add ability to specify paths for argocd and grafana (https://git.kvazaric.ru/gstykalin/kube-forge/-/issues/1)

2024-05-25 21:31:10 +03:00
parent 36d886d94a
commit f84c27e622
17 changed files with 534 additions and 16 deletions
--- a/internal/resources/templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl
+++ b/internal/resources/templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl
@@ -7,3 +7,248 @@
  {{- else }}
  release_state: "absent"
  {{- end }}
+  values:
+    linux:
+      enabled: true
+      image:
+        repository: registry.k8s.io/csi-secrets-store/driver
+        tag: v1.4.3
+        #digest: sha256:
+        pullPolicy: IfNotPresent
+
+      crds:
+        enabled: true
+        image:
+          repository: registry.k8s.io/csi-secrets-store/driver-crds
+          tag: v1.4.3
+          pullPolicy: IfNotPresent
+        ## Optionally override resource limits for crd hooks(jobs)
+        resources: {}
+          # requests:
+          #   cpu: "100m"
+          #   memory: "128Mi"
+          # limits:
+          #   cpu: "500m"
+          #   memory: "512Mi"
+        annotations: {}
+        podLabels: {}
+
+      ## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: type
+                    operator: NotIn
+                    values:
+                      - virtual-kubelet
+
+      driver:
+        resources:
+          limits:
+            cpu: 200m
+            memory: 200Mi
+          requests:
+            cpu: 50m
+            memory: 100Mi
+
+      registrarImage:
+        repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
+        tag: v2.10.0
+        #digest: sha256:
+        pullPolicy: IfNotPresent
+
+      registrar:
+        resources:
+          limits:
+            cpu: 100m
+            memory: 100Mi
+          requests:
+            cpu: 10m
+            memory: 20Mi
+        logVerbosity: 5
+
+      livenessProbeImage:
+        repository: registry.k8s.io/sig-storage/livenessprobe
+        tag: v2.12.0
+        #digest: sha256:
+        pullPolicy: IfNotPresent
+
+      livenessProbe:
+        resources:
+          limits:
+            cpu: 100m
+            memory: 100Mi
+          requests:
+            cpu: 10m
+            memory: 20Mi
+
+      updateStrategy:
+        type: RollingUpdate
+        rollingUpdate:
+          maxUnavailable: 1
+
+      kubeletRootDir: /var/lib/kubelet
+      providersDir: /var/run/secrets-store-csi-providers
+      additionalProvidersDirs:
+        - /etc/kubernetes/secrets-store-csi-providers
+      nodeSelector: {}
+      # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
+      # An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
+      tolerations:
+        - operator: "Exists"
+      metricsAddr: ":8095"
+      env: []
+      priorityClassName: ""
+      daemonsetAnnotations: {}
+      podAnnotations: {}
+      podLabels: {}
+
+      # volumes is a list of volumes made available to secrets store csi driver.
+      volumes: null
+      #   - name: foo
+      #     emptyDir: {}
+
+      # volumeMounts is a list of volumeMounts for secrets store csi driver.
+      volumeMounts: null
+      #   - name: foo
+      #     mountPath: /bar
+      #     readOnly: true
+
+    windows:
+      enabled: false
+      image:
+        repository: registry.k8s.io/csi-secrets-store/driver
+        tag: v1.4.3
+        #digest: sha256:
+        pullPolicy: IfNotPresent
+
+      ## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: type
+                    operator: NotIn
+                    values:
+                      - virtual-kubelet
+
+      driver:
+        resources:
+          limits:
+            cpu: 400m
+            memory: 400Mi
+          requests:
+            cpu: 100m
+            memory: 100Mi
+
+      registrarImage:
+        repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
+        tag: v2.10.0
+        #digest: sha256:
+        pullPolicy: IfNotPresent
+
+      registrar:
+        resources:
+          limits:
+            cpu: 200m
+            memory: 200Mi
+          requests:
+            cpu: 100m
+            memory: 100Mi
+        logVerbosity: 5
+
+      livenessProbeImage:
+        repository: registry.k8s.io/sig-storage/livenessprobe
+        tag: v2.12.0
+        #digest: sha256:
+        pullPolicy: IfNotPresent
+
+      livenessProbe:
+        resources:
+          limits:
+            cpu: 200m
+            memory: 200Mi
+          requests:
+            cpu: 100m
+            memory: 100Mi
+
+      updateStrategy:
+        type: RollingUpdate
+        rollingUpdate:
+          maxUnavailable: 1
+
+      kubeletRootDir: C:\var\lib\kubelet
+      providersDir: C:\\k\\secrets-store-csi-providers
+      additionalProvidersDirs:
+      nodeSelector: {}
+      # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
+      # An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
+      tolerations:
+        - operator: "Exists"
+      metricsAddr: ":8095"
+      env: []
+      priorityClassName: ""
+      daemonsetAnnotations: {}
+      podAnnotations: {}
+      podLabels: {}
+
+      # volumes is a list of volumes made available to secrets store csi driver.
+      volumes: null
+      #   - name: foo
+      #     emptyDir: {}
+
+      # volumeMounts is a list of volumeMounts for secrets store csi driver.
+      volumeMounts: null
+      #   - name: foo
+      #     mountPath: /bar
+      #     readOnly: true
+
+    # log level. Uses V logs (klog)
+    logVerbosity: 0
+
+    # logging format JSON
+    logFormatJSON: false
+
+    livenessProbe:
+      port: 9808
+      logLevel: 2
+
+    ## Maximum size in bytes of gRPC response from plugins
+    maxCallRecvMsgSize: 4194304
+
+    ## Install Default RBAC roles and bindings
+    rbac:
+      install: true
+      pspEnabled: false
+
+    ## Install RBAC roles and bindings required for K8S Secrets syncing if true
+    syncSecret:
+      enabled: false
+
+    ## Enable secret rotation feature [alpha]
+    enableSecretRotation: false
+
+    ## Secret rotation poll interval duration
+    rotationPollInterval:
+
+    ## Provider HealthCheck
+    providerHealthCheck: false
+
+    ## Provider HealthCheck interval
+    providerHealthCheckInterval: 2m
+
+    imagePullSecrets: []
+
+    ## This allows CSI drivers to impersonate the pods that they mount the volumes for.
+    # refer to https://kubernetes-csi.github.io/docs/token-requests.html for more details.
+    # Supported only for Kubernetes v1.20+
+    tokenRequests: []
+    # - audience: aud1
+    # - audience: aud2
+
+    # -- Labels to apply to all resources
+    commonLabels: {}
+    # team_name: dev
--- a/internal/resources/templates/helm-apps/releases/authentication/keycloak.yml.tmpl
+++ b/internal/resources/templates/helm-apps/releases/authentication/keycloak.yml.tmpl
--- a/internal/resources/templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl
+++ b/internal/resources/templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl
@@ -11,6 +11,7 @@
  values:
    services:
      - domain: {{ .Modules.Cicd.ArgoCd.Expose.Domain }}
+        path: {{ .Modules.Cicd.ArgoCd.Expose.Path }}
        address: argo-cd-argocd-server
        port: 80
        secretName: argo-cd-server-tls
--- a/internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl
+++ b/internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl
@@ -89,6 +89,9 @@
    configs:
      params:
        server.insecure: true
+        {{- if not (eq .Modules.Cicd.ArgoCd.Expose.Path "/" ) }}
+        server.rootpath: '{{ .Modules.Cicd.ArgoCd.Expose.Path }}'
+        {{- end }}

      secret:
        argocdServerAdminPassword: {{ .Modules.Cicd.ArgoCd.AdminPassword }}
--- a/internal/resources/templates/helm-apps/releases/observability/observability.yml.tmpl
+++ b/internal/resources/templates/helm-apps/releases/observability/observability.yml.tmpl
@@ -209,6 +209,7 @@
      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Visualization.Grafana.Enabled }}
      serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
      domain: &grafanaDomain {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
+      path: {{ .Modules.Observability.Visualization.Grafana.Expose.Path }}
      {{- if eq .Modules.Observability.Visualization.Grafana.Expose.Type "NodePort" }}
      serviceNodePort: {{ .Modules.Observability.Visualization.Grafana.Expose.NodePortHttp }}
      {{- end }}
@@ -225,7 +226,10 @@
      config:
        server: |
          enable_gzip = true
-          root_url = {{ if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
+          root_url = {{ if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}{{ .Modules.Observability.Visualization.Grafana.Expose.Path }}
+          {{- if not (eq .Modules.Observability.Visualization.Grafana.Expose.Path  "/") }}
+          serve_from_sub_path = true
+          {{- end }}

        security: |
          admin_user = admin
--- a/internal/resources/templates/helm-apps/releases/registry/harbor.yml.tmpl
+++ b/internal/resources/templates/helm-apps/releases/registry/harbor.yml.tmpl
@@ -41,7 +41,7 @@
            port: 443
            nodePort: {{ .Modules.Registry.Expose.NodePortHttps }}

-    externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain  }}
+    externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain  }}{{ if not (eq  .Modules.Registry.Expose.Path "/") }}{{ .Modules.Registry.Expose.Path }}{{ end }}
    persistence:
      resourcePolicy: "keep"
      persistentVolumeClaim:
--- a/internal/resources/templates/helm-apps/releases/secrets-storage/vault.yml.tmpl
+++ b/internal/resources/templates/helm-apps/releases/secrets-storage/vault.yml.tmpl
@@ -710,6 +710,7 @@
    ui:
      enabled: true
      domain: {{ .Modules.SecretsStorage.Expose.Domain }}
+      path: {{ .Modules.SecretsStorage.Expose.Path }}
      publishNotReadyAddresses: true
      # The service should only contain selectors for active Vault pod
      activeVaultPodOnly: false
@@ -785,7 +786,11 @@

      pod:
        annotations: {}
-        tolerations: []
+        tolerations:
+          - key: node-role.kubernetes.io/master
+            effect: NoSchedule
+          - key: node-role.kubernetes.io/control-plane
+            effect: NoSchedule
        nodeSelector: {}
        affinity: {}
        extraLabels: {}
--- a/internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl
+++ b/internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl
@@ -154,7 +154,7 @@ cert_manager_dns_config:
    - "8.8.4.4"

 # MetalLB deployment
-{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Install }}
+{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Enabled }}
 metallb_enabled: true
 {{- else }}
 metallb_enabled: false
--- a/internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl
+++ b/internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl
@@ -126,7 +126,7 @@ kube_proxy_mode: ipvs

 # configure arp_ignore and arp_announce to avoid answering ARP queries from kube-ipvs0 interface
 # must be set to true for MetalLB, kube-vip(ARP enabled) to work
-{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Install }}
+{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Enabled }}
 kube_proxy_strict_arp: true
 {{- else }}
 kube_proxy_strict_arp: false