add gke test cluster and bootstrap-v2

try multiplanetary values test
planetarium · Jan 23, 2025 · 6f157a2 · 6f157a2
1 parent 7f02dfc
commit 6f157a2
Show file tree

Hide file tree

Showing 19 changed files with 511 additions and 7 deletions.
diff --git a/charts/multiplanetary/templates/network.yaml b/charts/multiplanetary/templates/network.yaml
@@ -1,4 +1,4 @@
-{{ range $.Values.network }}
+{{- range $.Values.network }}
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -7,16 +7,15 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://github.com/planetarium/9c-infra.git
-    targetRevision: main
+    repoURL: {{ $.Values.repoURL | default "https://github.com/planetarium/9c-infra.git" }}
+    targetRevision: {{ $.Values.targetRevision | default "main" }}
     path: charts/all-in-one
     helm:
       valueFiles:
-        - "../../{{ $.Values.path }}/network/general.yaml"
-        - "../../{{ $.Values.path }}/network/{{ . }}.yaml"
-
+      - /{{ $.Values.path }}/network/general.yaml
+      - /{{ $.Values.path }}/network/{{ . }}.yaml
   destination:
     server: https://kubernetes.default.svc
     namespace: {{ . }}
 ---
-{{ end }}
+{{- end }}
diff --git a/common/bootstrap-v2/Chart.yaml b/common/bootstrap-v2/Chart.yaml
@@ -0,0 +1,6 @@
+apiVersion: v2
+type: application
+name: bootstrap-v2
+description: A Helm chart bootstrapping the cluster
+version: 0.2.0
+appVersion: 1.0.0
diff --git a/common/bootstrap-v2/kustomization/amazon-eks-pod-identity-webhook/kustomization.yaml b/common/bootstrap-v2/kustomization/amazon-eks-pod-identity-webhook/kustomization.yaml
@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+metadata:
+  name: amazon-eks-pod-identity-webhook
+resources:
+  - https://raw.githubusercontent.com/aws/amazon-eks-pod-identity-webhook/refs/tags/v0.6.2/deploy/auth.yaml
+  - https://raw.githubusercontent.com/aws/amazon-eks-pod-identity-webhook/refs/tags/v0.6.2/deploy/deployment-base.yaml
+  - https://raw.githubusercontent.com/aws/amazon-eks-pod-identity-webhook/refs/tags/v0.6.2/deploy/mutatingwebhook.yaml
+  - https://raw.githubusercontent.com/aws/amazon-eks-pod-identity-webhook/refs/tags/v0.6.2/deploy/service.yaml
+patches:
+  - target:
+      kind: Deployment
+      name: pod-identity-webhook
+    patch: |-
+      - op: replace
+        path: /spec/template/spec/containers/0/image
+        value: amazon/amazon-eks-pod-identity-webhook:latest
diff --git a/common/bootstrap-v2/templates/amazon-eks-pod-identity-webhook.yaml b/common/bootstrap-v2/templates/amazon-eks-pod-identity-webhook.yaml
@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: amazon-eks-pod-identity-webhook
+  namespace: argocd
+spec:
+  project: infra
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: default
+  source:
+    repoURL: https://github.com/planetarium/9c-infra.git
+    path: common/bootstrap-v2/kustomization/amazon-eks-pod-identity-webhook
+    targetRevision: gke
diff --git a/common/bootstrap-v2/templates/argocd-appproject-infra.yaml b/common/bootstrap-v2/templates/argocd-appproject-infra.yaml
@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: infra
+spec:
+  description: In-cluster applications managed by DevOps team
+  destinations:
+    - namespace: '*'
+      server: https://kubernetes.default.svc
+  sourceRepos:
+    - '*'
+  clusterResourceWhitelist:
+    - group: '*'
+      kind: '*'
+  namespaceResourceWhitelist:
+    - group: '*'
+      kind: '*'
diff --git a/common/bootstrap-v2/templates/argocd-secret-github-ssh-client b/common/bootstrap-v2/templates/argocd-secret-github-ssh-client
@@ -0,0 +1,20 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: argocd-secret-github-ssh-client
+  namespace: argocd
+spec:
+  refreshInterval: 1m
+  secretStoreRef:
+    kind: SecretStore
+    name: argocd-secretstore
+  target:
+    name: github-ssh-client
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/instance: argocd
+          app.kubernetes.io/part-of: argocd
+  dataFrom:
+    - extract:
+        key: {{ .Values.clusterName }}-argocd-github-ssh-client
diff --git a/common/bootstrap-v2/templates/argocd-secretstore.yaml b/common/bootstrap-v2/templates/argocd-secretstore.yaml
@@ -0,0 +1,20 @@
+apiVersion: external-secrets.io/v1beta1
+kind: SecretStore
+metadata:
+  name: argocd-secretstore
+  namespace: argocd
+spec:
+  provider:
+    {{- if eq .Values.provider "AWS" }}
+    aws:
+      service: SecretsManager
+      region: {{ .Values.AWS.region }}
+    {{- else if eq .Values.provider "GCP" }}
+    gcpsm:
+      projectID: {{ .Values.GCP.projectID }}
+    {{- else }}
+    fake:
+      data:
+        - key: {{ .Values.clusterName }}-argocd-github-ssh-client
+          value: '{"dex.github.clientId":"DUMMY","dex.github.clientSecret":""}'
+    {{- end }}
diff --git a/common/bootstrap-v2/templates/argocd.yaml b/common/bootstrap-v2/templates/argocd.yaml
@@ -0,0 +1,58 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: argocd
+  namespace: argocd
+spec:
+  project: infra
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated:
+      prune: true
+      selfHeal: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  source:
+    repoURL: https://argoproj.github.io/argo-helm
+    chart: argo-cd
+    targetRevision: 7.7.16
+    helm:
+      values: |-
+        global:
+          domain: {{ .Values.argocd.domain }}
+        controller:
+          replicas: 1
+        redis-ha:
+          enabled: true
+        repoServer:
+          autoscaling:
+            enabled: true
+        server:
+          autoscaling:
+            enabled: true
+          ingress:
+            enabled: true
+            ingressClassName: traefik
+        configs:
+          params:
+            server.insecure: true
+          rbac:
+            scopes: "[email, groups]"
+            policy.default: role:readonly
+            policy.csv: |
+              g, planetarium:DevOps, role:admin
+          cm:
+            admin.enabled: true
+            statusbadge.enabled: true
+            dex.config: |-
+              connectors:
+                - type: github
+                  id: github
+                  name: GitHub
+                  config:
+                    orgs:
+                      - name: planetarium
+                    clientID: "$github-ssh-client:dex.github.clientId"
+                    clientSecret: "$github-ssh-client:dex.github.clientSecret"
diff --git a/common/bootstrap-v2/templates/cert-manager-certificate.yaml b/common/bootstrap-v2/templates/cert-manager-certificate.yaml
@@ -0,0 +1,14 @@
+{{- with .Values.certManager.dnsNames }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: certificate
+  namespace: traefik
+spec:
+  secretName: certificate-secret
+  dnsNames:
+    {{- toYaml . | nindent 4 }}
+  issuerRef:
+    name: cert-manager-letsencrypt-issuer
+    kind: ClusterIssuer
+{{- end }}
diff --git a/common/bootstrap-v2/templates/cert-manager-letsencrypt-issuer.yaml b/common/bootstrap-v2/templates/cert-manager-letsencrypt-issuer.yaml
@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: cert-manager-letsencrypt-issuer
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: "{{ .Values.certManager.issuer.email }}"
+    privateKeySecretRef:
+      name: cert-manager-letsencrypt-issuer-secret
+    solvers:
+      - dns01:
+          route53:
+            region: us-east-2
diff --git a/common/bootstrap-v2/templates/cert-manager.yaml b/common/bootstrap-v2/templates/cert-manager.yaml
@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager
+  namespace: argocd
+spec:
+  project: infra
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated:
+      prune: true
+      selfHeal: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cert-manager
+  source:
+    repoURL: https://charts.jetstack.io
+    chart: cert-manager
+    targetRevision: v1.16.3
+    helm:
+      values: |-
+        crds:
+          enabled: true
+        serviceAccount:
+          annotations:
+            {{- with .Values.certManager.serviceAccount.annotations }}
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
diff --git a/common/bootstrap-v2/templates/external-dns.yaml b/common/bootstrap-v2/templates/external-dns.yaml
@@ -0,0 +1,40 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-dns
+  namespace: argocd
+spec:
+  project: infra
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated:
+      prune: true
+      selfHeal: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-dns
+  source:
+    repoURL: https://kubernetes-sigs.github.io/external-dns/
+    chart: external-dns
+    targetRevision: 1.15.0
+    helm:
+      values: |-
+        policy: sync
+        txtOwnerId: "{{ .Values.clusterName }}"
+        sources:
+          - service
+          - ingress
+          - gateway-httproute
+          - gateway-grpcroute
+          - crd
+        managedRecordTypes:
+          - A
+          - AAAA
+          - CNAME
+          - TXT
+        serviceAccount:
+          annotations:
+            {{- with .Values.externalDns.serviceAccount.annotations }}
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
diff --git a/common/bootstrap-v2/templates/external-secrets.yaml b/common/bootstrap-v2/templates/external-secrets.yaml
@@ -0,0 +1,31 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-secrets
+  namespace: argocd
+spec:
+  project: infra
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated:
+      prune: true
+      selfHeal: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-secrets
+  source:
+    repoURL: https://charts.external-secrets.io
+    chart: external-secrets
+    targetRevision: 0.12.1
+    helm:
+      values: |-
+        certController:
+          create: false
+        webhook:
+          create: false
+        serviceAccount:
+          annotations:
+            {{- with .Values.externalSecrets.serviceAccount.annotations }}
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
diff --git a/common/bootstrap-v2/templates/traefik.yaml b/common/bootstrap-v2/templates/traefik.yaml
@@ -0,0 +1,31 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: traefik
+  namespace: argocd
+spec:
+  project: infra
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated:
+      prune: true
+      selfHeal: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: traefik
+  source:
+    repoURL: https://traefik.github.io/charts
+    chart: traefik
+    targetRevision: 34.1.0
+    helm:
+      values: |-
+        service:
+          annotations:
+            {{- with .Values.global.service.annotations }}
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
+        tlsStore:
+          default:
+            defaultCertificate:
+              secretName: certificate-secret
diff --git a/common/bootstrap-v2/values.yaml b/common/bootstrap-v2/values.yaml
@@ -0,0 +1,24 @@
+clusterName:
+provider:
+
+global:
+  service:
+    annotations:
+
+argocd:
+  domain:
+
+externalSecrets:
+  serviceAccount:
+    annotations:
+
+externalDns:
+  serviceAccount:
+    annotations:
+
+certManager:
+  serviceAccount:
+    annotations:
+  dnsNames:
+  issuer:
+    email: