gstykalin/kube-forge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

migrate from kubespray to library helm client

Browse Source
This commit is contained in:
George Stykalin
2024-06-20 00:20:50 +03:00
parent 3109816dee
commit 78cf06e314
46 changed files with 6283 additions and 12035 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
cmd/main/main.go
View File

@@ -2,13 +2,28 @@ package main
import (
"flag"
"fmt"
"kube-forge/internal/additional"
"kube-forge/internal/cicd"
"kube-forge/internal/config"
"kube-forge/internal/csi"
"kube-forge/internal/kubespray"
"kube-forge/internal/logging"
"kube-forge/internal/observability"
"kube-forge/internal/registry"
"kube-forge/internal/secrets_storage"
"kube-forge/internal/templates"
"os"
)
func installAndConfigureModules() {
csi.ApplyCharts()
additional.ApplyCharts()
registry.ApplyCharts()
secrets_storage.ApplyCharts()
cicd.ApplyCharts()
observability.ApplyCharts()
}
func main() {
var password, configPath, workDir string
var verbose bool
@@ -20,9 +35,6 @@ func main() {
flag.Parse()
config := config.CreateConfig(configPath, workDir, password)
config.Verbose = verbose
repositories, releases := templates.GetHelmAppsConfigData()
config.Repositories = repositories
config.Releases = releases
templates.ApplyK8sTemplates()
@@ -30,9 +42,10 @@ func main() {
switch cmd {
case "apply":
kubespray.InstallCluster("")
installAndConfigureModules()
return
case "apply-modules":
kubespray.InstallCluster("helm-apps")
installAndConfigureModules()
return
case "upgrade":
kubespray.UpgradeCluster("")
@@ -42,5 +55,5 @@ func main() {
return
}
}
fmt.Println("No such command\nAvailable commands: apply, apply-modules, upgrade, scale")
logging.Log.Error("No such command\nAvailable commands: apply, apply-modules, upgrade, scale")
}

4
go.mod
View File

@@ -11,7 +11,9 @@ require (
github.com/apenella/go-ansible/v2 v2.0.0
github.com/ilyakaznacheev/cleanenv v1.5.0
github.com/mittwald/go-helm-client v0.12.9
github.com/sirupsen/logrus v1.9.3
golang.org/x/crypto v0.22.0
helm.sh/helm/v3 v3.14.2
k8s.io/api v0.30.0
k8s.io/apimachinery v0.30.0
k8s.io/client-go v0.30.0
@@ -113,7 +115,6 @@ require (
github.com/rubenv/sql-migrate v1.6.0 // indirect
github.com/russross/blackfriday/v2 v2.1.0 // indirect
github.com/shopspring/decimal v1.3.1 // indirect
github.com/sirupsen/logrus v1.9.3 // indirect
github.com/spf13/cast v1.6.0 // indirect
github.com/spf13/cobra v1.8.0 // indirect
github.com/spf13/pflag v1.0.5 // indirect
@@ -144,7 +145,6 @@ require (
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
helm.sh/helm/v3 v3.14.2 // indirect
k8s.io/apiextensions-apiserver v0.29.0 // indirect
k8s.io/apiserver v0.29.0 // indirect
k8s.io/cli-runtime v0.29.0 // indirect

79
internal/additional/helm.go Normal file
View File

@@ -0,0 +1,79 @@
package additional
import (
"kube-forge/internal/config"
"kube-forge/internal/helm_client"
"kube-forge/internal/templates"
"time"
go_helm_client "github.com/mittwald/go-helm-client"
)
var HELM_REPOS = []config.RepoSettings{
{
Name: "kube-forge",
URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
},
}
func getCertManagerSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "cert-manager",
ChartName: appConfig.Modules.Additional.CertManager.ChartRef,
Version: appConfig.Modules.Additional.CertManager.ChartVersion,
Namespace: appConfig.Modules.Additional.CertManager.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl"),
}
}
func getIngressNginxSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "ingress-nginx",
ChartName: appConfig.Modules.Additional.Ingress.ChartRef,
Version: appConfig.Modules.Additional.Ingress.ChartVersion,
Namespace: appConfig.Modules.Additional.Ingress.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/ingress-nginx.yml.tmpl"),
}
}
func getDockerSecretsGeneratorSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "docker-secrets-generator",
ChartName: appConfig.Modules.Additional.DockerSecrets.ChartRef,
Version: appConfig.Modules.Additional.DockerSecrets.ChartVersion,
Namespace: appConfig.Modules.Additional.DockerSecrets.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/docker-secrets-generator.yml.tmpl"),
}
}
func ApplyCharts() {
appConfig := config.GetConfig()
helm_client.AddHelmRepos("kube-system", HELM_REPOS)
if appConfig.Modules.Additional.CertManager.Enabled {
helm_client.InstallChart(getCertManagerSpec())
} else {
helm_client.DeleteChart(getCertManagerSpec())
}
if appConfig.Modules.Additional.Ingress.Enabled && appConfig.Modules.Additional.Ingress.Type == "nginx" {
helm_client.InstallChart(getIngressNginxSpec())
} else {
helm_client.DeleteChart(getIngressNginxSpec())
}
if appConfig.Modules.Additional.DockerSecrets.Repositories != nil {
helm_client.InstallChart(getDockerSecretsGeneratorSpec())
} else {
helm_client.DeleteChart(getDockerSecretsGeneratorSpec())
}
}

108
internal/cicd/helm.go Normal file
View File

@@ -0,0 +1,108 @@
package cicd
import (
"kube-forge/internal/config"
"kube-forge/internal/helm_client"
"kube-forge/internal/templates"
"time"
go_helm_client "github.com/mittwald/go-helm-client"
)
var HELM_REPOS = [...]config.RepoSettings{
{
Name: "kube-forge",
URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
},
}
func getArgoCdSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "argo-cd",
ChartName: appConfig.Modules.Cicd.ArgoCd.ChartRef,
Version: appConfig.Modules.Cicd.ArgoCd.ChartVersion,
Namespace: appConfig.Modules.Cicd.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/argo-cd.yml.tmpl"),
}
}
func getArgoRolloutsSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "argo-rollouts",
ChartName: appConfig.Modules.Cicd.Rollouts.ChartRef,
Version: appConfig.Modules.Cicd.Rollouts.ChartVersion,
Namespace: appConfig.Modules.Cicd.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl"),
}
}
func getKeelSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "keel",
ChartName: appConfig.Modules.Cicd.UpdatesOperator.ChartRef,
Version: appConfig.Modules.Cicd.UpdatesOperator.ChartVersion,
Namespace: appConfig.Modules.Cicd.UpdatesOperator.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/keel.yml.tmpl"),
}
}
func getArgoCdIngressSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "argo-cd-ingress",
ChartName: appConfig.Modules.Cicd.ArgoCd.ServiceIngress.ChartRef,
Version: appConfig.Modules.Cicd.ArgoCd.ServiceIngress.ChartVersion,
Namespace: appConfig.Modules.Cicd.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl"),
}
}
func addCicdHelmRepos() {
appConfig := config.GetConfig()
for _, repoSettings := range HELM_REPOS {
helm_client.AddHelmRepo(appConfig.Modules.SecretsStorage.Namespace, repoSettings)
}
}
func ApplyCharts() {
addCicdHelmRepos()
appConfig := config.GetConfig()
if appConfig.Modules.Cicd.Enabled {
helm_client.InstallChart(getArgoCdSpec())
if appConfig.Modules.Cicd.ArgoCd.Expose.Type == "ingress" {
helm_client.InstallChart(getArgoCdIngressSpec())
} else {
helm_client.DeleteChart(getArgoCdIngressSpec())
}
if appConfig.Modules.Cicd.Rollouts.Enabled {
helm_client.InstallChart(getArgoRolloutsSpec())
} else {
helm_client.DeleteChart(getArgoRolloutsSpec())
}
if appConfig.Modules.Cicd.UpdatesOperator.Enabled {
helm_client.InstallChart(getKeelSpec())
} else {
helm_client.DeleteChart(getKeelSpec())
}
} else {
helm_client.DeleteChart(getArgoCdIngressSpec())
helm_client.DeleteChart(getArgoCdSpec())
helm_client.DeleteChart(getArgoRolloutsSpec())
helm_client.DeleteChart(getKeelSpec())
}
}

3
internal/config/config.go
View File

@@ -38,9 +38,6 @@ type Config struct {
Cicd Cicd `yaml:"cicd"`
SecretsStorage SecretsStorage `yaml:"secrets_storage"`
} `yaml:"modules"`
Repositories string
Releases string
}
var instance *Config

26
internal/config/helm.go
View File

@@ -5,13 +5,30 @@ import (
"log"
"os"
"path/filepath"
"time"
helm_client "github.com/mittwald/go-helm-client"
)
var client *helm_client.Client
type RepoSettings struct {
Name string
URL string
Username string
Password string
}
func CreateHelmClient() helm_client.Client {
type ChartSettings struct {
ReleaseName string
ChartRef string
ChartVersion string
Namespace string
CreateNamespace bool
Atomic bool
Timeout time.Duration
ValuesYaml string
}
func GetHelmClient(namespace string) helm_client.Client {
config := GetConfig()
file, err := os.Open(filepath.Join(config.WorkDir, config.KubeconfigFile))
if err != nil {
@@ -24,7 +41,7 @@ func CreateHelmClient() helm_client.Client {
}
opts := &helm_client.KubeConfClientOptions{
Options: &helm_client.Options{
Namespace: "default", // Change this to the namespace you wish to install the chart in.
Namespace: namespace,
RepositoryCache: "/tmp/.helmcache",
RepositoryConfig: "/tmp/.helmrepo",
Debug: true,
@@ -40,9 +57,6 @@ func CreateHelmClient() helm_client.Client {
if err != nil {
log.Fatalf("error while creating helm client: %s", err)
}
return client
}
func GetHelmClient() *helm_client.Client {
return client
}

5
internal/config/modules_additional.go
View File

@@ -5,6 +5,7 @@ type Additional struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/cert-manager"`
ChartVersion string `yaml:"chart_version" env-default:"v1.14.5"`
Enabled bool `yaml:"enabled"`
Namespace string `yaml:"namespace" env-default:"cert-manager"`
HaEnabled bool `yaml:"ha_enabled"`
DnsServers []string `yaml:"dns_servers" env-default:"8.8.8.8,1.1.1.1"`
AccountEmail string `yaml:"account_email"`
@@ -19,6 +20,7 @@ type Additional struct {
ChartVersion string `yaml:"chart_version" env-default:"4.10.1"`
Type string `yaml:"type" env-default:"nginx"`
Enabled bool `yaml:"enabled"`
Namespace string `yaml:"namespace" env-default:"ingress-nginx"`
IngressClassName string `yaml:"ingress_class_name" env-default:"nginx"`
HostNetwork bool `yaml:"host_network"`
EnableAdmissionWebhooks bool `yaml:"enable_admission_webhooks"`
@@ -42,6 +44,7 @@ type Additional struct {
DockerSecrets struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/docker-secrets-generator"`
ChartVersion string `yaml:"chart_version" env-default:"0.1.0"`
Namespace string `yaml:"namespace" env-default:"kube-system"`
Repositories interface{} `yaml:"repositories"`
} `yaml:"docker_secrets"`
@@ -54,11 +57,13 @@ type Additional struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/longhorn"`
ChartVersion string `yaml:"chart_version" env-default:"1.6.1"`
Enabled bool `yaml:"enabled"`
Namespace string `yaml:"namespace" env-default:"longhorn-system"`
} `yaml:"longhorn"`
SecretsStoreCsiDriver struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/secrets-store-csi-driver"`
ChartVersion string `yaml:"chart_version" env-default:"1.4.3"`
Enabled bool `yaml:"enabled"`
Namespace string `yaml:"namespace" env-default:"kube-system"`
} `yaml:"secrets_store_csi_driver"`
} `yaml:"storage"`
}

2
internal/config/modules_cicd.go
View File

@@ -2,6 +2,7 @@ package config
type Cicd struct {
Enabled bool `yaml:"enabled"`
Namespace string `yaml:"namespace" env-default:"cicd"`
ArgoCd struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/argo-cd"`
ChartVersion string `yaml:"chart_version" env-default:"6.7.10"`
@@ -69,6 +70,7 @@ type Cicd struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/keel"`
ChartVersion string `yaml:"chart_version" env-default:"1.0.3"`
Enabled bool `yaml:"enabled"`
Namespace string `yaml:"namespace" env-default:"kube-system"`
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/keelhq/keel"`
Tag string `yaml:"tag" env-default:"latest"`
} `yaml:"updates_operator"`

6
internal/config/modules_observability.go
View File

@@ -8,6 +8,7 @@ type Observability struct {
Tracing Tracing `yaml:"tracing"`
Monitoring Monitoring `yaml:"monitoring"`
Visualization Visualization `yaml:"visualization"`
Namespace string `yaml:"namespace" env-default:"observability"`
}
type Logging struct {
@@ -17,6 +18,7 @@ type Logging struct {
ChartVersion string `yaml:"chart_version" env-default:"2.7.0"`
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/kubesphere/fluent-operator"`
Tag string `yaml:"tag" env-default:"v2.7.0"`
Namespace string `yaml:"namespace" env-default:"observability"`
InitContainer struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/docker"`
Tag string `yaml:"tag" env-default:"20.10"`
@@ -36,6 +38,7 @@ type Logging struct {
Registry string `yaml:"registry" env-default:"harbor.kvazaric.ru"`
Image string `yaml:"image" env-default:"kube-forge/grafana/loki"`
Tag string `yaml:"tag" env-default:"latest"`
Namespace string `yaml:"namespace" env-default:"observability"`
Persistence struct {
StorageClass string `yaml:"storage_class" env-default:"local-path"`
StorageSize string `yaml:"storage_size" env-default:"10Gi"`
@@ -65,6 +68,7 @@ type Tracing struct {
ChartVersion string `yaml:"chart_version" env-default:"0.55.0"`
Image string `yaml:"image" env-default:"ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator"`
Tag string `yaml:"tag" env-default:""`
Namespace string `yaml:"namespace" env-default:"observability"`
} `yaml:"operator"`
Collector struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/otel/opentelemetry-collector-contrib"`
@@ -75,6 +79,7 @@ type Tracing struct {
ChartVersion string `yaml:"chart_version" env-default:"1.7.2"`
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/grafana/tempo"`
Tag string `yaml:"tag" env-default:"2.3.1"`
Namespace string `yaml:"namespace" env-default:"observability"`
Retention string `yaml:"retention" env-default:"24h"`
ListenPort int `yaml:"listen_port" env-default:"3100"`
Persistence struct {
@@ -142,6 +147,7 @@ type Monitoring struct {
ChartVersion string `yaml:"chart_version" env-default:"3.12.1"`
Image string `yaml:"image" env-default:"registry.k8s.io/metrics-server/metrics-server"`
Tag string `yaml:"tag" env-default:""`
Namespace string `yaml:"namespace" env-default:"kube-system"`
}
}

1
internal/config/modules_secrets_storage.go
View File

@@ -3,6 +3,7 @@ package config
type SecretsStorage struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/vault"`
ChartVersion string `yaml:"chart_version" env-default:"0.1.0"`
Namespace string `yaml:"namespace" env-default:"secrets-storage"`
Enabled bool `yaml:"enabled"`
KeyShares int `yaml:"key_shares" env-default:"5"`
KeyThreshold int `yaml:"key_threshold" env-default:"3"`

60
internal/csi/helm.go Normal file
View File

@@ -0,0 +1,60 @@
package csi
import (
"kube-forge/internal/config"
"kube-forge/internal/helm_client"
"kube-forge/internal/templates"
"time"
go_helm_client "github.com/mittwald/go-helm-client"
)
var HELM_REPOS = []config.RepoSettings{
{
Name: "kube-forge",
URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
},
}
func getLonghornSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "longhorn",
ChartName: appConfig.Modules.Additional.Storage.Longhorn.ChartRef,
Version: appConfig.Modules.Additional.Storage.Longhorn.ChartVersion,
Namespace: appConfig.Modules.Additional.Storage.Longhorn.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/longhorn.yml.tmpl"),
}
}
func getSecretsStoreSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "csi-secrets-store",
ChartName: appConfig.Modules.Additional.Storage.SecretsStoreCsiDriver.ChartRef,
Version: appConfig.Modules.Additional.Storage.SecretsStoreCsiDriver.ChartVersion,
Namespace: appConfig.Modules.Additional.Storage.SecretsStoreCsiDriver.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 60,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl"),
}
}
func ApplyCharts() {
appConfig := config.GetConfig()
helm_client.AddHelmRepos("kube-system", HELM_REPOS)
if appConfig.Modules.Additional.Storage.Longhorn.Enabled {
helm_client.InstallChart(getLonghornSpec())
} else {
helm_client.DeleteChart(getLonghornSpec())
}
if appConfig.Modules.Additional.Storage.SecretsStoreCsiDriver.Enabled {
helm_client.InstallChart(getSecretsStoreSpec())
} else {
helm_client.DeleteChart(getSecretsStoreSpec())
}
}

32
internal/helm_client/chart.go Normal file
View File

@@ -0,0 +1,32 @@
package helm_client
import (
"context"
"kube-forge/internal/config"
"kube-forge/internal/logging"
go_helm_client "github.com/mittwald/go-helm-client"
)
func InstallChart(chartSpec go_helm_client.ChartSpec) {
helmClient := config.GetHelmClient(chartSpec.Namespace)
_, error := helmClient.GetRelease(chartSpec.ReleaseName)
if error != nil {
logging.Log.Infof("Installing %s", chartSpec.ChartName)
} else {
logging.Log.Infof("Upgrading %s", chartSpec.ChartName)
}
if _, err := helmClient.InstallOrUpgradeChart(context.Background(), &chartSpec, nil); err != nil {
panic(err)
}
}
func DeleteChart(chartSpec go_helm_client.ChartSpec) {
helmClient := config.GetHelmClient(chartSpec.Namespace)
_, error := helmClient.GetRelease(chartSpec.ReleaseName)
if error != nil {
return
}
logging.Log.Warnf("Uninstalling %s", chartSpec.ChartName)
helmClient.UninstallRelease(&chartSpec)
}

27
internal/helm_client/repo.go Normal file
View File

@@ -0,0 +1,27 @@
package helm_client
import (
"kube-forge/internal/config"
"helm.sh/helm/v3/pkg/repo"
)
func AddHelmRepo(namespace string, repoSettings config.RepoSettings) {
helmClient := config.GetHelmClient(namespace)
chartRepo := repo.Entry{
Name: repoSettings.Name,
URL: repoSettings.URL,
Username: repoSettings.Username,
Password: repoSettings.Password,
}
if err := helmClient.AddOrUpdateChartRepo(chartRepo); err != nil {
panic(err)
}
}
func AddHelmRepos(namespace string, helmRepos []config.RepoSettings) {
for _, repoSettings := range helmRepos {
AddHelmRepo(namespace, repoSettings)
}
}

11
internal/kubespray/cluster.go
View File

@@ -1,22 +1,13 @@
package kubespray
import (
"fmt"
"kube-forge/internal/config"
"kube-forge/internal/secrets_storage"
)
func InstallCluster(tags string) {
appConfig := config.GetConfig()
runPlaybook("kubespray/project/cluster.yml", tags)
CopyK8SAdminConfig(appConfig.KubeconfigFile)
config.CreateHelmClient()
if appConfig.Modules.SecretsStorage.Enabled {
fmt.Println("## Additional Vault Configuration")
secrets_storage.InitVault()
secrets_storage.UnsealVault()
secrets_storage.AddKubernetesLocalIntegration()
}
}
func UpgradeCluster(tags string) {
@@ -26,7 +17,7 @@ func UpgradeCluster(tags string) {
}
func ScaleCluster() {
runPlaybook("kubespray/project/scale.yml", "")
appConfig := config.GetConfig()
runPlaybook("kubespray/project/scale.yml", "")
CopyK8SAdminConfig(appConfig.KubeconfigFile)
}

12
internal/logging/log.go Normal file
View File

@@ -0,0 +1,12 @@
package logging
import (
"github.com/sirupsen/logrus"
)
var Log = logrus.New()
func init() {
Log.SetLevel(logrus.InfoLevel)
Log.SetFormatter(&logrus.TextFormatter{})
}

122
internal/observability/helm.go Normal file
View File

@@ -0,0 +1,122 @@
package observability
import (
"kube-forge/internal/config"
"kube-forge/internal/helm_client"
"kube-forge/internal/templates"
"time"
go_helm_client "github.com/mittwald/go-helm-client"
)
var HELM_REPOS = []config.RepoSettings{
{
Name: "kube-forge",
URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
},
}
func getFluentOperatorSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "fluent-operator",
ChartName: appConfig.Modules.Observability.Logging.Operator.ChartRef,
Version: appConfig.Modules.Observability.Logging.Operator.ChartVersion,
Namespace: appConfig.Modules.Observability.Logging.Operator.Namespace,
CreateNamespace: true,
Atomic: true,
UpgradeCRDs: true,
Timeout: time.Second * 60,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/fluent-operator.yml.tmpl"),
}
}
func getOpenTelemetryOperatorSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "opentelemetry-operator",
ChartName: appConfig.Modules.Observability.Tracing.Operator.ChartRef,
Version: appConfig.Modules.Observability.Tracing.Operator.ChartVersion,
Namespace: appConfig.Modules.Observability.Tracing.Operator.Namespace,
CreateNamespace: true,
Atomic: true,
UpgradeCRDs: true,
Timeout: time.Second * 60,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl"),
}
}
func getMetricsServerSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "metrics-server",
ChartName: appConfig.Modules.Observability.Monitoring.MetricsServer.ChartRef,
Version: appConfig.Modules.Observability.Monitoring.MetricsServer.ChartVersion,
Namespace: appConfig.Modules.Observability.Monitoring.MetricsServer.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 60,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/metrics-server.yml.tmpl"),
}
}
func getTempoSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "tempo",
ChartName: appConfig.Modules.Observability.Tracing.Tempo.ChartRef,
Version: appConfig.Modules.Observability.Tracing.Tempo.ChartVersion,
Namespace: appConfig.Modules.Observability.Tracing.Tempo.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 60,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/tempo.yml.tmpl"),
}
}
func getLokiSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "loki",
ChartName: appConfig.Modules.Observability.Logging.Loki.ChartRef,
Version: appConfig.Modules.Observability.Logging.Loki.ChartVersion,
Namespace: appConfig.Modules.Observability.Logging.Loki.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 60,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/loki.yml.tmpl"),
}
}
func getObservabilitySpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "observability",
ChartName: appConfig.Modules.Observability.ChartRef,
Version: appConfig.Modules.Observability.ChartVersion,
Namespace: appConfig.Modules.Observability.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/observability.yml.tmpl"),
}
}
func ApplyCharts() {
appConfig := config.GetConfig()
helm_client.AddHelmRepos(appConfig.Modules.Registry.Namespace, HELM_REPOS)
if appConfig.Modules.Observability.Enabled {
if appConfig.Modules.Observability.Logging.Enabled {
helm_client.InstallChart(getFluentOperatorSpec())
helm_client.InstallChart(getLokiSpec())
}
if appConfig.Modules.Observability.Tracing.Enabled {
helm_client.InstallChart(getOpenTelemetryOperatorSpec())
helm_client.InstallChart(getTempoSpec())
}
if appConfig.Modules.Observability.Monitoring.Enabled {
helm_client.InstallChart(getMetricsServerSpec())
}
helm_client.InstallChart(getObservabilitySpec())
}
}

5
internal/registry/charts.go
View File

@@ -1,5 +0,0 @@
package registry
func InstallRegistryCharts() {
}

9
internal/registry/commands.go
View File

@@ -1,9 +0,0 @@
package registry
func CreateDockerRepositories() {
}
func CreateHelmRepositories() {
}

0
internal/registry/errors.go
View File

61
internal/registry/helm.go Normal file
View File

@@ -0,0 +1,61 @@
package registry
import (
"kube-forge/internal/config"
"kube-forge/internal/helm_client"
"kube-forge/internal/templates"
"time"
go_helm_client "github.com/mittwald/go-helm-client"
)
var HELM_REPOS = []config.RepoSettings{
{
Name: "kube-forge",
URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
},
}
func getHarborCertificateGeneratorSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "harbor-certificate-generator",
ChartName: appConfig.Modules.Registry.Tls.CertificateGenerator.ChartRef,
Version: appConfig.Modules.Registry.Tls.CertificateGenerator.ChartVersion,
Namespace: appConfig.Modules.Registry.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 60,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl"),
}
}
func getHarborSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "harbor",
ChartName: appConfig.Modules.Registry.ChartRef,
Version: appConfig.Modules.Registry.ChartVersion,
Namespace: appConfig.Modules.Registry.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/registry/harbor.yml.tmpl"),
}
}
func ApplyCharts() {
appConfig := config.GetConfig()
helm_client.AddHelmRepos(appConfig.Modules.Registry.Namespace, HELM_REPOS)
if appConfig.Modules.Registry.Enabled {
if appConfig.Modules.Registry.Expose.Type == "ingress" {
helm_client.InstallChart(getHarborCertificateGeneratorSpec())
} else {
helm_client.DeleteChart(getHarborCertificateGeneratorSpec())
}
helm_client.InstallChart(getHarborSpec())
} else {
helm_client.DeleteChart(getHarborSpec())
helm_client.DeleteChart(getHarborCertificateGeneratorSpec())
}
}

473
internal/resources/templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl
View File

@@ -1,15 +1,4 @@
- name: cert-manager
namespace: cert-manager
create_namespace: true
chart_ref: {{ .Modules.Additional.CertManager.ChartRef }}
chart_version: {{ .Modules.Additional.CertManager.ChartVersion }}
{{- if .Modules.Additional.CertManager.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
global:
global:
imagePullSecrets: []
commonLabels: {}
@@ -50,28 +39,28 @@
# renewal of a leadership.
# retryPeriod: 15s
installCRDs: true
installCRDs: true
# Number of replicas of the cert-manager controller to run.
#
# The default is 1, but in production you should set this to 2 or 3 to provide high
# availability.
#
# If `replicas > 1` you should also consider setting `podDisruptionBudget.enabled=true`.
#
# Note: cert-manager uses leader election to ensure that there can
# only be a single instance active at a time.
{{- if .Modules.Additional.CertManager.HaEnabled }}
replicaCount: 3
{{- else }}
replicaCount: 1
{{- end }}
# Number of replicas of the cert-manager controller to run.
#
# The default is 1, but in production you should set this to 2 or 3 to provide high
# availability.
#
# If `replicas > 1` you should also consider setting `podDisruptionBudget.enabled=true`.
#
# Note: cert-manager uses leader election to ensure that there can
# only be a single instance active at a time.
{{- if .Modules.Additional.CertManager.HaEnabled }}
replicaCount: 3
{{- else }}
replicaCount: 1
{{- end }}
# Deployment update strategy for the cert-manager controller deployment.
# See https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
strategy: {}
# Deployment update strategy for the cert-manager controller deployment.
# See https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
strategy: {}
podDisruptionBudget:
podDisruptionBudget:
# Enable or disable the PodDisruptionBudget resource
#
# This prevents downtime during voluntary disruptions such as during a Node upgrade.
@@ -92,14 +81,14 @@
# +docs:property
# maxUnavailable: 1
# Comma separated list of feature gates that should be enabled on the
# controller pod.
featureGates: ""
# Comma separated list of feature gates that should be enabled on the
# controller pod.
featureGates: ""
# The maximum number of challenges that can be scheduled as 'processing' at once
maxConcurrentChallenges: 60
# The maximum number of challenges that can be scheduled as 'processing' at once
maxConcurrentChallenges: 60
image:
image:
# The container registry to pull the manager image from
# +docs:property
# registry: quay.io
@@ -120,17 +109,17 @@
# Kubernetes imagePullPolicy on Deployment.
pullPolicy: IfNotPresent
# Override the namespace used to store DNS provider credentials etc. for ClusterIssuer
# resources. By default, the same namespace as cert-manager is deployed within is
# used. This namespace will not be automatically created by the Helm chart.
clusterResourceNamespace: ""
# Override the namespace used to store DNS provider credentials etc. for ClusterIssuer
# resources. By default, the same namespace as cert-manager is deployed within is
# used. This namespace will not be automatically created by the Helm chart.
clusterResourceNamespace: ""
# This namespace allows you to define where the services will be installed into
# if not set then they will use the namespace of the release
# This is helpful when installing cert manager as a chart dependency (sub chart)
namespace: ""
# This namespace allows you to define where the services will be installed into
# if not set then they will use the namespace of the release
# This is helpful when installing cert manager as a chart dependency (sub chart)
namespace: ""
serviceAccount:
serviceAccount:
# Specifies whether a service account should be created
create: true
@@ -150,162 +139,162 @@
# Automount API credentials for a Service Account.
automountServiceAccountToken: true
# Automounting API credentials for a particular pod
# +docs:property
# automountServiceAccountToken: true
# Automounting API credentials for a particular pod
# +docs:property
# automountServiceAccountToken: true
# When this flag is enabled, secrets will be automatically removed when the certificate resource is deleted
enableCertificateOwnerRef: false
# When this flag is enabled, secrets will be automatically removed when the certificate resource is deleted
enableCertificateOwnerRef: false
# Used to configure options for the controller pod.
# This allows setting options that'd usually be provided via flags.
# An APIVersion and Kind must be specified in your values.yaml file.
# Flags will override options that are set here.
#
# For example:
# config:
# apiVersion: controller.config.cert-manager.io/v1alpha1
# kind: ControllerConfiguration
# logging:
# verbosity: 2
# format: text
# leaderElectionConfig:
# namespace: kube-system
# kubernetesAPIQPS: 9000
# kubernetesAPIBurst: 9000
# numberOfConcurrentWorkers: 200
# featureGates:
# AdditionalCertificateOutputFormats: true
# DisallowInsecureCSRUsageDefinition: true
# ExperimentalCertificateSigningRequestControllers: true
# ExperimentalGatewayAPISupport: true
# LiteralCertificateSubject: true
# SecretsFilteredCaching: true
# ServerSideApply: true
# StableCertificateRequestName: true
# UseCertificateRequestBasicConstraints: true
# ValidateCAA: true
# metricsTLSConfig:
# dynamic:
# secretNamespace: "cert-manager"
# secretName: "cert-manager-metrics-ca"
# dnsNames:
# - cert-manager-metrics
# - cert-manager-metrics.cert-manager
# - cert-manager-metrics.cert-manager.svc
config: {}
# Used to configure options for the controller pod.
# This allows setting options that'd usually be provided via flags.
# An APIVersion and Kind must be specified in your values.yaml file.
# Flags will override options that are set here.
#
# For example:
# config:
# apiVersion: controller.config.cert-manager.io/v1alpha1
# kind: ControllerConfiguration
# logging:
# verbosity: 2
# format: text
# leaderElectionConfig:
# namespace: kube-system
# kubernetesAPIQPS: 9000
# kubernetesAPIBurst: 9000
# numberOfConcurrentWorkers: 200
# featureGates:
# AdditionalCertificateOutputFormats: true
# DisallowInsecureCSRUsageDefinition: true
# ExperimentalCertificateSigningRequestControllers: true
# ExperimentalGatewayAPISupport: true
# LiteralCertificateSubject: true
# SecretsFilteredCaching: true
# ServerSideApply: true
# StableCertificateRequestName: true
# UseCertificateRequestBasicConstraints: true
# ValidateCAA: true
# metricsTLSConfig:
# dynamic:
# secretNamespace: "cert-manager"
# secretName: "cert-manager-metrics-ca"
# dnsNames:
# - cert-manager-metrics
# - cert-manager-metrics.cert-manager
# - cert-manager-metrics.cert-manager.svc
config: {}
# Setting Nameservers for DNS01 Self Check
# See: https://cert-manager.io/docs/configuration/acme/dns01/#setting-nameservers-for-dns01-self-check
# Setting Nameservers for DNS01 Self Check
# See: https://cert-manager.io/docs/configuration/acme/dns01/#setting-nameservers-for-dns01-self-check
# Comma separated string with host and port of the recursive nameservers cert-manager should query
dns01RecursiveNameservers: ""
# Comma separated string with host and port of the recursive nameservers cert-manager should query
dns01RecursiveNameservers: ""
# Forces cert-manager to only use the recursive nameservers for verification.
# Enabling this option could cause the DNS01 self check to take longer due to caching performed by the recursive nameservers
dns01RecursiveNameserversOnly: false
# Forces cert-manager to only use the recursive nameservers for verification.
# Enabling this option could cause the DNS01 self check to take longer due to caching performed by the recursive nameservers
dns01RecursiveNameserversOnly: false
# Additional command line flags to pass to cert-manager controller binary.
# To see all available flags run docker run quay.io/jetstack/cert-manager-controller:<version> --help
#
# Use this flag to enable or disable arbitrary controllers, for example, disable the CertificiateRequests approver
#
# For example:
# extraArgs:
# - --controllers=*,-certificaterequests-approver
extraArgs: []
# Additional command line flags to pass to cert-manager controller binary.
# To see all available flags run docker run quay.io/jetstack/cert-manager-controller:<version> --help
#
# Use this flag to enable or disable arbitrary controllers, for example, disable the CertificiateRequests approver
#
# For example:
# extraArgs:
# - --controllers=*,-certificaterequests-approver
extraArgs: []
# Additional environment variables to pass to cert-manager controller binary.
extraEnv: []
# - name: SOME_VAR
# value: 'some value'
# Additional environment variables to pass to cert-manager controller binary.
extraEnv: []
# - name: SOME_VAR
# value: 'some value'
# Resources to provide to the cert-manager controller pod
#
# For example:
# requests:
# cpu: 10m
# memory: 32Mi
#
# ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {}
# Resources to provide to the cert-manager controller pod
#
# For example:
# requests:
# cpu: 10m
# memory: 32Mi
#
# ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {}
# Pod Security Context
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
# +docs:property
securityContext:
# Pod Security Context
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
# +docs:property
securityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
# Container Security Context to be set on the controller component container
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
# +docs:property
containerSecurityContext:
# Container Security Context to be set on the controller component container
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
# +docs:property
containerSecurityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
# Additional volumes to add to the cert-manager controller pod.
volumes: []
# Additional volumes to add to the cert-manager controller pod.
volumes: []
# Additional volume mounts to add to the cert-manager controller container.
volumeMounts: []
# Additional volume mounts to add to the cert-manager controller container.
volumeMounts: []
# Optional additional annotations to add to the controller Deployment
# +docs:property
# deploymentAnnotations: {}
# Optional additional annotations to add to the controller Deployment
# +docs:property
# deploymentAnnotations: {}
# Optional additional annotations to add to the controller Pods
# +docs:property
# podAnnotations: {}
# Optional additional annotations to add to the controller Pods
# +docs:property
# podAnnotations: {}
# Optional additional labels to add to the controller Pods
podLabels: {}
# Optional additional labels to add to the controller Pods
podLabels: {}
# Optional annotations to add to the controller Service
# +docs:property
# serviceAnnotations: {}
# Optional annotations to add to the controller Service
# +docs:property
# serviceAnnotations: {}
# Optional additional labels to add to the controller Service
# +docs:property
# serviceLabels: {}
# Optional additional labels to add to the controller Service
# +docs:property
# serviceLabels: {}
# Optional DNS settings, useful if you have a public and private DNS zone for
# the same domain on Route 53. What follows is an example of ensuring
# cert-manager can access an ingress or DNS TXT records at all times.
# NOTE: This requires Kubernetes 1.10 or `CustomPodDNS` feature gate enabled for
# the cluster to work.
# Optional DNS settings, useful if you have a public and private DNS zone for
# the same domain on Route 53. What follows is an example of ensuring
# cert-manager can access an ingress or DNS TXT records at all times.
# NOTE: This requires Kubernetes 1.10 or `CustomPodDNS` feature gate enabled for
# the cluster to work.
# Pod DNS policy
# ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy
# +docs:property
# podDnsPolicy: "None"
# Pod DNS policy
# ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy
# +docs:property
# podDnsPolicy: "None"
# Pod DNS config, podDnsConfig field is optional and it can work with any podDnsPolicy
# settings. However, when a Pod's dnsPolicy is set to "None", the dnsConfig field has to be specified.
# ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config
# +docs:property
podDnsConfig:
# Pod DNS config, podDnsConfig field is optional and it can work with any podDnsPolicy
# settings. However, when a Pod's dnsPolicy is set to "None", the dnsConfig field has to be specified.
# ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config
# +docs:property
podDnsConfig:
nameservers:
{{- range $index,$value := .Modules.Additional.CertManager.DnsServers }}
- "{{ $value }}"
{{- end }}
# The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
# matching labels.
# See https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
#
# This default ensures that Pods are only scheduled to Linux nodes.
# It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
# +docs:property
nodeSelector:
# The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
# matching labels.
# See https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
#
# This default ensures that Pods are only scheduled to Linux nodes.
# It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
# +docs:property
nodeSelector:
kubernetes.io/os: linux
# +docs:ignore
ingressShim: {}
# +docs:ignore
ingressShim: {}
# Optional default issuer to use for ingress resources
# +docs:property=ingressShim.defaultIssuerName
@@ -319,68 +308,68 @@
# +docs:property=ingressShim.defaultIssuerGroup
# defaultIssuerGroup: ""
# Use these variables to configure the HTTP_PROXY environment variables
# Use these variables to configure the HTTP_PROXY environment variables
# Configures the HTTP_PROXY environment variable for where a HTTP proxy is required
# +docs:property
# http_proxy: "http://proxy:8080"
# Configures the HTTP_PROXY environment variable for where a HTTP proxy is required
# +docs:property
# http_proxy: "http://proxy:8080"
# Configures the HTTPS_PROXY environment variable for where a HTTP proxy is required
# +docs:property
# https_proxy: "https://proxy:8080"
# Configures the HTTPS_PROXY environment variable for where a HTTP proxy is required
# +docs:property
# https_proxy: "https://proxy:8080"
# Configures the NO_PROXY environment variable for where a HTTP proxy is required,
# but certain domains should be excluded
# +docs:property
# no_proxy: 127.0.0.1,localhost
# Configures the NO_PROXY environment variable for where a HTTP proxy is required,
# but certain domains should be excluded
# +docs:property
# no_proxy: 127.0.0.1,localhost
# A Kubernetes Affinity, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core
#
# For example:
# affinity:
# nodeAffinity:
# requiredDuringSchedulingIgnoredDuringExecution:
# nodeSelectorTerms:
# - matchExpressions:
# - key: foo.bar.com/role
# operator: In
# values:
# - master
affinity: {}
# A Kubernetes Affinity, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core
#
# For example:
# affinity:
# nodeAffinity:
# requiredDuringSchedulingIgnoredDuringExecution:
# nodeSelectorTerms:
# - matchExpressions:
# - key: foo.bar.com/role
# operator: In
# values:
# - master
affinity: {}
# A list of Kubernetes Tolerations, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core
#
# For example:
# tolerations:
# - key: foo.bar.com/role
# operator: Equal
# value: master
# effect: NoSchedule
tolerations: []
# A list of Kubernetes Tolerations, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core
#
# For example:
# tolerations:
# - key: foo.bar.com/role
# operator: Equal
# value: master
# effect: NoSchedule
tolerations: []
# A list of Kubernetes TopologySpreadConstraints, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core
#
# For example:
# topologySpreadConstraints:
# - maxSkew: 2
# topologyKey: topology.kubernetes.io/zone
# whenUnsatisfiable: ScheduleAnyway
# labelSelector:
# matchLabels:
# app.kubernetes.io/instance: cert-manager
# app.kubernetes.io/component: controller
topologySpreadConstraints: []
# A list of Kubernetes TopologySpreadConstraints, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core
#
# For example:
# topologySpreadConstraints:
# - maxSkew: 2
# topologyKey: topology.kubernetes.io/zone
# whenUnsatisfiable: ScheduleAnyway
# labelSelector:
# matchLabels:
# app.kubernetes.io/instance: cert-manager
# app.kubernetes.io/component: controller
topologySpreadConstraints: []
# LivenessProbe settings for the controller container of the controller Pod.
#
# Enabled by default, because we want to enable the clock-skew liveness probe that
# restarts the controller in case of a skew between the system clock and the monotonic clock.
# LivenessProbe durations and thresholds are based on those used for the Kubernetes
# controller-manager. See:
# https://github.com/kubernetes/kubernetes/blob/806b30170c61a38fedd54cc9ede4cd6275a1ad3b/cmd/kubeadm/app/util/staticpod/utils.go#L241-L245
# +docs:property
livenessProbe:
# LivenessProbe settings for the controller container of the controller Pod.
#
# Enabled by default, because we want to enable the clock-skew liveness probe that
# restarts the controller in case of a skew between the system clock and the monotonic clock.
# LivenessProbe durations and thresholds are based on those used for the Kubernetes
# controller-manager. See:
# https://github.com/kubernetes/kubernetes/blob/806b30170c61a38fedd54cc9ede4cd6275a1ad3b/cmd/kubeadm/app/util/staticpod/utils.go#L241-L245
# +docs:property
livenessProbe:
enabled: true
initialDelaySeconds: 10
periodSeconds: 10
@@ -388,14 +377,14 @@
successThreshold: 1
failureThreshold: 8
# enableServiceLinks indicates whether information about services should be
# injected into pod's environment variables, matching the syntax of Docker
# links.
enableServiceLinks: false
# enableServiceLinks indicates whether information about services should be
# injected into pod's environment variables, matching the syntax of Docker
# links.
enableServiceLinks: false
# +docs:section=Prometheus
# +docs:section=Prometheus
prometheus:
prometheus:
# Enable Prometheus monitoring for the cert-manager controller to use with the
# Prometheus Operator. If this option is enabled without enabling `prometheus.servicemonitor.enabled` or
# `prometheus.podmonitor.enabled`, 'prometheus.io' annotations are added to the cert-manager Deployment
@@ -490,9 +479,9 @@
# +docs:property
endpointAdditionalProperties: {}
# +docs:section=Webhook
# +docs:section=Webhook
webhook:
webhook:
# Number of replicas of the cert-manager webhook to run.
#
# The default is 1, but in production you should set this to 2 or 3 to provide high
@@ -849,9 +838,9 @@
# links.
enableServiceLinks: false
# +docs:section=CA Injector
# +docs:section=CA Injector
cainjector:
cainjector:
# Create the CA Injector deployment
enabled: true
@@ -1070,9 +1059,9 @@
# links.
enableServiceLinks: false
# +docs:section=ACME Solver
# +docs:section=ACME Solver
acmesolver:
acmesolver:
image:
# The container registry to pull the acmesolver image from
# +docs:property
@@ -1094,16 +1083,16 @@
# Kubernetes imagePullPolicy on Deployment.
pullPolicy: IfNotPresent
# +docs:section=Startup API Check
# This startupapicheck is a Helm post-install hook that waits for the webhook
# endpoints to become available.
# The check is implemented using a Kubernetes Job - if you are injecting mesh
# sidecar proxies into cert-manager pods, you probably want to ensure that they
# are not injected into this Job's pod. Otherwise the installation may time out
# due to the Job never being completed because the sidecar proxy does not exit.
# See https://github.com/cert-manager/cert-manager/pull/4414 for context.
# +docs:section=Startup API Check
# This startupapicheck is a Helm post-install hook that waits for the webhook
# endpoints to become available.
# The check is implemented using a Kubernetes Job - if you are injecting mesh
# sidecar proxies into cert-manager pods, you probably want to ensure that they
# are not injected into this Job's pod. Otherwise the installation may time out
# due to the Job never being completed because the sidecar proxy does not exit.
# See https://github.com/cert-manager/cert-manager/pull/4414 for context.
startupapicheck:
startupapicheck:
# Enables the startup api check
enabled: true

14
internal/resources/templates/helm-apps/releases/additional-modules/docker-secrets-generator.yml.tmpl
View File

@@ -1,14 +1,2 @@
- name: docker-secrets-generator
namespace: kube-system
chart_ref: {{ .Modules.Additional.DockerSecrets.ChartRef }}
chart_version: {{ .Modules.Additional.DockerSecrets.ChartVersion }}
{{- if .Modules.Additional.DockerSecrets.Repositories }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
{{- if .Modules.Additional.DockerSecrets.Repositories }}
values:
repositories:
repositories:
{{- .Modules.Additional.DockerSecrets.Repositories | toYaml | nindent 6 }}
{{- end }}

85
internal/resources/templates/helm-apps/releases/additional-modules/ingress-nginx.yml.tmpl
View File

@@ -1,16 +1,5 @@
- name: ingress-nginx
namespace: ingress-nginx
create_namespace: true
chart_ref: {{ .Modules.Additional.Ingress.ChartRef }}
chart_version: {{ .Modules.Additional.Ingress.ChartVersion }}
{{- if and .Modules.Additional.Ingress.Enabled (eq .Modules.Additional.Ingress.Type "nginx") }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
commonLabels: {}
controller:
commonLabels: {}
controller:
name: controller
enableAnnotationValidations: false
image:
@@ -20,8 +9,6 @@
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
repository: {{ .Modules.Additional.Ingress.Nginx.Controller.Image }}
tag: "{{ .Modules.Additional.Ingress.Nginx.Controller.Tag }}"
digest: sha256:5b161f051d017e55d358435f295f5e9a297e66158f136321d9b04520ec6c48a3
digestChroot: sha256:5976b1067cfbca8a21d0ba53d71f83543a73316a61ea7f7e436d6cf84ddf9b26
pullPolicy: IfNotPresent
# www-data -> uid 101
runAsUser: 101
@@ -556,7 +543,7 @@
opentelemetry:
enabled: false
image: registry.k8s.io/ingress-nginx/opentelemetry:v20230721-3e2062ee5@sha256:13bee3f5223883d3ca62fee7309ad02d22ec00ff0d7033e3e9aca7a9f60fd472
# image: registry.k8s.io/ingress-nginx/opentelemetry:v20230721-3e2062ee5@sha256:13bee3f5223883d3ca62fee7309ad02d22ec00ff0d7033e3e9aca7a9f60fd472
containerSecurityContext:
allowPrivilegeEscalation: false
resources: {}
@@ -737,12 +724,12 @@
command:
- /wait-shutdown
priorityClassName: ""
# -- Rollback limit
##
revisionHistoryLimit: 10
## Default 404 backend
##
defaultBackend:
# -- Rollback limit
##
revisionHistoryLimit: 10
## Default 404 backend
##
defaultBackend:
##
enabled: false
name: defaultbackend
@@ -868,41 +855,41 @@
priorityClassName: ""
# -- Labels to be added to the default backend resources
labels: {}
## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266
rbac:
## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266
rbac:
create: true
scope: false
## If true, create & use Pod Security Policy resources
## https://kubernetes.io/docs/concepts/policy/pod-security-policy/
podSecurityPolicy:
## If true, create & use Pod Security Policy resources
## https://kubernetes.io/docs/concepts/policy/pod-security-policy/
podSecurityPolicy:
enabled: false
serviceAccount:
serviceAccount:
create: true
name: ""
automountServiceAccountToken: true
# -- Annotations for the controller service account
annotations: {}
# -- Optional array of imagePullSecrets containing private registry credentials
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
imagePullSecrets: []
# - name: secretName
# -- Optional array of imagePullSecrets containing private registry credentials
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
imagePullSecrets: []
# - name: secretName
# -- TCP service key-value pairs
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md
##
tcp: {}
# 8080: "default/example-tcp-svc:9000"
# -- TCP service key-value pairs
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md
##
tcp: {}
# 8080: "default/example-tcp-svc:9000"
# -- UDP service key-value pairs
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md
##
udp: {}
# 53: "kube-system/kube-dns:53"
# -- UDP service key-value pairs
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md
##
udp: {}
# 53: "kube-system/kube-dns:53"
# -- Prefix for TCP and UDP ports names in ingress controller service
## Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration
portNamePrefix: ""
# -- (string) A base64-encoded Diffie-Hellman parameter.
# This can be generated with: `openssl dhparam 4096 2> /dev/null | base64`
## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param
dhParam: ""
# -- Prefix for TCP and UDP ports names in ingress controller service
## Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration
portNamePrefix: ""
# -- (string) A base64-encoded Diffie-Hellman parameter.
# This can be generated with: `openssl dhparam 4096 2> /dev/null | base64`
## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param
dhParam: ""

61
internal/resources/templates/helm-apps/releases/additional-modules/longhorn.yml.tmpl
View File

@@ -1,15 +1,4 @@
- name: longhorn
namespace: longhorn-system
create_namespace: true
chart_ref: {{ .Modules.Additional.Storage.Longhorn.ChartRef }}
chart_version: {{ .Modules.Additional.Storage.Longhorn.ChartVersion }}
{{- if .Modules.Additional.Storage.Longhorn.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
global:
global:
cattle:
# -- Default system registry.
systemDefaultRegistry: ""
@@ -31,13 +20,13 @@
# -- Node selector for system-managed Longhorn components.
systemManagedComponentsNodeSelector: kubernetes.io/os:linux
networkPolicies:
networkPolicies:
# -- Setting that allows you to enable network policies that control access to Longhorn pods.
enabled: false
# -- Distribution that determines the policy for allowing access for an ingress. (Options: "k3s", "rke2", "rke1")
type: "k3s"
image:
image:
longhorn:
engine:
# -- Repository for the Longhorn Engine image.
@@ -114,7 +103,7 @@
# -- Image pull policy that applies to all user-deployed Longhorn components, such as Longhorn Manager, Longhorn driver, and Longhorn UI.
pullPolicy: IfNotPresent
service:
service:
ui:
# -- Service type for Longhorn UI. (Options: "ClusterIP", "NodePort", "LoadBalancer", "Rancher-Proxy")
type: ClusterIP
@@ -126,7 +115,7 @@
# -- NodePort port number for Longhorn Manager. When unspecified, Longhorn selects a free port between 30000 and 32767.
nodePort: ""
persistence:
persistence:
# -- Setting that allows you to specify the default Longhorn StorageClass.
defaultClass: true
# -- Filesystem type of the default Longhorn StorageClass.
@@ -170,13 +159,13 @@
# -- Setting that allows you to enable automatic snapshot removal during filesystem trim for a Longhorn StorageClass. (Options: "ignored", "enabled", "disabled")
removeSnapshotsDuringFilesystemTrim: ignored
preUpgradeChecker:
preUpgradeChecker:
# -- Setting that allows Longhorn to perform pre-upgrade checks. Disable this setting when installing Longhorn using Argo CD or other GitOps solutions.
jobEnabled: true
# -- Setting that allows Longhorn to perform upgrade version checks after starting the Longhorn Manager DaemonSet Pods. Disabling this setting also disables `preUpgradeChecker.jobEnabled`. Longhorn recommends keeping this setting enabled.
upgradeVersionCheck: true
csi:
csi:
# -- kubelet root directory. When unspecified, Longhorn uses the default value.
kubeletRootDir: ~
# -- Replica count of the CSI Attacher. When unspecified, Longhorn uses the default value ("3").
@@ -188,7 +177,7 @@
# -- Replica count of the CSI Snapshotter. When unspecified, Longhorn uses the default value ("3").
snapshotterReplicaCount: ~
defaultSettings:
defaultSettings:
# -- Endpoint used to access the backupstore. (Options: "NFS", "CIFS", "AWS", "GCP", "AZURE")
backupTarget: ~
# -- Name of the Kubernetes secret associated with the backup target.
@@ -330,7 +319,7 @@
# -- Maximum snapshot count for a volume. The value should be between 2 to 250
snapshotMaxCount: ~
privateRegistry:
privateRegistry:
# -- Setting that allows you to create a private registry secret.
createSecret: ~
# -- URL of a private registry. When unspecified, Longhorn uses the default system registry.
@@ -342,7 +331,7 @@
# -- Kubernetes secret that allows you to pull images from a private registry. This setting applies only when creation of private registry secrets is enabled. You must include the private registry name in the secret name.
registrySecret: ~
longhornManager:
longhornManager:
log:
# -- Format of Longhorn Manager logs. (Options: "plain", "json")
format: plain
@@ -369,7 +358,7 @@
# annotation-key1: "annotation-value1"
# annotation-key2: "annotation-value2"
longhornDriver:
longhornDriver:
# -- PriorityClass for Longhorn Driver.
priorityClass: *defaultPriorityClassNameRef
# -- Toleration for Longhorn Driver on nodes allowed to run Longhorn components.
@@ -387,7 +376,7 @@
# label-key1: "label-value1"
# label-key2: "label-value2"
longhornUI:
longhornUI:
# -- Replica count for Longhorn UI.
replicas: 2
# -- PriorityClass for Longhorn UI.
@@ -407,7 +396,7 @@
# label-key1: "label-value1"
# label-key2: "label-value2"
ingress:
ingress:
# -- Setting that allows Longhorn to generate ingress records for the Longhorn UI service.
enabled: false
@@ -456,26 +445,26 @@
# key:
# certificate:
# -- Setting that allows you to enable pod security policies (PSPs) that allow privileged Longhorn pods to start. This setting applies only to clusters running Kubernetes 1.25 and earlier, and with the built-in Pod Security admission controller enabled.
enablePSP: false
# -- Setting that allows you to enable pod security policies (PSPs) that allow privileged Longhorn pods to start. This setting applies only to clusters running Kubernetes 1.25 and earlier, and with the built-in Pod Security admission controller enabled.
enablePSP: false
# -- Specify override namespace, specifically this is useful for using longhorn as sub-chart and its release namespace is not the `longhorn-system`.
namespaceOverride: ""
# -- Specify override namespace, specifically this is useful for using longhorn as sub-chart and its release namespace is not the `longhorn-system`.
namespaceOverride: ""
# -- Annotation for the Longhorn Manager DaemonSet pods. This setting is optional.
annotations: {}
# -- Annotation for the Longhorn Manager DaemonSet pods. This setting is optional.
annotations: {}
serviceAccount:
serviceAccount:
# -- Annotations to add to the service account
annotations: {}
metrics:
metrics:
serviceMonitor:
# -- Setting that allows the creation of a Prometheus ServiceMonitor resource for Longhorn Manager components.
enabled: false
## openshift settings
openshift:
## openshift settings
openshift:
# -- Setting that allows Longhorn to integrate with OpenShift.
enabled: false
ui:
@@ -486,5 +475,5 @@
# -- Port for proxy that provides access to the OpenShift web console.
proxy: 8443
# -- Setting that allows Longhorn to generate code coverage profiles.
enableGoCoverDir: false
# -- Setting that allows Longhorn to generate code coverage profiles.
enableGoCoverDir: false

72
internal/resources/templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl
View File

@@ -1,14 +1,4 @@
- name: csi-secrets-store
namespace: kube-system
chart_ref: {{ .Modules.Additional.Storage.SecretsStoreCsiDriver.ChartRef }}
chart_version: {{ .Modules.Additional.Storage.SecretsStoreCsiDriver.ChartVersion }}
{{- if .Modules.Additional.Storage.SecretsStoreCsiDriver.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
linux:
linux:
enabled: true
image:
repository: registry.k8s.io/csi-secrets-store/driver
@@ -116,7 +106,7 @@
# mountPath: /bar
# readOnly: true
windows:
windows:
enabled: false
image:
repository: registry.k8s.io/csi-secrets-store/driver
@@ -206,49 +196,49 @@
# mountPath: /bar
# readOnly: true
# log level. Uses V logs (klog)
logVerbosity: 0
# log level. Uses V logs (klog)
logVerbosity: 0
# logging format JSON
logFormatJSON: false
# logging format JSON
logFormatJSON: false
livenessProbe:
livenessProbe:
port: 9808
logLevel: 2
## Maximum size in bytes of gRPC response from plugins
maxCallRecvMsgSize: 4194304
## Maximum size in bytes of gRPC response from plugins
maxCallRecvMsgSize: 4194304
## Install Default RBAC roles and bindings
rbac:
## Install Default RBAC roles and bindings
rbac:
install: true
pspEnabled: false
## Install RBAC roles and bindings required for K8S Secrets syncing if true
syncSecret:
## Install RBAC roles and bindings required for K8S Secrets syncing if true
syncSecret:
enabled: false
## Enable secret rotation feature [alpha]
enableSecretRotation: false
## Enable secret rotation feature [alpha]
enableSecretRotation: false
## Secret rotation poll interval duration
rotationPollInterval:
## Secret rotation poll interval duration
rotationPollInterval:
## Provider HealthCheck
providerHealthCheck: false
## Provider HealthCheck
providerHealthCheck: false
## Provider HealthCheck interval
providerHealthCheckInterval: 2m
## Provider HealthCheck interval
providerHealthCheckInterval: 2m
imagePullSecrets: []
imagePullSecrets: []
## This allows CSI drivers to impersonate the pods that they mount the volumes for.
# refer to https://kubernetes-csi.github.io/docs/token-requests.html for more details.
# Supported only for Kubernetes v1.20+
tokenRequests: []
# - audience: aud1
# - audience: aud2
## This allows CSI drivers to impersonate the pods that they mount the volumes for.
# refer to https://kubernetes-csi.github.io/docs/token-requests.html for more details.
# Supported only for Kubernetes v1.20+
tokenRequests: []
# - audience: aud1
# - audience: aud2
# -- Labels to apply to all resources
commonLabels: {}
# team_name: dev
# -- Labels to apply to all resources
commonLabels: {}
# team_name: dev

15
internal/resources/templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl
View File

@@ -1,22 +1,11 @@
- name: argo-cd-ingress
namespace: cicd
create_namespace: true
chart_ref: {{ .Modules.Cicd.ArgoCd.ServiceIngress.ChartRef }}
chart_version: {{ .Modules.Cicd.ArgoCd.ServiceIngress.ChartVersion }}
{{- if and .Modules.Cicd.Enabled (eq .Modules.Cicd.ArgoCd.Expose.Type "ingress") }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
services:
services:
- domain: {{ .Modules.Cicd.ArgoCd.Expose.Domain }}
path: {{ .Modules.Cicd.ArgoCd.Expose.Path }}
address: argo-cd-argocd-server
port: 80
secretName: argo-cd-server-tls
ingress:
ingress:
accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
class: {{ .Modules.Additional.Ingress.Type }}
annotations:

37
internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl
View File

@@ -1,22 +1,11 @@
- name: argo-cd
namespace: cicd
create_namespace: true
chart_ref: {{ .Modules.Cicd.ArgoCd.ChartRef }}
chart_version: {{ .Modules.Cicd.ArgoCd.ChartVersion }}
{{- if .Modules.Cicd.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
crds:
crds:
install: true
global:
global:
repository: {{ .Modules.Cicd.ArgoCd.Global.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Global.Tag }}
server:
server:
image:
repository: {{ .Modules.Cicd.ArgoCd.Server.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Server.Tag }}
@@ -43,7 +32,7 @@
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
redis:
redis:
image:
repository: {{ .Modules.Cicd.ArgoCd.Redis.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Redis.Tag }}
@@ -57,7 +46,7 @@
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
controller:
controller:
image:
repository: {{ .Modules.Cicd.ArgoCd.Controller.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Controller.Tag }}
@@ -67,7 +56,7 @@
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
applicationSet:
applicationSet:
image:
repository: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Image }}
tag: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Tag }}
@@ -79,7 +68,7 @@
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
dex:
dex:
image:
repository: {{ .Modules.Cicd.ArgoCd.Dex.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Dex.Tag }}
@@ -89,7 +78,7 @@
serviceMonitor:
enabled: false
repoServer:
repoServer:
image:
repository: {{ .Modules.Cicd.ArgoCd.RepoServer.Image }}
tag: {{ .Modules.Cicd.ArgoCd.RepoServer.Tag }}
@@ -107,7 +96,7 @@
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
notifications:
notifications:
image:
repository: {{ .Modules.Cicd.ArgoCd.Notifications.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Notifications.Tag }}
@@ -116,7 +105,7 @@
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
configs:
configs:
params:
server.insecure: true
{{- if not (eq .Modules.Cicd.ArgoCd.Expose.Path "/" ) }}
@@ -175,7 +164,7 @@
policy.default: role:''
# scopes: "[roles,email,groups]"
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
redis-ha:
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
redis-ha:
enabled: true
{{- end }}
{{- end }}

73
internal/resources/templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl
View File

@@ -1,29 +1,18 @@
- name: argo-rollouts
namespace: cicd
create_namespace: true
chart_ref: {{ .Modules.Cicd.Rollouts.ChartRef }}
chart_version: {{ .Modules.Cicd.Rollouts.ChartVersion }}
{{- if and .Modules.Cicd.Enabled .Modules.Cicd.Rollouts.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
installCRDs: true
keepCRDs: false
clusterInstall: true
createClusterAggregateRoles: true
installCRDs: true
keepCRDs: false
clusterInstall: true
createClusterAggregateRoles: true
apiVersionOverrides:
apiVersionOverrides:
# -- String to override apiVersion of ingresses rendered by this helm chart
ingress: "" # networking.k8s.io/v1beta1
# -- Override the Kubernetes version, which is used to evaluate certain manifests
kubeVersionOverride: ""
# -- Override the Kubernetes version, which is used to evaluate certain manifests
kubeVersionOverride: ""
# -- Additional manifests to deploy within the chart. A list of objects.
## Can be used to add secrets for Analysis with 3rd-party monitoring solutions.
extraObjects: []
# -- Additional manifests to deploy within the chart. A list of objects.
## Can be used to add secrets for Analysis with 3rd-party monitoring solutions.
extraObjects: []
# - apiVersion: v1
# kind: Secret
# metadata:
@@ -34,11 +23,11 @@
# api-key: <datadog-api-key>
# app-key: <datadog-app-key>
global:
global:
# -- Annotations for all deployed Deployments
deploymentAnnotations: {}
controller:
controller:
# -- Value of label `app.kubernetes.io/component`
component: rollouts-controller
# -- Annotations to be added to the controller deployment
@@ -182,7 +171,7 @@
# - name: "argoproj-labs/sample-nginx" # name of the plugin, it must match the name required by the plugin so it can find it's configuration
# location: "file://./my-custom-plugin" # supports http(s):// urls and file://
serviceAccount:
serviceAccount:
# -- Specifies whether a service account should be created
create: true
# -- Annotations to add to the service account
@@ -191,18 +180,18 @@
# If not set and create is true, a name is generated using the fullname template
name: ""
# -- Annotations to be added to all CRDs
crdAnnotations: {}
# -- Annotations to be added to all CRDs
crdAnnotations: {}
# -- Annotations for the all deployed pods
podAnnotations: {}
# -- Annotations for the all deployed pods
podAnnotations: {}
# -- Security Context to set on pod level
podSecurityContext:
# -- Security Context to set on pod level
podSecurityContext:
runAsNonRoot: true
# -- Security Context to set on container level
containerSecurityContext: {}
# -- Security Context to set on container level
containerSecurityContext: {}
# capabilities:
# drop:
# - ALL
@@ -210,17 +199,17 @@
# runAsNonRoot: true
# runAsUser: 1000
# -- Annotations to be added to the Rollout service
serviceAnnotations: {}
# -- Annotations to be added to the Rollout service
serviceAnnotations: {}
# -- Labels to be added to the Rollout pods
podLabels: {}
# -- Labels to be added to the Rollout pods
podLabels: {}
# -- Secrets with credentials to pull images from a private registry. Registry secret names as an array.
imagePullSecrets: []
# - name: argo-pull-secret
# -- Secrets with credentials to pull images from a private registry. Registry secret names as an array.
imagePullSecrets: []
# - name: argo-pull-secret
providerRBAC:
providerRBAC:
# -- Toggles addition of provider-specific RBAC rules to the controller Role and ClusterRole
enabled: true
# providerRBAC.enabled must be true in order to toggle the individual providers
@@ -246,7 +235,7 @@
# -- Additional RBAC rules for others providers
additionalRules: []
dashboard:
dashboard:
# -- Deploy dashboard server
enabled: true
# -- Set cluster role to readonly
@@ -412,7 +401,7 @@
# -- Additional volumeMounts to add to the dashboard container
volumeMounts: []
notifications:
notifications:
secret:
# -- Whether to create notifications secret
create: false

216
internal/resources/templates/helm-apps/releases/cicd/keel.yml.tmpl
View File

@@ -1,36 +1,26 @@
- name: keel
namespace: kube-system
chart_ref: {{ .Modules.Cicd.UpdatesOperator.ChartRef }}
chart_version: {{ .Modules.Cicd.UpdatesOperator.ChartVersion }}
{{- if and .Modules.Cicd.Enabled .Modules.Cicd.UpdatesOperator.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
image:
image:
repository: {{ .Modules.Cicd.UpdatesOperator.Image }}
tag: {{ .Modules.Cicd.UpdatesOperator.Tag }}
pullPolicy: Always
# Enable insecure registries
insecureRegistry: false
# Enable insecure registries
insecureRegistry: false
# Polling is enabled by default,
# you can disable it setting value below to false
polling:
# Polling is enabled by default,
# you can disable it setting value below to false
polling:
enabled: true
defaultSchedule: "@every 1m"
# Extra Containers to run alongside Keel
# extraContainers:
# - name: busybox
# image: busybox
# imagePullPolicy: IfNotPresent
# command: ['sh', '-c', 'echo Container 1 is Running ; sleep 3600']
# Extra Containers to run alongside Keel
# extraContainers:
# - name: busybox
# image: busybox
# imagePullPolicy: IfNotPresent
# command: ['sh', '-c', 'echo Container 1 is Running ; sleep 3600']
# Helm provider support
helmProvider:
# Helm provider support
helmProvider:
enabled: true
# set to version "v3" for Helm v3
version: "v2"
@@ -39,12 +29,12 @@
# if you are using default configuration, setting it to
# 'tiller-deploy:44134' is usually fine
tillerAddress: 'tiller-deploy:44134'
# helmDriver: ''
# helmDriverSqlConnectionString: ''
# helmDriver: ''
# helmDriverSqlConnectionString: ''
# Google Container Registry
# GCP Project ID
gcr:
# Google Container Registry
# GCP Project ID
gcr:
enabled: false
projectId: ""
gcpServiceAccount: ""
@@ -52,35 +42,35 @@
pubSub:
enabled: false
# Notification level (debug, info, success, warn, error, fatal)
notificationLevel: info
# Notification level (debug, info, success, warn, error, fatal)
notificationLevel: info
# AWS Elastic Container Registry
# https://keel.sh/v1/guide/documentation.html#Polling-with-AWS-ECR
ecr:
# AWS Elastic Container Registry
# https://keel.sh/v1/guide/documentation.html#Polling-with-AWS-ECR
ecr:
enabled: false
roleArn: ""
accessKeyId: ""
secretAccessKey: ""
region: ""
# Webhook Notification
# Remote webhook endpoint for notification delivery
webhook:
# Webhook Notification
# Remote webhook endpoint for notification delivery
webhook:
enabled: false
endpoint: ""
# Slack Notification
# bot name (default keel) must exist!
slack:
# Slack Notification
# bot name (default keel) must exist!
slack:
enabled: false
botName: ""
token: ""
channel: ""
approvalsChannel: ""
# Hipchat notification and approvals
hipchat:
# Hipchat notification and approvals
hipchat:
enabled: false
token: ""
channel: ""
@@ -89,23 +79,23 @@
userName: ""
password: ""
# Mattermost notifications
mattermost:
# Mattermost notifications
mattermost:
enabled: false
endpoint: ""
# MS Teams notifications
teams:
# MS Teams notifications
teams:
enabled: false
webhookUrl: ""
# Discord notifications
discord:
# Discord notifications
discord:
enabled: false
webhookUrl: ""
# Mail notifications
mail:
# Mail notifications
mail:
enabled: false
from: ""
to: ""
@@ -115,24 +105,24 @@
user: ""
pass: ""
# Basic auth on approvals
basicauth:
# Basic auth on approvals
basicauth:
enabled: true
user: "admin"
password: "{{ .Modules.AdminPassword }}"
# Keel service
# Enable to receive webhooks from Docker registries
service:
# Keel service
# Enable to receive webhooks from Docker registries
service:
enabled: false
type: LoadBalancer
externalPort: 9300
clusterIP: ""
# Webhook Relay service
# If you don’t want to expose your Keel service, you can use https://webhookrelay.com/
# which can deliver webhooks to your internal Keel service through Keel sidecar container.
webhookRelay:
# Webhook Relay service
# If you don’t want to expose your Keel service, you can use https://webhookrelay.com/
# which can deliver webhooks to your internal Keel service through Keel sidecar container.
webhookRelay:
enabled: false
bucket: ""
# webhookrelay.com credentials
@@ -146,30 +136,30 @@
tag: latest
pullPolicy: IfNotPresent
# Use a secret file to define passwords and tokens of third parties.
secret:
# Use a secret file to define passwords and tokens of third parties.
secret:
# Leave blank to use `keel.fullname`
name: ""
# Set to false to manage your own secret file, with terraform for example.
create: true
# Keel self-update
# uncomment lines below if you want Keel to automaticly
# self-update to the latest release version
# keel:
# # keel policy (all/major/minor/patch/force)
# policy: patch
# # trigger type, defaults to events such as pubsub, webhooks
# trigger: poll
# # polling schedule
# pollSchedule: "@every 3m"
# # images to track and update
# images:
# - repository: image.repository
# tag: image.tag
# Keel self-update
# uncomment lines below if you want Keel to automaticly
# self-update to the latest release version
# keel:
# # keel policy (all/major/minor/patch/force)
# policy: patch
# # trigger type, defaults to events such as pubsub, webhooks
# trigger: poll
# # polling schedule
# pollSchedule: "@every 3m"
# # images to track and update
# images:
# - repository: image.repository
# tag: image.tag
# RBAC manifests management
rbac:
# RBAC manifests management
rbac:
enabled: true
serviceAccount:
# Kubernetes service account name to be used for ClusterRoleBinding and Deployment.
@@ -178,8 +168,8 @@
# If rbac.serviceAccount.name is not set, a new name for the service account is generated
create: true
# Resources
resources:
# Resources
resources:
limits:
cpu: 100m
memory: 128Mi
@@ -187,69 +177,69 @@
cpu: 50m
memory: 64Mi
# NodeSelector
nodeSelector: {}
# NodeSelector
nodeSelector: {}
affinity: {}
affinity: {}
tolerations: {}
tolerations: {}
# base64 encoded json of GCP service account
# more info available here: https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform
# e.g. --set googleApplicationCredentials=$(cat <JSON_KEY_FIEL> | base64)
googleApplicationCredentials: ""
# base64 encoded json of GCP service account
# more info available here: https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform
# e.g. --set googleApplicationCredentials=$(cat <JSON_KEY_FIEL> | base64)
googleApplicationCredentials: ""
# Enable DEBUG logging
debug: false
# Enable DEBUG logging
debug: false
# This is used by the static manifest generator in order to create a static
# namespace manifest for the namespace that keel is being installed
# within. It should **not** be used if you are using Helm for deployment.
createNamespaceResource: false
# This is used by the static manifest generator in order to create a static
# namespace manifest for the namespace that keel is being installed
# within. It should **not** be used if you are using Helm for deployment.
createNamespaceResource: false
podAnnotations: {}
podAnnotations: {}
serviceAnnotations: {}
# Useful for making the load balancer internal
# serviceAnnotations:
# cloud.google.com/load-balancer-type: Internal
serviceAnnotations: {}
# Useful for making the load balancer internal
# serviceAnnotations:
# cloud.google.com/load-balancer-type: Internal
aws:
aws:
region: null
podDisruptionBudget:
podDisruptionBudget:
enabled: false
maxUnavailable: 1
minAvailable: null
# Google Cloud Certificates
gcloud:
# Google Cloud Certificates
gcloud:
managedCertificates:
enabled: false
domains:
- ""
ingress:
ingress:
enabled: false
labels: {}
annotations: {}
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
hosts: []
# - host: chart-example.local
# paths:
# - /
# - host: chart-example.local
# paths:
# - /
tls: []
# - secretName: chart-example-tls
# hosts:
# - chart-example.local
# - secretName: chart-example-tls
# hosts:
# - chart-example.local
dockerRegistry:
dockerRegistry:
enabled: false
name: ""
key: ""
persistence:
persistence:
enabled: false
storageClass: "-"
size: 1Gi

29
internal/resources/templates/helm-apps/releases/observability/fluent-operator.yml.tmpl
View File

@@ -1,19 +1,8 @@
- name: fluent-operator
namespace: observability
create_namespace: true
chart_ref: {{ .Modules.Observability.Logging.Operator.ChartRef }}
chart_version: {{ .Modules.Observability.Logging.Operator.ChartVersion }}
{{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
# Set this to containerd or crio if you want to collect CRI format logs
containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
Kubernetes: false
# Set this to containerd or crio if you want to collect CRI format logs
containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
Kubernetes: false
operator:
operator:
initcontainer:
repository: "{{ .Modules.Observability.Logging.Operator.InitContainer.Image }}"
tag: "{{ .Modules.Observability.Logging.Operator.InitContainer.Tag }}"
@@ -44,11 +33,11 @@
containerd: /var/log
disableComponentControllers: ""
fluentbit:
fluentbit:
crdsEnable: true
enable: false
fluentd:
fluentd:
crdsEnable: true
enable: false
name: fluentd
@@ -61,6 +50,6 @@
repository: "{{ .Modules.Observability.Logging.Fluentd.Image }}"
tag: "{{ .Modules.Observability.Logging.Fluentd.Tag }}"
nameOverride: ""
fullnameOverride: ""
namespaceOverride: ""
nameOverride: ""
fullnameOverride: ""
namespaceOverride: ""

28
internal/resources/templates/helm-apps/releases/observability/loki.yml.tmpl
View File

@@ -1,15 +1,4 @@
- name: loki
namespace: observability
create_namespace: true
chart_ref: {{ .Modules.Observability.Logging.Loki.ChartRef }}
chart_version: {{ .Modules.Observability.Logging.Loki.ChartVersion }}
{{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
loki:
loki:
image:
registry: {{ .Modules.Observability.Logging.Loki.Registry }}
repository: {{ .Modules.Observability.Logging.Loki.Image }}
@@ -53,7 +42,7 @@
alertmanager_url: {{ .Modules.Observability.Logging.Loki.AlertManagerUrl }}
singleBinary:
singleBinary:
replicas: 1
extraVolumes:
@@ -66,19 +55,19 @@
mountPath: /var/loki/rules
write:
write:
persistence:
volumeClaimsEnabled: true
storageClass: "{{ .Modules.Observability.Logging.Loki.Persistence.StorageClass }}"
size: {{ .Modules.Observability.Logging.Loki.Persistence.StorageSize }}
test:
test:
enabled: false
gateway:
gateway:
enabled: false
monitoring:
monitoring:
selfMonitoring:
enabled: false
grafanaAgent:
@@ -88,9 +77,8 @@
rules:
enabled: true
alerting: true
additionalGroups: {}
extraObjects:
extraObjects:
- apiVersion: v1
kind: ConfigMap
metadata:
@@ -168,7 +156,7 @@
jobName: kube_events
summary: BackOff events occured in cluster
addDefaultUrl: "true"
sidecar:
sidecar:
rules:
enabled: true
# -- Label that the configmaps/secrets with rules will be marked with.

101
internal/resources/templates/helm-apps/releases/observability/metrics-server.yml.tmpl
View File

@@ -1,26 +1,15 @@
- name: metrics-server
namespace: kube-system
create_namespace: true
chart_ref: {{ .Modules.Observability.Monitoring.MetricsServer.ChartRef }}
chart_version: {{ .Modules.Observability.Monitoring.MetricsServer.ChartVersion }}
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
image:
image:
repository: {{.Modules.Observability.Monitoring.MetricsServer.Image }}
tag: "{{ .Modules.Observability.Monitoring.MetricsServer.Tag }}"
pullPolicy: IfNotPresent
imagePullSecrets: []
# - name: registrySecretName
imagePullSecrets: []
# - name: registrySecretName
nameOverride: ""
fullnameOverride: ""
nameOverride: ""
fullnameOverride: ""
serviceAccount:
serviceAccount:
# Specifies whether a service account should be created
create: true
# Annotations to add to the service account
@@ -32,12 +21,12 @@
# See https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets
secrets: []
rbac:
rbac:
# Specifies whether RBAC resources should be created
create: true
pspEnabled: false
apiService:
apiService:
create: true
# Annotations to add to the API service
annotations: {}
@@ -46,14 +35,14 @@
# The PEM encoded CA bundle for TLS verification
caBundle: ""
commonLabels: {}
podLabels:
commonLabels: {}
podLabels:
"app.kubernetes.io/component": "metrics-server"
podAnnotations: {}
podAnnotations: {}
podSecurityContext: {}
podSecurityContext: {}
securityContext:
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
@@ -64,11 +53,11 @@
drop:
- ALL
priorityClassName: system-cluster-critical
priorityClassName: system-cluster-critical
containerPort: 10250
containerPort: 10250
hostNetwork:
hostNetwork:
# Specifies if metrics-server should be started in hostNetwork mode.
#
# You would require this enabled if you use alternate overlay networking for pods and
@@ -76,32 +65,32 @@
# if you use Weave network on EKS
enabled: false
replicas: 1
replicas: 1
revisionHistoryLimit:
revisionHistoryLimit:
updateStrategy: {}
# type: RollingUpdate
# rollingUpdate:
# maxSurge: 0
# maxUnavailable: 1
updateStrategy: {}
# type: RollingUpdate
# rollingUpdate:
# maxSurge: 0
# maxUnavailable: 1
podDisruptionBudget:
podDisruptionBudget:
# https://kubernetes.io/docs/tasks/run-application/configure-pdb/
enabled: false
minAvailable:
maxUnavailable:
defaultArgs:
defaultArgs:
- --cert-dir=/tmp
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
- --kubelet-use-node-status-port
- --metric-resolution=15s
- --kubelet-insecure-tls
args: []
args: []
livenessProbe:
livenessProbe:
httpGet:
path: /livez
port: https
@@ -110,7 +99,7 @@
periodSeconds: 10
failureThreshold: 3
readinessProbe:
readinessProbe:
httpGet:
path: /readyz
port: https
@@ -119,7 +108,7 @@
periodSeconds: 10
failureThreshold: 3
service:
service:
type: ClusterIP
port: 443
annotations: {}
@@ -128,7 +117,7 @@
# kubernetes.io/cluster-service: "true"
# kubernetes.io/name: "Metrics-server"
addonResizer:
addonResizer:
enabled: false
image:
repository: registry.k8s.io/autoscaling/addon-resizer
@@ -159,10 +148,10 @@
pollPeriod: 300000
threshold: 5
metrics:
metrics:
enabled: true
serviceMonitor:
serviceMonitor:
enabled: true
additionalLabels: {}
interval: 1m
@@ -170,8 +159,8 @@
metricRelabelings: []
relabelings: []
# See https://github.com/kubernetes-sigs/metrics-server#scaling
resources:
# See https://github.com/kubernetes-sigs/metrics-server#scaling
resources:
requests:
cpu: 100m
memory: 200Mi
@@ -179,25 +168,25 @@
# cpu:
# memory:
extraVolumeMounts: []
extraVolumeMounts: []
extraVolumes: []
extraVolumes: []
nodeSelector: {}
nodeSelector: {}
tolerations: []
tolerations: []
affinity: {}
affinity: {}
topologySpreadConstraints: []
topologySpreadConstraints: []
dnsConfig: {}
dnsConfig: {}
# Annotations to add to the deployment
deploymentAnnotations: {}
# Annotations to add to the deployment
deploymentAnnotations: {}
schedulerName: ""
schedulerName: ""
tmpVolume:
tmpVolume:
emptyDir: {}

35
internal/resources/templates/helm-apps/releases/observability/observability.yml.tmpl
View File

@@ -1,15 +1,4 @@
- name: observability
namespace: observability
create_namespace: true
chart_ref: {{ .Modules.Observability.ChartRef }}
chart_version: {{ .Modules.Observability.ChartVersion }}
{{- if .Modules.Observability.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
prometheus:
prometheus:
enabled: {{ .Modules.Observability.Monitoring.Enabled }}
serviceMonitor: true
image:
@@ -105,7 +94,7 @@
replacement: observability-blackbox-exporter:9115
{{- end }}
alertManager:
alertManager:
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.AlertManager.Enabled }}
serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
enableDefaultRules: true
@@ -130,7 +119,7 @@
{{- .Modules.Observability.Monitoring.AlertManager.Receivers | toYaml | nindent 8 }}
{{- end }}
blackboxExporter:
blackboxExporter:
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.Blackbox.Enabled }}
serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
image:
@@ -144,7 +133,7 @@
additionalModules:
kubeStateMetrics:
kubeStateMetrics:
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.KubeState.Enabled }}
image:
repository: {{ .Modules.Observability.Monitoring.KubeState.Image }}
@@ -158,7 +147,7 @@
memory: 240Mi
cpu: 60m
prometheusOperator:
prometheusOperator:
enabled: {{ .Modules.Observability.Monitoring.Enabled }}
image:
repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Image }}
@@ -177,14 +166,14 @@
tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Tag }}
pullPolicy: IfNotPresent
nodeExporter:
nodeExporter:
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.Node.Enabled }}
image:
repository: {{ .Modules.Observability.Monitoring.Node.Image }}
tag: {{ .Modules.Observability.Monitoring.Node.Tag }}
pullPolicy: IfNotPresent
kubeEventsExporter:
kubeEventsExporter:
enabled: {{ and .Modules.Observability.Logging.Enabled .Modules.Observability.Logging.Events.Enabled }}
image:
repository: {{ .Modules.Observability.Logging.Events.Exporter.Image }}
@@ -207,7 +196,7 @@
additionalRoutes:
additionalReceivers:
grafana:
grafana:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Visualization.Grafana.Enabled }}
serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
domain: &grafanaDomain {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
@@ -269,7 +258,7 @@
{{- .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources | toYaml | nindent 10 }}
{{- end }}
opentelemetryCollector:
opentelemetryCollector:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
serviceMonitor: true
config: |
@@ -290,7 +279,7 @@
receivers: [otlp]
exporters: [otlphttp]
ingress:
ingress:
{{- if and .Modules.Observability.Visualization.Grafana.Enabled (eq .Modules.Observability.Visualization.Grafana.Expose.Type "ingress") }}
enabled: true
{{- else }}
@@ -312,9 +301,9 @@
- host: {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
secretName: grafana-tls
containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
fluentbit:
fluentbit:
enable: {{ and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
serviceMonitor: true
image:

45
internal/resources/templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl
View File

@@ -1,23 +1,12 @@
- name: opentelemetry-operator
namespace: observability
create_namespace: true
chart_ref: {{ .Modules.Observability.Tracing.Operator.ChartRef }}
chart_version: {{ .Modules.Observability.Tracing.Operator.ChartVersion }}
{{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
replicaCount: 1
nameOverride: ""
imagePullSecrets: []
pdb:
replicaCount: 1
nameOverride: ""
imagePullSecrets: []
pdb:
create: false
minAvailable: 1
maxUnavailable: ""
manager:
manager:
image:
repository: {{ .Modules.Observability.Tracing.Operator.Image }}
tag: "{{ .Modules.Observability.Tracing.Operator.Tag }}"
@@ -73,7 +62,7 @@
securityContext: {}
kubeRBACProxy:
kubeRBACProxy:
enabled: true
image:
repository: quay.io/brancz/kube-rbac-proxy
@@ -92,7 +81,7 @@
securityContext: {}
admissionWebhooks:
admissionWebhooks:
create: true
servicePort: 443
failurePolicy: Fail
@@ -119,27 +108,27 @@
secretAnnotations: {}
secretLabels: {}
role:
role:
create: true
clusterRole:
clusterRole:
create: true
affinity: {}
tolerations: []
nodeSelector: {}
topologySpreadConstraints: []
hostNetwork: false
affinity: {}
tolerations: []
nodeSelector: {}
topologySpreadConstraints: []
hostNetwork: false
priorityClassName: ""
priorityClassName: ""
securityContext:
securityContext:
runAsGroup: 65532
runAsNonRoot: true
runAsUser: 65532
fsGroup: 65532
testFramework:
testFramework:
image:
repository: busybox
tag: latest

27
internal/resources/templates/helm-apps/releases/observability/tempo.yml.tmpl
View File

@@ -1,17 +1,6 @@
- name: tempo
namespace: observability
create_namespace: true
chart_ref: {{ .Modules.Observability.Tracing.Tempo.ChartRef }}
chart_version: {{ .Modules.Observability.Tracing.Tempo.ChartVersion }}
{{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
replicas: 1
replicas: 1
tempo:
tempo:
repository: {{ .Modules.Observability.Tracing.Tempo.Image }}
tag: "{{ .Modules.Observability.Tracing.Tempo.Tag }}"
pullPolicy: IfNotPresent
@@ -46,7 +35,7 @@
http:
endpoint: "0.0.0.0:4318"
tempoQuery:
tempoQuery:
repository: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Image }}
tag: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Tag }}
pullPolicy: IfNotPresent
@@ -59,21 +48,21 @@
ingress:
enabled: false
serviceAccount:
serviceAccount:
create: true
automountServiceAccountToken: true
service:
service:
type: ClusterIP
serviceMonitor:
serviceMonitor:
enabled: true
persistence:
persistence:
enabled: true
storageClassName: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageClass }}
accessModes:
- ReadWriteOnce
size: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageSize }}
priorityClassName: null
priorityClassName: null

17
internal/resources/templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl
View File

@@ -1,17 +1,6 @@
- name: harbor-certificate-generator
namespace: {{ .Modules.Registry.Namespace }}
create_namespace: true
chart_ref: {{ .Modules.Registry.Tls.CertificateGenerator.ChartRef }}
chart_version: {{ .Modules.Registry.Tls.CertificateGenerator.ChartVersion }}
{{- if and .Modules.Registry.Enabled (eq .Modules.Registry.Expose.Type "ingress") }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
issuer_email: {{ .Modules.Additional.CertManager.AccountEmail }}
solver_ingress_class: {{ .Modules.Additional.Ingress.Type }}
issuer_email: {{ .Modules.Additional.CertManager.AccountEmail }}
solver_ingress_class: {{ .Modules.Additional.Ingress.Type }}
certificates:
certificates:
- name: harbor-tls
domain: {{ .Modules.Registry.Expose.Domain }}

43
internal/resources/templates/helm-apps/releases/registry/harbor.yml.tmpl
View File

@@ -1,15 +1,4 @@
- name: harbor
namespace: {{ .Modules.Registry.Namespace }}
create_namespace: true
chart_ref: {{ .Modules.Registry.ChartRef }}
chart_version: {{ .Modules.Registry.ChartVersion }}
{{- if .Modules.Registry.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
expose:
expose:
type: {{ .Modules.Registry.Expose.Type }}
tls:
enabled: {{ .Modules.Registry.Tls.Enabled }}
@@ -41,8 +30,8 @@
port: 443
nodePort: {{ .Modules.Registry.Expose.NodePortHttps }}
externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain }}{{ if not (eq .Modules.Registry.Expose.Path "/") }}{{ .Modules.Registry.Expose.Path }}{{ end }}
persistence:
externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain }}{{ if not (eq .Modules.Registry.Expose.Path "/") }}{{ .Modules.Registry.Expose.Path }}{{ end }}
persistence:
resourcePolicy: "keep"
persistentVolumeClaim:
registry:
@@ -90,16 +79,16 @@
rootdirectory: /storage
#maxthreads: 100
imagePullPolicy: IfNotPresent
imagePullPolicy: IfNotPresent
updateStrategy:
updateStrategy:
type: RollingUpdate
harborAdminPassword: "{{ .Modules.Registry.AdminPassword }}"
harborAdminPassword: "{{ .Modules.Registry.AdminPassword }}"
logLevel: info
logLevel: info
metrics:
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
core:
path: /metrics
@@ -117,7 +106,7 @@
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
trace:
trace:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
provider: otel
sample_rate: 1
@@ -132,7 +121,7 @@
insecure: true
timeout: 10
portal:
portal:
image:
repository: {{ .Modules.Registry.Portal.Image }}
tag: {{ .Modules.Registry.Portal.Tag }}
@@ -147,7 +136,7 @@
"app.kubernetes.io/component": "harbor-portal"
priorityClassName:
core:
core:
image:
repository: {{ .Modules.Registry.Core.Image }}
tag: {{ .Modules.Registry.Portal.Tag }}
@@ -185,7 +174,7 @@
auditLogsCompliant: false
jobservice:
jobservice:
image:
repository: {{ .Modules.Registry.Jobservice.Image }}
tag: {{ .Modules.Registry.Jobservice.Tag }}
@@ -213,7 +202,7 @@
existingSecret: ""
existingSecretKey: JOBSERVICE_SECRET
registry:
registry:
registry:
image:
repository: {{ .Modules.Registry.Registry.Registry.Image }}
@@ -262,7 +251,7 @@
interval: 24h
dryrun: false
trivy:
trivy:
enabled: {{ .Modules.Registry.EnabledScanner }}
image:
repository: {{ .Modules.Registry.Trivy.Image }}
@@ -278,7 +267,7 @@
memory: 1Gi
database:
database:
# if external database is used, set "type" to "external"
# and fill the connection information in "external" section
type: internal
@@ -339,7 +328,7 @@
podLabels: {}
redis:
redis:
type: internal
internal:
image:

27
internal/resources/templates/helm-apps/releases/secrets-storage/vault.yml.tmpl
View File

@@ -1,15 +1,4 @@
- name: vault
namespace: secrets-storage
create_namespace: true
chart_ref: {{ .Modules.SecretsStorage.ChartRef }}
chart_version: {{ .Modules.SecretsStorage.ChartVersion }}
{{- if .Modules.SecretsStorage.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
global:
global:
enabled: true
imagePullSecrets: []
@@ -35,7 +24,7 @@
# See the top level serverTelemetry section below before enabling this feature.
prometheusOperator: false
injector:
injector:
enabled: true
replicas: 1
@@ -282,7 +271,7 @@
# maxUnavailable: 25%
# type: RollingUpdate
server:
server:
enabled: true
enterpriseLicense:
# The name of the Kubernetes secret that holds the enterprise license. The
@@ -706,8 +695,8 @@
hostNetwork: false
# Vault UI
ui:
# Vault UI
ui:
enabled: true
domain: {{ .Modules.SecretsStorage.Expose.Domain }}
path: {{ .Modules.SecretsStorage.Expose.Path }}
@@ -738,7 +727,7 @@
annotations: {}
csi:
csi:
# True if you want to install a secrets-store-csi-driver-provider-vault daemonset.
#
# Requires installing the secrets-store-csi-driver separately, see:
@@ -833,7 +822,7 @@
debug: false
extraArgs: []
serverTelemetry:
serverTelemetry:
# Enable support for the Prometheus Operator. Currently, this chart does not support
# authenticating to Vault's metrics endpoint, so the following `telemetry{}` must be included
# in the `listener "tcp"{}` stanza
@@ -863,7 +852,7 @@
selectors: {}
rules: []
ingress:
ingress:
{{- if eq .Modules.SecretsStorage.Expose.Type "ingress" }}
enabled: true
{{- end }}

5
internal/resources/templates/helm-apps/repositories/repositories.yml.tmpl
View File

@@ -1,5 +0,0 @@
- name: kube-forge
url: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable"
{{ if .Modules.AdditionalRepositories }}
{{ .Modules.AdditionalRepositories | toYaml }}
{{- end }}

10
internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl
View File

@@ -232,13 +232,3 @@ argocd_enabled: false
# The plugin manager for kubectl
krew_enabled: false
krew_root_dir: "/usr/local/krew"
########################################
# Helm apps configuration
########################################
repositories:
{{- .Repositories | nindent 2 }}
releases:
{{- .Releases | nindent 2 }}

23
internal/secrets_storage/commands.go
View File

@@ -4,44 +4,45 @@ import (
"fmt"
"kube-forge/internal/config"
"kube-forge/internal/kubernetes_client"
"kube-forge/internal/logging"
"kube-forge/internal/templates"
"regexp"
"strings"
)
func InitVault() {
func initVault() {
_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
if err != nil {
fmt.Println(err.Error())
logging.Log.Error(err.Error())
return
}
err = commandToInitVault()
if err != nil {
fmt.Println(err.Error())
logging.Log.Warn(err.Error())
return
}
fmt.Println("Vault initialized")
logging.Log.Info("Vault initialized")
templates.ApplyVaultInitKeysTemplate()
}
func AddKubernetesLocalIntegration() {
func addKubernetesLocalIntegration() {
_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
if err != nil {
fmt.Println(err.Error())
logging.Log.Error(err.Error())
return
}
err = commandToAddKubernetesLocalIntegration()
if err != nil {
fmt.Println(err.Error())
logging.Log.Error(err.Error())
return
}
fmt.Println("Vault local Kubernetes integration added")
logging.Log.Info("Vault local Kubernetes integration added")
}
func UnsealVault() {
func unsealVault() {
_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
if err != nil {
fmt.Println(err.Error())
logging.Log.Error(err.Error())
return
}
commandToUnsealVault()
@@ -92,7 +93,7 @@ func commandToUnsealVault() {
commandArray, "secrets-storage", "vault-0", "vault",
)
}
fmt.Println("Vault unsealed")
logging.Log.Info("Vault unsealed")
}
func commandToAddKubernetesLocalIntegration() error {

44
internal/secrets_storage/helm.go Normal file
View File

@@ -0,0 +1,44 @@
package secrets_storage
import (
"kube-forge/internal/config"
"kube-forge/internal/helm_client"
"kube-forge/internal/templates"
"time"
go_helm_client "github.com/mittwald/go-helm-client"
)
var HELM_REPOS = []config.RepoSettings{
{
Name: "kube-forge",
URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
},
}
func getVaultSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "vault",
ChartName: appConfig.Modules.SecretsStorage.ChartRef,
Version: appConfig.Modules.SecretsStorage.ChartVersion,
Namespace: appConfig.Modules.SecretsStorage.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/secrets-storage/vault.yml.tmpl"),
}
}
func ApplyCharts() {
appConfig := config.GetConfig()
helm_client.AddHelmRepos(appConfig.Modules.SecretsStorage.Namespace, HELM_REPOS)
if appConfig.Modules.SecretsStorage.Enabled {
helm_client.InstallChart(getVaultSpec())
initVault()
unsealVault()
addKubernetesLocalIntegration()
} else {
helm_client.DeleteChart(getVaultSpec())
}
}

12
internal/templates/helm.go Normal file
View File

@@ -0,0 +1,12 @@
package templates
import (
"kube-forge/internal/config"
"kube-forge/internal/resources"
)
func GetHelmValuesByTemplate(templateFile string) string {
cfg := config.GetConfig()
template := getTemplateFromEmbedFSFolder(resources.Templates, templateFile)
return executeTemplateToString(template, cfg)
}

46
internal/templates/helm_apps.go
View File

@@ -1,46 +0,0 @@
package templates
import (
"kube-forge/internal/config"
"kube-forge/internal/resources"
"strings"
)
var HELM_APPS_TEMPLATES = [...]string{
"templates/helm-apps/releases/additional-modules/docker-secrets-generator.yml.tmpl",
"templates/helm-apps/releases/additional-modules/longhorn.yml.tmpl",
"templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl",
"templates/helm-apps/releases/additional-modules/ingress-nginx.yml.tmpl",
"templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl",
"templates/helm-apps/releases/observability/fluent-operator.yml.tmpl",
"templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl",
"templates/helm-apps/releases/observability/metrics-server.yml.tmpl",
"templates/helm-apps/releases/observability/tempo.yml.tmpl",
"templates/helm-apps/releases/observability/loki.yml.tmpl",
"templates/helm-apps/releases/observability/observability.yml.tmpl",
"templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl",
"templates/helm-apps/releases/registry/harbor.yml.tmpl",
"templates/helm-apps/releases/cicd/argo-cd.yml.tmpl",
"templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl",
"templates/helm-apps/releases/cicd/keel.yml.tmpl",
"templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl",
"templates/helm-apps/releases/secrets-storage/vault.yml.tmpl",
}
var HELM_REPOSITORIES_TEMPLATES = [...]string{
"templates/helm-apps/repositories/repositories.yml.tmpl",
}
func GetHelmAppsConfigData() (string, string) {
cfg := config.GetConfig()
helmAppsTemplateResults := []string{}
for _, templateFile := range HELM_APPS_TEMPLATES {
template := getTemplateFromEmbedFSFolder(resources.Templates, templateFile)
helmAppsTemplateResults = append(helmAppsTemplateResults, executeTemplateToString(template, cfg))
}
repositoriesTemplateResults := []string{}
for _, templateFile := range HELM_REPOSITORIES_TEMPLATES {
template := getTemplateFromEmbedFSFolder(resources.Templates, templateFile)
repositoriesTemplateResults = append(repositoriesTemplateResults, executeTemplateToString(template, cfg))
}
return strings.Join(repositoriesTemplateResults, "\n"), strings.Join(helmAppsTemplateResults, "\n")
}

6064
kubespray/inventory/group_vars/k8s_cluster/addons.yml
View File

File diff suppressed because it is too large Load Diff

2
kubespray/project/cluster.yml
View File

@@ -90,7 +90,7 @@
- { role: kubernetes-apps/ingress_controller, tags: ingress-controller }
- { role: kubernetes-apps/external_provisioner, tags: external-provisioner }
- { role: kubernetes-apps, tags: apps }
- { role: helm-apps, tags: helm-apps }
# - { role: helm-apps, tags: helm-apps }
- name: Apply resolv.conf changes now that cluster DNS is up
hosts: k8s_cluster