add ability to specify paths for argocd and grafana (https://git.kvazaric.ru/gstykalin/kube-forge/-/issues/1)

README.md

@@ -7,11 +7,12 @@
 ### Docker-образ
 
 ```shell
+touch k8s-admin.conf
+
 docker run -v $(pwd)/config.yaml:/application/config.yaml \
   -v $(pwd)/id_rsa_bastion_ift:/root/.ssh/id_rsa \
-  -v $(pwd)/config:/root/.ssh/config \
+  -v type=bind,src=$(pwd)/k8s-admin.conf,dst=/application/k8s-admin.conf\
-  -v $(pwd)/k8s-admin.conf:/application/k8s-admin.conf \
+  harbor.kvazaric.ru/kube-forge/kube-forge:1.1-36d886d9 apply
-  harbor.kvazaric.ru/kube-forge/kube-forge:1.0-71bd08d2 apply
 ```
 
 ## С помощью исполняемого файла
@@ -20,6 +21,8 @@ docker run -v $(pwd)/config.yaml:/application/config.yaml \
 
 - sshpass
 
+А также установить Python-библиотеки из списка "requirements.txt"
+
 ```shell
 ./kube-forge -c config.yaml -d . apply
 ```

config.sample.yaml

@@ -72,6 +72,7 @@ modules:
         expose:
           type: ingress # ingress or NodePort
           domain: grafana.disk.lt.t1.cloud
+          # path: "/grafana"
           tls:
             enabled: true
 
@@ -81,6 +82,7 @@ modules:
       expose:
         type: ingress # ingress or NodePort
         domain: argocd.disk.lt.t1.cloud
+        # path: "/cicd"
         tls:
           enabled: true
     rollouts:

internal/config/modules_additional.go

@@ -36,7 +36,7 @@ type Additional struct {
 
 	LoadBalancer struct {
 		Type    string `yaml:"type" env-default:"metallb"`
-		Install bool   `yaml:"install"`
+		Enabled bool   `yaml:"enabled"`
 	} `yaml:"load_balancer"`
 
 	DockerSecrets struct {

internal/config/modules_cicd.go

@@ -4,7 +4,7 @@ type Cicd struct {
 	Enabled bool `yaml:"enabled"`
 	ArgoCd  struct {
 		ChartRef      string `yaml:"chart_ref" env-default:"kube-forge/argo-cd"`
-		ChartVersion  string `yaml:"chart_version" env-default:"5.46.7"`
+		ChartVersion  string `yaml:"chart_version" env-default:"6.7.10"`
 		AdminPassword string
 		Ha            struct {
 			Enabled     bool `yaml:"enabled"`
@@ -13,6 +13,7 @@ type Cicd struct {
 		Expose struct {
 			Type          string `yaml:"type"`
 			Domain        string `yaml:"domain"`
+			Path          string `yaml:"path" env-default:"/"`
 			NodePortHttp  int    `yaml:"node_port_http" env-default:"30005"`
 			NodePortHttps int    `yaml:"node_port_https" env-default:"30006"`
 			Tls           struct {

internal/config/modules_observability.go

@@ -154,6 +154,7 @@ type Visualization struct {
 		Expose  struct {
 			Type         string `yaml:"type" env-default:"ingress"`
 			Domain       string `yaml:"domain" env-default:""`
+			Path         string `yaml:"path" env-default:"/"`
 			NodePortHttp int    `yaml:"node_port_http" env-default:"30007"`
 			Tls          struct {
 				Enabled bool `yaml:"enabled"`

internal/config/modules_registry.go

@@ -10,6 +10,7 @@ type Registry struct {
 	Expose        struct {
 		Type          string `yaml:"type" env-default:"nodePort"`
 		Domain        string `yaml:"domain" env-default:""`
+		Path          string `yaml:"path" env-default:"/"`
 		NodePortHttp  int    `yaml:"node_port_http" env-default:"30002"`
 		NodePortHttps int    `yaml:"node_port_https" env-default:"30003"`
 	} `yaml:"expose"`

internal/config/modules_secrets_storage.go

@@ -11,6 +11,7 @@ type SecretsStorage struct {
 	Expose       struct {
 		Type     string `yaml:"type"`
 		Domain   string `yaml:"domain"`
+		Path     string `yaml:"path" env-default:"/"`
 		NodePort int    `yaml:"node_port"`
 		Tls      struct {
 			Enabled bool `yaml:"enabled"`

internal/resources/templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl

@@ -7,3 +7,248 @@
   {{- else }}
   release_state: "absent"
   {{- end }}
+  values:
+    linux:
+      enabled: true
+      image:
+        repository: registry.k8s.io/csi-secrets-store/driver
+        tag: v1.4.3
+        #digest: sha256:
+        pullPolicy: IfNotPresent
+
+      crds:
+        enabled: true
+        image:
+          repository: registry.k8s.io/csi-secrets-store/driver-crds
+          tag: v1.4.3
+          pullPolicy: IfNotPresent
+        ## Optionally override resource limits for crd hooks(jobs)
+        resources: {}
+          # requests:
+          #   cpu: "100m"
+          #   memory: "128Mi"
+          # limits:
+          #   cpu: "500m"
+          #   memory: "512Mi"
+        annotations: {}
+        podLabels: {}
+
+      ## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: type
+                    operator: NotIn
+                    values:
+                      - virtual-kubelet
+
+      driver:
+        resources:
+          limits:
+            cpu: 200m
+            memory: 200Mi
+          requests:
+            cpu: 50m
+            memory: 100Mi
+
+      registrarImage:
+        repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
+        tag: v2.10.0
+        #digest: sha256:
+        pullPolicy: IfNotPresent
+
+      registrar:
+        resources:
+          limits:
+            cpu: 100m
+            memory: 100Mi
+          requests:
+            cpu: 10m
+            memory: 20Mi
+        logVerbosity: 5
+
+      livenessProbeImage:
+        repository: registry.k8s.io/sig-storage/livenessprobe
+        tag: v2.12.0
+        #digest: sha256:
+        pullPolicy: IfNotPresent
+
+      livenessProbe:
+        resources:
+          limits:
+            cpu: 100m
+            memory: 100Mi
+          requests:
+            cpu: 10m
+            memory: 20Mi
+
+      updateStrategy:
+        type: RollingUpdate
+        rollingUpdate:
+          maxUnavailable: 1
+
+      kubeletRootDir: /var/lib/kubelet
+      providersDir: /var/run/secrets-store-csi-providers
+      additionalProvidersDirs:
+        - /etc/kubernetes/secrets-store-csi-providers
+      nodeSelector: {}
+      # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
+      # An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
+      tolerations:
+        - operator: "Exists"
+      metricsAddr: ":8095"
+      env: []
+      priorityClassName: ""
+      daemonsetAnnotations: {}
+      podAnnotations: {}
+      podLabels: {}
+
+      # volumes is a list of volumes made available to secrets store csi driver.
+      volumes: null
+      #   - name: foo
+      #     emptyDir: {}
+
+      # volumeMounts is a list of volumeMounts for secrets store csi driver.
+      volumeMounts: null
+      #   - name: foo
+      #     mountPath: /bar
+      #     readOnly: true
+
+    windows:
+      enabled: false
+      image:
+        repository: registry.k8s.io/csi-secrets-store/driver
+        tag: v1.4.3
+        #digest: sha256:
+        pullPolicy: IfNotPresent
+
+      ## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: type
+                    operator: NotIn
+                    values:
+                      - virtual-kubelet
+
+      driver:
+        resources:
+          limits:
+            cpu: 400m
+            memory: 400Mi
+          requests:
+            cpu: 100m
+            memory: 100Mi
+
+      registrarImage:
+        repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
+        tag: v2.10.0
+        #digest: sha256:
+        pullPolicy: IfNotPresent
+
+      registrar:
+        resources:
+          limits:
+            cpu: 200m
+            memory: 200Mi
+          requests:
+            cpu: 100m
+            memory: 100Mi
+        logVerbosity: 5
+
+      livenessProbeImage:
+        repository: registry.k8s.io/sig-storage/livenessprobe
+        tag: v2.12.0
+        #digest: sha256:
+        pullPolicy: IfNotPresent
+
+      livenessProbe:
+        resources:
+          limits:
+            cpu: 200m
+            memory: 200Mi
+          requests:
+            cpu: 100m
+            memory: 100Mi
+
+      updateStrategy:
+        type: RollingUpdate
+        rollingUpdate:
+          maxUnavailable: 1
+
+      kubeletRootDir: C:\var\lib\kubelet
+      providersDir: C:\\k\\secrets-store-csi-providers
+      additionalProvidersDirs:
+      nodeSelector: {}
+      # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
+      # An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
+      tolerations:
+        - operator: "Exists"
+      metricsAddr: ":8095"
+      env: []
+      priorityClassName: ""
+      daemonsetAnnotations: {}
+      podAnnotations: {}
+      podLabels: {}
+
+      # volumes is a list of volumes made available to secrets store csi driver.
+      volumes: null
+      #   - name: foo
+      #     emptyDir: {}
+
+      # volumeMounts is a list of volumeMounts for secrets store csi driver.
+      volumeMounts: null
+      #   - name: foo
+      #     mountPath: /bar
+      #     readOnly: true
+
+    # log level. Uses V logs (klog)
+    logVerbosity: 0
+
+    # logging format JSON
+    logFormatJSON: false
+
+    livenessProbe:
+      port: 9808
+      logLevel: 2
+
+    ## Maximum size in bytes of gRPC response from plugins
+    maxCallRecvMsgSize: 4194304
+
+    ## Install Default RBAC roles and bindings
+    rbac:
+      install: true
+      pspEnabled: false
+
+    ## Install RBAC roles and bindings required for K8S Secrets syncing if true
+    syncSecret:
+      enabled: false
+
+    ## Enable secret rotation feature [alpha]
+    enableSecretRotation: false
+
+    ## Secret rotation poll interval duration
+    rotationPollInterval:
+
+    ## Provider HealthCheck
+    providerHealthCheck: false
+
+    ## Provider HealthCheck interval
+    providerHealthCheckInterval: 2m
+
+    imagePullSecrets: []
+
+    ## This allows CSI drivers to impersonate the pods that they mount the volumes for.
+    # refer to https://kubernetes-csi.github.io/docs/token-requests.html for more details.
+    # Supported only for Kubernetes v1.20+
+    tokenRequests: []
+    # - audience: aud1
+    # - audience: aud2
+
+    # -- Labels to apply to all resources
+    commonLabels: {}
+    # team_name: dev

internal/resources/templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl

@@ -11,6 +11,7 @@
   values:
     services:
       - domain: {{ .Modules.Cicd.ArgoCd.Expose.Domain }}
+        path: {{ .Modules.Cicd.ArgoCd.Expose.Path }}
         address: argo-cd-argocd-server
         port: 80
         secretName: argo-cd-server-tls

internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl

@@ -89,6 +89,9 @@
     configs:
       params:
         server.insecure: true
+        {{- if not (eq .Modules.Cicd.ArgoCd.Expose.Path "/" ) }}
+        server.rootpath: '{{ .Modules.Cicd.ArgoCd.Expose.Path }}'
+        {{- end }}
 
       secret:
         argocdServerAdminPassword: {{ .Modules.Cicd.ArgoCd.AdminPassword }}

internal/resources/templates/helm-apps/releases/observability/observability.yml.tmpl

@@ -209,6 +209,7 @@
       enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Visualization.Grafana.Enabled }}
       serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
       domain: &grafanaDomain {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
+      path: {{ .Modules.Observability.Visualization.Grafana.Expose.Path }}
       {{- if eq .Modules.Observability.Visualization.Grafana.Expose.Type "NodePort" }}
       serviceNodePort: {{ .Modules.Observability.Visualization.Grafana.Expose.NodePortHttp }}
       {{- end }}
@@ -225,7 +226,10 @@
       config:
         server: |
           enable_gzip = true
-          root_url = {{ if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
+          root_url = {{ if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}{{ .Modules.Observability.Visualization.Grafana.Expose.Path }}
+          {{- if not (eq .Modules.Observability.Visualization.Grafana.Expose.Path  "/") }}
+          serve_from_sub_path = true
+          {{- end }}
 
         security: |
           admin_user = admin

internal/resources/templates/helm-apps/releases/registry/harbor.yml.tmpl

@@ -41,7 +41,7 @@
             port: 443
             nodePort: {{ .Modules.Registry.Expose.NodePortHttps }}
 
-    externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain  }}
+    externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain  }}{{ if not (eq  .Modules.Registry.Expose.Path "/") }}{{ .Modules.Registry.Expose.Path }}{{ end }}
     persistence:
       resourcePolicy: "keep"
       persistentVolumeClaim:

internal/resources/templates/helm-apps/releases/secrets-storage/vault.yml.tmpl

@@ -710,6 +710,7 @@
     ui:
       enabled: true
       domain: {{ .Modules.SecretsStorage.Expose.Domain }}
+      path: {{ .Modules.SecretsStorage.Expose.Path }}
       publishNotReadyAddresses: true
       # The service should only contain selectors for active Vault pod
       activeVaultPodOnly: false
@@ -785,7 +786,11 @@
 
       pod:
         annotations: {}
-        tolerations: []
+        tolerations:
+          - key: node-role.kubernetes.io/master
+            effect: NoSchedule
+          - key: node-role.kubernetes.io/control-plane
+            effect: NoSchedule
         nodeSelector: {}
         affinity: {}
         extraLabels: {}

internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl

@@ -154,7 +154,7 @@ cert_manager_dns_config:
     - "8.8.4.4"
 
 # MetalLB deployment
-{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Install }}
+{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Enabled }}
 metallb_enabled: true
 {{- else }}
 metallb_enabled: false

internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl

@@ -126,7 +126,7 @@ kube_proxy_mode: ipvs
 
 # configure arp_ignore and arp_announce to avoid answering ARP queries from kube-ipvs0 interface
 # must be set to true for MetalLB, kube-vip(ARP enabled) to work
-{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Install }}
+{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Enabled }}
 kube_proxy_strict_arp: true
 {{- else }}
 kube_proxy_strict_arp: false

kubespray/inventory/group_vars/k8s_cluster/addons.yml

@@ -2895,7 +2895,251 @@ releases:
     chart_ref: kube-forge/secrets-store-csi-driver
     chart_version: 1.4.3
     release_state: "present"
+    values:
+      linux:
+        enabled: true
+        image:
+          repository: registry.k8s.io/csi-secrets-store/driver
+          tag: v1.4.3
+          #digest: sha256:
+          pullPolicy: IfNotPresent
   
+        crds:
+          enabled: true
+          image:
+            repository: registry.k8s.io/csi-secrets-store/driver-crds
+            tag: v1.4.3
+            pullPolicy: IfNotPresent
+          ## Optionally override resource limits for crd hooks(jobs)
+          resources: {}
+            # requests:
+            #   cpu: "100m"
+            #   memory: "128Mi"
+            # limits:
+            #   cpu: "500m"
+            #   memory: "512Mi"
+          annotations: {}
+          podLabels: {}
+  
+        ## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
+        affinity:
+          nodeAffinity:
+            requiredDuringSchedulingIgnoredDuringExecution:
+              nodeSelectorTerms:
+                - matchExpressions:
+                    - key: type
+                      operator: NotIn
+                      values:
+                        - virtual-kubelet
+  
+        driver:
+          resources:
+            limits:
+              cpu: 200m
+              memory: 200Mi
+            requests:
+              cpu: 50m
+              memory: 100Mi
+  
+        registrarImage:
+          repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
+          tag: v2.10.0
+          #digest: sha256:
+          pullPolicy: IfNotPresent
+  
+        registrar:
+          resources:
+            limits:
+              cpu: 100m
+              memory: 100Mi
+            requests:
+              cpu: 10m
+              memory: 20Mi
+          logVerbosity: 5
+  
+        livenessProbeImage:
+          repository: registry.k8s.io/sig-storage/livenessprobe
+          tag: v2.12.0
+          #digest: sha256:
+          pullPolicy: IfNotPresent
+  
+        livenessProbe:
+          resources:
+            limits:
+              cpu: 100m
+              memory: 100Mi
+            requests:
+              cpu: 10m
+              memory: 20Mi
+  
+        updateStrategy:
+          type: RollingUpdate
+          rollingUpdate:
+            maxUnavailable: 1
+  
+        kubeletRootDir: /var/lib/kubelet
+        providersDir: /var/run/secrets-store-csi-providers
+        additionalProvidersDirs:
+          - /etc/kubernetes/secrets-store-csi-providers
+        nodeSelector: {}
+        # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
+        # An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
+        tolerations:
+          - operator: "Exists"
+        metricsAddr: ":8095"
+        env: []
+        priorityClassName: ""
+        daemonsetAnnotations: {}
+        podAnnotations: {}
+        podLabels: {}
+  
+        # volumes is a list of volumes made available to secrets store csi driver.
+        volumes: null
+        #   - name: foo
+        #     emptyDir: {}
+  
+        # volumeMounts is a list of volumeMounts for secrets store csi driver.
+        volumeMounts: null
+        #   - name: foo
+        #     mountPath: /bar
+        #     readOnly: true
+  
+      windows:
+        enabled: false
+        image:
+          repository: registry.k8s.io/csi-secrets-store/driver
+          tag: v1.4.3
+          #digest: sha256:
+          pullPolicy: IfNotPresent
+  
+        ## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
+        affinity:
+          nodeAffinity:
+            requiredDuringSchedulingIgnoredDuringExecution:
+              nodeSelectorTerms:
+                - matchExpressions:
+                    - key: type
+                      operator: NotIn
+                      values:
+                        - virtual-kubelet
+  
+        driver:
+          resources:
+            limits:
+              cpu: 400m
+              memory: 400Mi
+            requests:
+              cpu: 100m
+              memory: 100Mi
+  
+        registrarImage:
+          repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
+          tag: v2.10.0
+          #digest: sha256:
+          pullPolicy: IfNotPresent
+  
+        registrar:
+          resources:
+            limits:
+              cpu: 200m
+              memory: 200Mi
+            requests:
+              cpu: 100m
+              memory: 100Mi
+          logVerbosity: 5
+  
+        livenessProbeImage:
+          repository: registry.k8s.io/sig-storage/livenessprobe
+          tag: v2.12.0
+          #digest: sha256:
+          pullPolicy: IfNotPresent
+  
+        livenessProbe:
+          resources:
+            limits:
+              cpu: 200m
+              memory: 200Mi
+            requests:
+              cpu: 100m
+              memory: 100Mi
+  
+        updateStrategy:
+          type: RollingUpdate
+          rollingUpdate:
+            maxUnavailable: 1
+  
+        kubeletRootDir: C:\var\lib\kubelet
+        providersDir: C:\\k\\secrets-store-csi-providers
+        additionalProvidersDirs:
+        nodeSelector: {}
+        # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
+        # An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
+        tolerations:
+          - operator: "Exists"
+        metricsAddr: ":8095"
+        env: []
+        priorityClassName: ""
+        daemonsetAnnotations: {}
+        podAnnotations: {}
+        podLabels: {}
+  
+        # volumes is a list of volumes made available to secrets store csi driver.
+        volumes: null
+        #   - name: foo
+        #     emptyDir: {}
+  
+        # volumeMounts is a list of volumeMounts for secrets store csi driver.
+        volumeMounts: null
+        #   - name: foo
+        #     mountPath: /bar
+        #     readOnly: true
+  
+      # log level. Uses V logs (klog)
+      logVerbosity: 0
+  
+      # logging format JSON
+      logFormatJSON: false
+  
+      livenessProbe:
+        port: 9808
+        logLevel: 2
+  
+      ## Maximum size in bytes of gRPC response from plugins
+      maxCallRecvMsgSize: 4194304
+  
+      ## Install Default RBAC roles and bindings
+      rbac:
+        install: true
+        pspEnabled: false
+  
+      ## Install RBAC roles and bindings required for K8S Secrets syncing if true
+      syncSecret:
+        enabled: false
+  
+      ## Enable secret rotation feature [alpha]
+      enableSecretRotation: false
+  
+      ## Secret rotation poll interval duration
+      rotationPollInterval:
+  
+      ## Provider HealthCheck
+      providerHealthCheck: false
+  
+      ## Provider HealthCheck interval
+      providerHealthCheckInterval: 2m
+  
+      imagePullSecrets: []
+  
+      ## This allows CSI drivers to impersonate the pods that they mount the volumes for.
+      # refer to https://kubernetes-csi.github.io/docs/token-requests.html for more details.
+      # Supported only for Kubernetes v1.20+
+      tokenRequests: []
+      # - audience: aud1
+      # - audience: aud2
+  
+      # -- Labels to apply to all resources
+      commonLabels: {}
+      # team_name: dev
   - name: fluent-operator
     namespace: observability
     create_namespace: true
@@ -3793,6 +4037,7 @@ releases:
         enabled: true
         serviceMonitor: true
         domain: &grafanaDomain grafana.disk.lt.t1.cloud
+        path: /
         image:
           repository: grafana/grafana
           tag: 10.4.1
@@ -3806,7 +4051,7 @@ releases:
         config:
           server: |
             enable_gzip = true
-            root_url = https://grafana.disk.lt.t1.cloud
+            root_url = https://grafana.disk.lt.t1.cloud/
   
           security: |
             admin_user = admin
@@ -4355,7 +4600,7 @@ releases:
     namespace: cicd
     create_namespace: true
     chart_ref: kube-forge/argo-cd
-    chart_version: 5.46.7
+    chart_version: 6.7.10
     release_state: "present"
     values:
       crds:
@@ -4413,7 +4658,7 @@ releases:
           server.insecure: true
   
         secret:
-          argocdServerAdminPassword: $2a$10$N3yN5AWSH6e7MfcQUt7/NOJpXacdWK1vPRiZPbzsUsMWNqCy9G8l6
+          argocdServerAdminPassword: $2a$10$eb0YB2bJ/B9XvAOACyvWGOUMDfyOO.Jfej8DyA.7MhzzwhopgkVFq
   
         repositories:
           # add default helm-repository from harbor
@@ -4421,7 +4666,7 @@ releases:
   
         cm:
           create: true
-          url: "https://argocd.disk.lt.t1.cloud"
+          url: "https://cicd.disk.lt.t1.cloud"
   
           accounts.developer: login
           accounts.guest: login
@@ -5139,7 +5384,8 @@ releases:
     release_state: "present"
     values:
       services:
-        - domain: argocd.disk.lt.t1.cloud
+        - domain: cicd.disk.lt.t1.cloud
+          path: /
           address: argo-cd-argocd-server
           port: 80
           secretName: argo-cd-server-tls
@@ -5854,6 +6100,7 @@ releases:
       ui:
         enabled: true
         domain: vault.disk.lt.t1.cloud
+        path: /
         publishNotReadyAddresses: true
         # The service should only contain selectors for active Vault pod
         activeVaultPodOnly: false
@@ -5924,7 +6171,11 @@ releases:
   
         pod:
           annotations: {}
-          tolerations: []
+          tolerations:
+            - key: node-role.kubernetes.io/master
+              effect: NoSchedule
+            - key: node-role.kubernetes.io/control-plane
+              effect: NoSchedule
           nodeSelector: {}
           affinity: {}
           extraLabels: {}