update vault integration

2024-05-10 15:56:07 +03:00
parent 385b79d457
commit a0f87046ca
55 changed files with 828 additions and 135 deletions
--- a/internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl
+++ b/internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl
@@ -0,0 +1,149 @@
+- name: argo-cd
+  namespace: cicd
+  create_namespace: true
+  chart_ref: {{ .Modules.Cicd.ArgoCd.ChartRef }}
+  chart_version: {{ .Modules.Cicd.ArgoCd.ChartVersion }}
+  {{- if .Modules.Cicd.Enabled }}
+  release_state: "present"
+  {{- else }}
+  release_state: "absent"
+  {{- end }}
+  values:
+    crds:
+      install: true
+
+    server:
+      certificateSecret:
+        enabled: false
+      {{- if eq .Modules.Cicd.ArgoCd.Expose.Type "NodePort" }}
+      service:
+        type: "NodePort"
+        nodePortHttp: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttp }}
+        nodePortHttps: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttps }}
+      {{- end }}
+      {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
+      {{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
+      autoscaling:
+        enabled: true
+        minReplicas: 2
+      {{- else }}
+      replicas: 2
+      {{- end }}
+      {{- end }}
+
+      metrics:
+        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+        serviceMonitor:
+          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+
+    redis:
+      metrics:
+        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+        serviceMonitor:
+          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+
+    controller:
+      replicas: 1
+      metrics:
+        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+        serviceMonitor:
+          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+
+    applicationSet:
+      {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
+      replicas: 2
+      {{- end }}
+      metrics:
+        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+        serviceMonitor:
+          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+
+    dex:
+      metrics:
+        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+        ## check later
+        serviceMonitor:
+          enabled: false
+
+    repoServer:
+      {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
+      {{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
+      autoscaling:
+        enabled: true
+        minReplicas: 2
+      {{- else }}
+      replicas: 2
+      {{- end }}
+      {{- end }}
+
+      metrics:
+        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+        serviceMonitor:
+          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+
+    notifications:
+      metrics:
+        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+        serviceMonitor:
+          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+
+    configs:
+      params:
+        server.insecure: true
+
+      secret:
+        argocdServerAdminPassword: {{ .Modules.Cicd.ArgoCd.AdminPassword }}
+
+      repositories:
+        # add default helm-repository from harbor
+        {{- .Modules.Cicd.ArgoCd.Repositories | toYaml | nindent 8 }}
+
+      cm:
+        create: true
+        url: "{{ if .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Cicd.ArgoCd.Expose.Domain }}"
+
+        accounts.developer: login
+        accounts.guest: login
+
+        # oidc.config: ""
+
+      rbac:
+        create: true
+        policy.csv: |
+          p, role:admin, applications, create, */*, allow
+          p, role:admin, applications, update, */*, allow
+          p, role:admin, applications, delete, */*, allow
+          p, role:admin, applications, sync, */*, allow
+          p, role:admin, applications, override, */*, allow
+          p, role:admin, applications, action/*, */*, allow
+          p, role:admin, applicationsets, get, */*, allow
+          p, role:admin, applicationsets, create, */*, allow
+          p, role:admin, applicationsets, update, */*, allow
+          p, role:admin, applicationsets, delete, */*, allow
+          p, role:admin, certificates, create, *, allow
+          p, role:admin, certificates, update, *, allow
+          p, role:admin, certificates, delete, *, allow
+          p, role:admin, clusters, create, *, allow
+          p, role:admin, clusters, update, *, allow
+          p, role:admin, clusters, delete, *, allow
+          p, role:admin, repositories, create, *, allow
+          p, role:admin, repositories, update, *, allow
+          p, role:admin, repositories, delete, *, allow
+          p, role:admin, projects, create, *, allow
+          p, role:admin, projects, update, *, allow
+          p, role:admin, projects, delete, *, allow
+          p, role:admin, accounts, update, *, allow
+          p, role:admin, gpgkeys, create, *, allow
+          p, role:admin, gpgkeys, delete, *, allow
+          p, role:admin, exec, create, */*, allow
+
+          {{- .Modules.Cicd.ArgoCd.Rbac.AdditionalPolicies }}
+
+
+        policy.default: role:''
+        # scopes: "[roles,email,groups]"
+
+    {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
+    redis-ha:
+      enabled: true
+    {{- end }}