensions, *, */*, allow
|
||||||
|
g, grp-admin-devops, role:devops-admin
|
||||||
|
# Policy rules are in the form:
|
||||||
|
# p, subject, resource, action, object, effect
|
||||||
|
# Role definitions and bindings are in the form:
|
||||||
|
# g, subject, inherited-subject
|
||||||
|
# policy.csv: |
|
||||||
|
# p, role:org-admin, applications, *, */*, allow
|
||||||
|
# p, role:org-admin, clusters, get, *, allow
|
||||||
|
# p, role:org-admin, repositories, *, *, allow
|
||||||
|
# p, role:org-admin, logs, get, *, allow
|
||||||
|
# p, role:org-admin, exec, create, */*, allow
|
||||||
|
# g, your-github-org:your-team, role:org-admin
|
||||||
|
|
||||||
|
# -- Repositories list to be used by applications
|
||||||
|
## Creates a secret for each key/value specified below to create repositories
|
||||||
|
## Note: the last example in the list would use a repository credential template, configured under "configs.repositoryCredentials".
|
||||||
|
repositories:
|
||||||
|
argocd-git-server:
|
||||||
|
url: https://git.avroid.tech/K8s/k8s-configs.git
|
||||||
|
name: prod_agrocd_configuration_repo
|
||||||
|
type: git
|
||||||
|
username: $git.repo.username
|
||||||
|
password: $git.repo.password
|
||||||
|
# istio-helm-repo:
|
||||||
|
# url: https://storage.googleapis.com/istio-prerelease/daily-build/master-latest-daily/charts
|
||||||
|
# name: istio.io
|
||||||
|
# type: helm
|
||||||
|
# private-helm-repo:
|
||||||
|
# url: https://my-private-chart-repo.internal
|
||||||
|
# name: private-repo
|
||||||
|
# type: helm
|
||||||
|
# password: my-password
|
||||||
|
# username: my-username
|
||||||
|
# private-repo:
|
||||||
|
# url: https://github.com/argoproj/private-repo
|
||||||
|
|
||||||
|
# Argo CD sensitive data
|
||||||
|
# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#sensitive-data-and-sso-client-secrets
|
||||||
|
secret:
|
||||||
|
# -- Bcrypt hashed admin password
|
||||||
|
## Argo expects the password in the secret to be bcrypt hashed. You can create this hash with
|
||||||
|
## `htpasswd -nbBC 10 "" $ARGO_PWD | tr -d ':\n' | sed 's/$2y/$2a/'`
|
||||||
|
argocdServerAdminPassword: $admin.password
|
||||||
|
|
||||||
|
## Dex image
|
||||||
|
image:
|
||||||
|
# -- Dex image repository
|
||||||
|
repository: harbor.avroid.tech/quay-proxy/dexidp/dex
|
||||||
|
|
||||||
|
## Redis-HA subchart replaces custom redis deployment when `redis-ha.enabled=true`
|
||||||
|
# Ref: https://github.com/DandyDeveloper/charts/blob/master/charts/redis-ha/values.yaml
|
||||||
|
redis-ha:
|
||||||
|
# -- Enables the Redis HA subchart and disables the custom Redis single node deployment
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
## Server
|
||||||
|
server:
|
||||||
|
## Argo CD server Horizontal Pod Autoscaler
|
||||||
|
autoscaling:
|
||||||
|
# -- Enable Horizontal Pod Autoscaler ([HPA]) for the Argo CD server
|
||||||
|
enabled: true
|
||||||
|
# -- Minimum number of replicas for the Argo CD server [HPA]
|
||||||
|
minReplicas: 2
|
||||||
|
|
||||||
|
# Argo CD server ingress configuration
|
||||||
|
ingress:
|
||||||
|
# -- Enable an ingress resource for the Argo CD server
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
# -- Additional ingress annotations
|
||||||
|
## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#option-1-ssl-passthrough
|
||||||
|
annotations:
|
||||||
|
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||||
|
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||||
|
|
||||||
|
# -- Defines which ingress controller will implement the resource
|
||||||
|
ingressClassName: "nginx"
|
||||||
|
|
||||||
|
# -- Enable TLS configuration for the hostname defined at `server.ingress.hostname`
|
||||||
|
## TLS certificate will be retrieved from a TLS secret `argocd-server-tls`
|
||||||
|
## You can create this secret via `certificate` or `certificateSecret` option
|
||||||
|
tls: true
|
||||||
|
|
||||||
|
## Repo Server
|
||||||
|
repoServer:
|
||||||
|
## Repo server Horizontal Pod Autoscaler
|
||||||
|
autoscaling:
|
||||||
|
# -- Enable Horizontal Pod Autoscaler ([HPA]) for the repo server
|
||||||
|
enabled: true
|
||||||
|
# -- Minimum number of replicas for the repo server [HPA]
|
||||||
|
minReplicas: 2
|
||||||
|
|
||||||
|
# -- Additional containers to be added to the repo server pod
|
||||||
|
## Ref: https://argo-cd.readthedocs.io/en/stable/user-guide/config-management-plugins/
|
||||||
|
## Note: Supports use of custom Helm templates
|
||||||
|
extraContainers:
|
||||||
|
- name: avp
|
||||||
|
command: [/var/run/argocd/argocd-cmp-server]
|
||||||
|
image: "{{ .Values.global.image.repository }}:{{ .Values.global.image.tag }}"
|
||||||
|
securityContext:
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 999
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /var/run/argocd
|
||||||
|
name: var-files
|
||||||
|
- mountPath: /home/argocd/cmp-server/plugins
|
||||||
|
name: plugins
|
||||||
|
- mountPath: /tmp
|
||||||
|
name: tmp
|
||||||
|
# Register plugins into sidecar
|
||||||
|
- mountPath: /home/argocd/cmp-server/config/plugin.yaml
|
||||||
|
subPath: avp.yaml
|
||||||
|
name: cmp-plugin
|
||||||
|
# Important: Mount tools into $PATH
|
||||||
|
- name: custom-tools
|
||||||
|
subPath: argocd-vault-plugin
|
||||||
|
mountPath: /usr/local/bin/argocd-vault-plugin
|
||||||
|
|
||||||
|
# -- Init containers to add to the repo server pods
|
||||||
|
initContainers:
|
||||||
|
- name: download-tools
|
||||||
|
image: registry.access.redhat.com/ubi8
|
||||||
|
env:
|
||||||
|
- name: AVP_VERSION
|
||||||
|
value: 1.18.1
|
||||||
|
command: [sh, -c]
|
||||||
|
args:
|
||||||
|
- >-
|
||||||
|
curl -L https://nexus.avroid.tech/repository/devops-raw-proxy-gitea/argoproj-labs/argocd-vault-plugin/releases/download/v$(AVP_VERSION)/argocd-vault-plugin_$(AVP_VERSION)_linux_amd64 -o argocd-vault-plugin &&
|
||||||
|
chmod +x argocd-vault-plugin &&
|
||||||
|
mv argocd-vault-plugin /custom-tools/
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /custom-tools
|
||||||
|
name: custom-tools
|
||||||
|
|
||||||
|
# -- Additional volumes to the repo server pod
|
||||||
|
volumes:
|
||||||
|
- name: cmp-plugin
|
||||||
|
configMap:
|
||||||
|
name: cmp-plugin
|
||||||
|
- name: custom-tools
|
||||||
|
emptyDir: {}
|
||||||
|
|
||||||
|
# -- Automount API credentials for the Service Account into the pod.
|
||||||
|
automountServiceAccountToken: true
|
||||||
|
|
||||||
|
## ApplicationSet controller
|
||||||
|
applicationSet:
|
||||||
|
# -- The number of ApplicationSet controller pods to run
|
||||||
|
replicas: 2
|
||||||
|
|
||||||
|
|
||||||
|
# -- Configures notification services such as slack, email or custom webhook
|
||||||
|
# @default -- See [values.yaml]
|
||||||
|
## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/overview/
|
||||||
|
notifiers:
|
||||||
|
service.telegram: |
|
||||||
|
token: $telegram-token
|
||||||
|
|
||||||
|
# -- Contains centrally managed global application subscriptions
|
||||||
|
## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/subscriptions/
|
||||||
|
subscriptions:
|
||||||
|
- recipients:
|
||||||
|
# warning channel
|
||||||
|
- telegram:-1001685938630
|
||||||
|
triggers:
|
||||||
|
- on-sync-status-unknown
|
||||||
|
- app-deployed
|
||||||
|
- on-sync-succeeded
|
||||||
|
- recipients:
|
||||||
|
# critical channel
|
||||||
|
- telegram:-1001997104886
|
||||||
|
triggers:
|
||||||
|
- on-health-degraded
|
||||||
|
- on-sync-failed
|
||||||
|
|
||||||
|
# -- The notification template is used to generate the notification content
|
||||||
|
## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/templates/
|
||||||
|
templates:
|
||||||
|
template.app-deployed: |
|
||||||
|
email:
|
||||||
|
subject: New version of an application {{.app.metadata.name}} is up and running.
|
||||||
|
message: |
|
||||||
|
{{if eq .serviceType "slack"}}:white_check_mark:{{end}} Application {{.app.metadata.name}} is now running new version of deployments manifests.
|
||||||
|
template.app-health-degraded: |
|
||||||
|
email:
|
||||||
|
subject: Application {{.app.metadata.name}} has degraded.
|
||||||
|
message: |
|
||||||
|
{{if eq .serviceType "slack"}}:exclamation:{{end}} Application {{.app.metadata.name}} has degraded.
|
||||||
|
Application details: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}.
|
||||||
|
template.app-sync-failed: |
|
||||||
|
email:
|
||||||
|
subject: Failed to sync application {{.app.metadata.name}}.
|
||||||
|
message: |
|
||||||
|
{{if eq .serviceType "slack"}}:exclamation:{{end}} The sync operation of application {{.app.metadata.name}} has failed at {{.app.status.operationState.finishedAt}} with the following error: {{.app.status.operationState.message}}
|
||||||
|
Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .
|
||||||
|
template.app-sync-running: |
|
||||||
|
email:
|
||||||
|
subject: Start syncing application {{.app.metadata.name}}.
|
||||||
|
message: |
|
||||||
|
The sync operation of application {{.app.metadata.name}} has started at {{.app.status.operationState.startedAt}}.
|
||||||
|
Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .
|
||||||
|
template.app-sync-status-unknown: |
|
||||||
|
email:
|
||||||
|
subject: Application {{.app.metadata.name}} sync status is 'Unknown'
|
||||||
|
message: |
|
||||||
|
{{if eq .serviceType "slack"}}:exclamation:{{end}} Application {{.app.metadata.name}} sync is 'Unknown'.
|
||||||
|
Application details: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}.
|
||||||
|
{{if ne .serviceType "slack"}}
|
||||||
|
{{range $c := .app.status.conditions}}
|
||||||
|
* {{$c.message}}
|
||||||
|
{{end}}
|
||||||
|
{{end}}
|
||||||
|
template.app-sync-succeeded: |
|
||||||
|
email:
|
||||||
|
subject: Application {{.app.metadata.name}} has been successfully synced.
|
||||||
|
message: |
|
||||||
|
{{if eq .serviceType "slack"}}:white_check_mark:{{end}} Application {{.app.metadata.name}} has been successfully synced at {{.app.status.operationState.finishedAt}}.
|
||||||
|
Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .
|
||||||
|
|
||||||
|
# -- The trigger defines the condition when the notification should be sent
|
||||||
|
## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/triggers/
|
||||||
|
triggers:
|
||||||
|
trigger.on-deployed: |
|
||||||
|
- description: Application is synced and healthy. Triggered once per commit.
|
||||||
|
oncePer: app.status.sync.revision
|
||||||
|
send:
|
||||||
|
- app-deployed
|
||||||
|
when: app.status.operationState.phase in ['Succeeded'] and app.status.health.status == 'Healthy'
|
||||||
|
trigger.on-health-degraded: |
|
||||||
|
- description: Application has degraded
|
||||||
|
send:
|
||||||
|
- app-health-degraded
|
||||||
|
when: app.status.health.status == 'Degraded'
|
||||||
|
trigger.on-sync-failed: |
|
||||||
|
- description: Application syncing has failed
|
||||||
|
send:
|
||||||
|
- app-sync-failed
|
||||||
|
when: app.status.operationState.phase in ['Error', 'Failed']
|
||||||
|
trigger.on-sync-running: |
|
||||||
|
- description: Application is being synced
|
||||||
|
send:
|
||||||
|
- app-sync-running
|
||||||
|
when: app.status.operationState.phase in ['Running']
|
||||||
|
trigger.on-sync-status-unknown: |
|
||||||
|
- description: Application status is 'Unknown'
|
||||||
|
send:
|
||||||
|
- app-sync-status-unknown
|
||||||
|
when: app.status.sync.status == 'Unknown'
|
||||||
|
trigger.on-sync-succeeded: |
|
||||||
|
- description: Application syncing has succeeded
|
||||||
|
send:
|
||||||
|
- app-sync-succeeded
|
||||||
|
when: app.status.operationState.phase in ['Succeeded']
|
||||||
|
#
|
||||||
|
# For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/triggers/#default-triggers
|
||||||
|
# defaultTriggers: |
|
||||||
|
# - on-sync-status-unknown
|
||||||
@@ -0,0 +1,45 @@
|
|||||||
|
# Install Argo CD by [argocd-apps in argo-helm](https://github.com/argoproj/argo-helm/tree/main/charts/argocd-apps)
|
||||||
|
|
||||||
|
## Create from version
|
||||||
|
| Project | Version |
|
||||||
|
|---------------------|---------|
|
||||||
|
| ArgoCD Helm | 7.8.2 |
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## Common
|
||||||
|
Используется подход управления приложениями через корневое приложение:
|
||||||
|
|
||||||
|
[App of Apps Pattern](https://github.com/argoproj/argo-helm/tree/main/charts/argocd-apps)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## Prepare install
|
||||||
|
Предварительно должен быть развёрнут и настроен ArgoCD через оператора `argo-cd` из состава `ArgoCD Helm` (каталог с инструкцией и переменными `argo-cd`)
|
||||||
|
|
||||||
|
|
||||||
|
## Install
|
||||||
|
Настраиваем для работы файл конфигурации kubectl для подключения к кластеру Kubernetes
|
||||||
|
|
||||||
|
И производим непосредственную установку корневого приложения ArgoCD:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
helm repo add argo https://argoproj.github.io/argo-helm
|
||||||
|
helm repo update
|
||||||
|
|
||||||
|
helm install -n argocd argocd-apps argo/argocd-apps -f values-override.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
## Upgrade/Changes
|
||||||
|
Обновление настроек и чарта делаем так:
|
||||||
|
|
||||||
|
В начале сравниваем содержимое `values-override.yaml` с исходным файлом `values.yaml`
|
||||||
|
(ссылка на исходную версию зафиксирована в заголовке `values-override.yaml`) через diff (IDE лучше).
|
||||||
|
Или с новой версией `values.yaml` в Helm-чарте.
|
||||||
|
Вносим необходимые правки, новые опции или добавляем секреты.
|
||||||
|
|
||||||
|
Затем применяем:
|
||||||
|
```bash
|
||||||
|
helm upgrade -n argocd argocd-apps argo/argocd-apps -f values-override.yaml
|
||||||
|
```
|
||||||
@@ -0,0 +1,37 @@
|
|||||||
|
# -- Deploy Argo CD Applications within this helm release
|
||||||
|
# @default -- `{}` (See [values.yaml])
|
||||||
|
## Ref: https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/
|
||||||
|
applications:
|
||||||
|
root-app:
|
||||||
|
namespace: argocd
|
||||||
|
additionalLabels: {}
|
||||||
|
additionalAnnotations: {}
|
||||||
|
finalizers:
|
||||||
|
- resources-finalizer.argocd.argoproj.io
|
||||||
|
project: default
|
||||||
|
source:
|
||||||
|
repoURL: https://git.avroid.tech/K8s/k8s-configs.git
|
||||||
|
targetRevision: master
|
||||||
|
path: clusters/k8s-avroid-office.prod.local/namespaces
|
||||||
|
directory:
|
||||||
|
recurse: true
|
||||||
|
exclude: '*'
|
||||||
|
include: 'argocd-apps-*.yaml'
|
||||||
|
destination:
|
||||||
|
server: https://kubernetes.default.svc
|
||||||
|
namespace: argocd
|
||||||
|
syncPolicy:
|
||||||
|
automated:
|
||||||
|
prune: true
|
||||||
|
selfHeal: true
|
||||||
|
syncOptions:
|
||||||
|
- CreateNamespace=true
|
||||||
|
- Validate=true
|
||||||
|
- PrunePropagationPolicy=foreground
|
||||||
|
- PruneLast=true
|
||||||
|
retry:
|
||||||
|
limit: 5
|
||||||
|
backoff:
|
||||||
|
duration: 5s
|
||||||
|
factor: 2
|
||||||
|
maxDuration: 3m
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: argocd
|
||||||
|
labels:
|
||||||
|
name: argocd
|
||||||
|
app.kubernetes.io/managed-by: manual
|
||||||
|
annotations:
|
||||||
|
scheduler.alpha.kubernetes.io/node-selector: node-role.kubernetes.io/worker=
|
||||||
Reference in New Issue
Block a user