add gke test cluster and bootstrap-v2

try multiplanetary values test
planetarium · Jan 22, 2025 · ae61dc8 · ae61dc8
1 parent f09292e
commit ae61dc8
Show file tree

Hide file tree

Showing 16 changed files with 486 additions and 7 deletions.
diff --git a/charts/multiplanetary/templates/network.yaml b/charts/multiplanetary/templates/network.yaml
@@ -1,4 +1,4 @@
-{{ range $.Values.network }}
+{{- range $.Values.network }}
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -7,16 +7,15 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://github.com/planetarium/9c-infra.git
-    targetRevision: main
+    repoURL: {{ $.Values.repoURL | default "https://github.com/planetarium/9c-infra.git" }}
+    targetRevision: {{ $.Values.targetRevision | default "main" }}
     path: charts/all-in-one
     helm:
       valueFiles:
-        - "../../{{ $.Values.path }}/network/general.yaml"
-        - "../../{{ $.Values.path }}/network/{{ . }}.yaml"
-
+      - /{{ $.Values.path }}/network/general.yaml
+      - /{{ $.Values.path }}/network/{{ . }}.yaml
   destination:
     server: https://kubernetes.default.svc
     namespace: {{ . }}
 ---
-{{ end }}
+{{- end }}
diff --git a/common/bootstrap-v2/Chart.yaml b/common/bootstrap-v2/Chart.yaml
@@ -0,0 +1,6 @@
+apiVersion: v2
+type: application
+name: bootstrap-v2
+description: A Helm chart bootstrapping the cluster
+version: 0.2.0
+appVersion: 1.0.0
diff --git a/common/bootstrap-v2/templates/amazon-eks-pod-identity-webhook.yaml b/common/bootstrap-v2/templates/amazon-eks-pod-identity-webhook.yaml
@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: amazon-eks-pod-identity-webhook
+  namespace: argocd
+spec:
+  project: infra
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated:
+      prune: true
+      selfHeal: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: kube-system
+  sources:
+    - repoURL: https://github.com/aws/eks-distro-build-tooling
+      path: helm-charts/stable/amazon-eks-pod-identity-webhook
+      targetRevision: 73e233eaf3b6f44847ee293d4386963c4d4cb915
diff --git a/common/bootstrap-v2/templates/argocd-appproject-infra.yaml b/common/bootstrap-v2/templates/argocd-appproject-infra.yaml
@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: infra
+spec:
+  description: In-cluster applications managed by DevOps team
+  destinations:
+    - namespace: '*'
+      server: https://kubernetes.default.svc
+  sourceRepos:
+    - '*'
+  clusterResourceWhitelist:
+    - group: '*'
+      kind: '*'
+  namespaceResourceWhitelist:
+    - group: '*'
+      kind: '*'
diff --git a/common/bootstrap-v2/templates/argocd-secretstore.yaml b/common/bootstrap-v2/templates/argocd-secretstore.yaml
@@ -0,0 +1,20 @@
+apiVersion: external-secrets.io/v1beta1
+kind: SecretStore
+metadata:
+  name: argocd-secretstore
+  namespace: argocd
+spec:
+  provider:
+    {{- if eq .Values.provider "AWS" }}
+    aws:
+      service: SecretsManager
+      region: {{ .Values.AWS.region }}
+    {{- else if eq .Values.provider "GCP" }}
+    gcpsm:
+      projectID: {{ .Values.GCP.projectID }}
+    {{- else }}
+    fake:
+      data:
+        - key: {{ .Values.clusterName }}-argocd-github-ssh-client
+          value: '{"dex.github.clientId":"DUMMY","dex.github.clientSecret":""}'
+    {{- end }}
diff --git a/common/bootstrap-v2/templates/argocd.yaml b/common/bootstrap-v2/templates/argocd.yaml
@@ -0,0 +1,78 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: argocd
+  namespace: argocd
+spec:
+  project: infra
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated:
+      prune: true
+      selfHeal: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  source:
+    repoURL: https://argoproj.github.io/argo-helm
+    chart: argo-cd
+    targetRevision: 7.7.16
+    helm:
+      values: |-
+        global:
+          domain: {{ .Values.argocd.domain }}
+        controller:
+          replicas: 1
+        redis-ha:
+          enabled: true
+        repoServer:
+          autoscaling:
+            enabled: true
+        server:
+          autoscaling:
+            enabled: true
+          ingress:
+            enabled: true
+            ingressClassName: traefik
+        configs:
+          params:
+            server.insecure: true
+          rbac:
+            scopes: "[email, groups]"
+            policy.default: role:readonly
+            policy.csv: |
+              g, planetarium:DevOps, role:admin
+          cm:
+            admin.enabled: true
+            statusbadge.enabled: true
+            dex.config: |-
+              connectors:
+                - type: github
+                  id: github
+                  name: GitHub
+                  config:
+                    orgs:
+                      - name: planetarium
+                    clientID: "$github-ssh-client:dex.github.clientId"
+                    clientSecret: "$github-ssh-client:dex.github.clientSecret"
+        extraObjects:
+          - apiVersion: external-secrets.io/v1beta1
+            kind: ExternalSecret
+            metadata:
+              name: github-ssh-client
+            spec:
+              refreshInterval: 1m
+              secretStoreRef:
+                kind: SecretStore
+                name: argocd-secretstore
+              target:
+                name: github-ssh-client
+                template:
+                  metadata:
+                    labels:
+                      app.kubernetes.io/instance: argocd
+                      app.kubernetes.io/part-of: argocd
+              dataFrom:
+                - extract:
+                    key: {{ .Values.clusterName }}-argocd-github-ssh-client
diff --git a/common/bootstrap-v2/templates/cert-manager.yaml b/common/bootstrap-v2/templates/cert-manager.yaml
@@ -0,0 +1,27 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager
+  namespace: argocd
+spec:
+  project: infra
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated:
+      prune: true
+      selfHeal: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cert-manager
+  sources:
+    - repoURL: https://charts.jetstack.io
+      chart: cert-manager
+      targetRevision: v1.16.3
+      helm:
+        values: |-
+          crds:
+            enabled: true
+    - repoURL: https://github.com/ThatsMrTalbot/acme-webhook-external-dns
+      path: deploy/charts/acme-webhook-external-dns
+      targetRevision: eca2f8291e2864cbcf4eaaddf72bcec8f6aa102d
diff --git a/common/bootstrap-v2/templates/certificate.yaml b/common/bootstrap-v2/templates/certificate.yaml
@@ -0,0 +1,30 @@
+apiVersion: cert-manager.io/v1alpha2
+kind: Certificate
+metadata:
+  name: certificate
+spec:
+  secretName: certificate-secret
+  dnsNames:
+    {{- with .Values.certificates.dnsNames }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  issuerRef:
+    name: cert-manager-letsencrypt-issuer
+    kind: Issuer
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: cert-manager-letsencrypt-issuer
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    # server: https://acme-v02.api.letsencrypt.org/directory
+    email: {{ .Values.certificates.issuer.email }}
+    privateKeySecretRef:
+      name: cert-manager-letsencrypt-issuer-secret
+    solvers:
+      - dns01:
+          webhook:
+            groupName: external-dns.acme.cert-manager.io
+            solverName: external-dns
diff --git a/common/bootstrap-v2/templates/external-dns.yaml b/common/bootstrap-v2/templates/external-dns.yaml
@@ -0,0 +1,40 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-dns
+  namespace: argocd
+spec:
+  project: infra
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated:
+      prune: true
+      selfHeal: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-dns
+  source:
+    repoURL: https://charts.bitnami.com/bitnami
+    chart: external-dns
+    targetRevision: 8.3.9
+    helm:
+      values: |-
+        policy: sync
+        txtOwnerId: "{{ .Values.clusterName }}"
+        sources:
+          - service
+          - ingress
+          - gateway-httproute
+          - gateway-grpcroute
+          - crd
+        managedRecordTypes:
+          - A
+          - AAAA
+          - CNAME
+          - TXT
+        serviceAccount:
+          annotations:
+            {{- with .Values.externalDns.serviceAccount.annotations }}
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
diff --git a/common/bootstrap-v2/templates/external-secrets.yaml b/common/bootstrap-v2/templates/external-secrets.yaml
@@ -0,0 +1,31 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-secrets
+  namespace: argocd
+spec:
+  project: infra
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated:
+      prune: true
+      selfHeal: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-secrets
+  source:
+    repoURL: https://charts.external-secrets.io
+    chart: external-secrets
+    targetRevision: 0.12.1
+    helm:
+      values: |-
+        certController:
+          create: false
+        webhook:
+          create: false
+        serviceAccount:
+          annotations:
+            {{- with .Values.externalSecrets.serviceAccount.annotations }}
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
diff --git a/common/bootstrap-v2/templates/traefik.yaml b/common/bootstrap-v2/templates/traefik.yaml
@@ -0,0 +1,27 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: traefik
+  namespace: argocd
+spec:
+  project: infra
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated:
+      prune: true
+      selfHeal: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: traefik
+  source:
+    repoURL: https://traefik.github.io/charts
+    chart: traefik
+    targetRevision: 34.1.0
+    helm:
+      values: |-
+        service:
+          annotations:
+            {{- with .Values.global.service.annotations }}
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
diff --git a/common/bootstrap-v2/values.yaml b/common/bootstrap-v2/values.yaml
@@ -0,0 +1,21 @@
+clusterName:
+provider:
+
+global:
+  service:
+    annotations:
+
+argocd:
+  domain:
+
+externalSecrets:
+  serviceAccount:
+    annotations:
+
+externalDns:
+  serviceAccount:
+    annotations:
+
+certificates:
+  dnsNames:
+  issuer:
diff --git a/gke-ninechronicles-internal/bootstrap.yaml b/gke-ninechronicles-internal/bootstrap.yaml
@@ -0,0 +1,27 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: bootstrap
+  namespace: argocd
+spec:
+  project: infra
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  sources:
+    - repoURL: https://github.com/planetarium/9c-infra
+      path: common/bootstrap-v2
+      targetRevision: gke
+      helm:
+        valueFiles:
+          - /gke-ninechronicles-internal/values.yaml
+    - repoURL: https://github.com/planetarium/9c-infra.git
+      path: charts/multiplanetary
+      targetRevision: gke
+      helm:
+        values: |-
+          clusterName: ninechronicles-internal-test-1
+          targetRevision: gke
+          path: gke-ninechronicles-internal
+          network:
+          - odin
diff --git a/gke-ninechronicles-internal/network/general.yaml b/gke-ninechronicles-internal/network/general.yaml
@@ -0,0 +1,15 @@
+clusterName: ninechronicles-internal-test-1
+
+global:
+  image:
+    repository: planetariumhq/ninechronicles-headless
+    tag: "git-5681ee3a468d8c550d70e0ebed6eb530a5caf82a"
+
+  service:
+    annotations:
+
+seed:
+  image:
+    repository: planetariumhq/libplanet-seed
+    pullPolicy: Always
+    tag: "git-67d0ef91c52a71a9772cd7fdb241c9fc37b165b8"