gstykalin/kube-forge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add ability to specify paths for argocd and grafana (https://git.kvazaric.ru/gstykalin/kube-forge/-/issues/1)

Browse Source
This commit is contained in:
George Stykalin
2024-05-25 21:31:10 +03:00
parent 36d886d94a
commit f84c27e622
17 changed files with 534 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
README.md
View File

@@ -7,11 +7,12 @@
### Docker-образ
```shell
touch k8s-admin.conf
docker run -v $(pwd)/config.yaml:/application/config.yaml \
-v $(pwd)/id_rsa_bastion_ift:/root/.ssh/id_rsa \
-v $(pwd)/config:/root/.ssh/config \
-v $(pwd)/k8s-admin.conf:/application/k8s-admin.conf \
harbor.kvazaric.ru/kube-forge/kube-forge:1.0-71bd08d2 apply
-v type=bind,src=$(pwd)/k8s-admin.conf,dst=/application/k8s-admin.conf\
harbor.kvazaric.ru/kube-forge/kube-forge:1.1-36d886d9 apply
```
## С помощью исполняемого файла
@@ -20,6 +21,8 @@ docker run -v $(pwd)/config.yaml:/application/config.yaml \
- sshpass
А также установить Python-библиотеки из списка "requirements.txt"
```shell
./kube-forge -c config.yaml -d . apply
```

2
config.sample.yaml
View File

@@ -72,6 +72,7 @@ modules:
expose:
type: ingress # ingress or NodePort
domain: grafana.disk.lt.t1.cloud
# path: "/grafana"
tls:
enabled: true
@@ -81,6 +82,7 @@ modules:
expose:
type: ingress # ingress or NodePort
domain: argocd.disk.lt.t1.cloud
# path: "/cicd"
tls:
enabled: true
rollouts:

2
internal/config/modules_additional.go
View File

@@ -36,7 +36,7 @@ type Additional struct {
LoadBalancer struct {
Type string `yaml:"type" env-default:"metallb"`
Install bool `yaml:"install"`
Enabled bool `yaml:"enabled"`
} `yaml:"load_balancer"`
DockerSecrets struct {

3
internal/config/modules_cicd.go
View File

@@ -4,7 +4,7 @@ type Cicd struct {
Enabled bool `yaml:"enabled"`
ArgoCd struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/argo-cd"`
ChartVersion string `yaml:"chart_version" env-default:"5.46.7"`
ChartVersion string `yaml:"chart_version" env-default:"6.7.10"`
AdminPassword string
Ha struct {
Enabled bool `yaml:"enabled"`
@@ -13,6 +13,7 @@ type Cicd struct {
Expose struct {
Type string `yaml:"type"`
Domain string `yaml:"domain"`
Path string `yaml:"path" env-default:"/"`
NodePortHttp int `yaml:"node_port_http" env-default:"30005"`
NodePortHttps int `yaml:"node_port_https" env-default:"30006"`
Tls struct {

1
internal/config/modules_observability.go
View File

@@ -154,6 +154,7 @@ type Visualization struct {
Expose struct {
Type string `yaml:"type" env-default:"ingress"`
Domain string `yaml:"domain" env-default:""`
Path string `yaml:"path" env-default:"/"`
NodePortHttp int `yaml:"node_port_http" env-default:"30007"`
Tls struct {
Enabled bool `yaml:"enabled"`

1
internal/config/modules_registry.go
View File

@@ -10,6 +10,7 @@ type Registry struct {
Expose struct {
Type string `yaml:"type" env-default:"nodePort"`
Domain string `yaml:"domain" env-default:""`
Path string `yaml:"path" env-default:"/"`
NodePortHttp int `yaml:"node_port_http" env-default:"30002"`
NodePortHttps int `yaml:"node_port_https" env-default:"30003"`
} `yaml:"expose"`

1
internal/config/modules_secrets_storage.go
View File

@@ -11,6 +11,7 @@ type SecretsStorage struct {
Expose struct {
Type string `yaml:"type"`
Domain string `yaml:"domain"`
Path string `yaml:"path" env-default:"/"`
NodePort int `yaml:"node_port"`
Tls struct {
Enabled bool `yaml:"enabled"`

245
internal/resources/templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl
View File

@@ -7,3 +7,248 @@
{{- else }}
release_state: "absent"
{{- end }}
values:
linux:
enabled: true
image:
repository: registry.k8s.io/csi-secrets-store/driver
tag: v1.4.3
#digest: sha256:
pullPolicy: IfNotPresent
crds:
enabled: true
image:
repository: registry.k8s.io/csi-secrets-store/driver-crds
tag: v1.4.3
pullPolicy: IfNotPresent
## Optionally override resource limits for crd hooks(jobs)
resources: {}
# requests:
# cpu: "100m"
# memory: "128Mi"
# limits:
# cpu: "500m"
# memory: "512Mi"
annotations: {}
podLabels: {}
## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: type
operator: NotIn
values:
- virtual-kubelet
driver:
resources:
limits:
cpu: 200m
memory: 200Mi
requests:
cpu: 50m
memory: 100Mi
registrarImage:
repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
tag: v2.10.0
#digest: sha256:
pullPolicy: IfNotPresent
registrar:
resources:
limits:
cpu: 100m
memory: 100Mi
requests:
cpu: 10m
memory: 20Mi
logVerbosity: 5
livenessProbeImage:
repository: registry.k8s.io/sig-storage/livenessprobe
tag: v2.12.0
#digest: sha256:
pullPolicy: IfNotPresent
livenessProbe:
resources:
limits:
cpu: 100m
memory: 100Mi
requests:
cpu: 10m
memory: 20Mi
updateStrategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
kubeletRootDir: /var/lib/kubelet
providersDir: /var/run/secrets-store-csi-providers
additionalProvidersDirs:
- /etc/kubernetes/secrets-store-csi-providers
nodeSelector: {}
# ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
# An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
tolerations:
- operator: "Exists"
metricsAddr: ":8095"
env: []
priorityClassName: ""
daemonsetAnnotations: {}
podAnnotations: {}
podLabels: {}
# volumes is a list of volumes made available to secrets store csi driver.
volumes: null
# - name: foo
# emptyDir: {}
# volumeMounts is a list of volumeMounts for secrets store csi driver.
volumeMounts: null
# - name: foo
# mountPath: /bar
# readOnly: true
windows:
enabled: false
image:
repository: registry.k8s.io/csi-secrets-store/driver
tag: v1.4.3
#digest: sha256:
pullPolicy: IfNotPresent
## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: type
operator: NotIn
values:
- virtual-kubelet
driver:
resources:
limits:
cpu: 400m
memory: 400Mi
requests:
cpu: 100m
memory: 100Mi
registrarImage:
repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
tag: v2.10.0
#digest: sha256:
pullPolicy: IfNotPresent
registrar:
resources:
limits:
cpu: 200m
memory: 200Mi
requests:
cpu: 100m
memory: 100Mi
logVerbosity: 5
livenessProbeImage:
repository: registry.k8s.io/sig-storage/livenessprobe
tag: v2.12.0
#digest: sha256:
pullPolicy: IfNotPresent
livenessProbe:
resources:
limits:
cpu: 200m
memory: 200Mi
requests:
cpu: 100m
memory: 100Mi
updateStrategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
kubeletRootDir: C:\var\lib\kubelet
providersDir: C:\\k\\secrets-store-csi-providers
additionalProvidersDirs:
nodeSelector: {}
# ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
# An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
tolerations:
- operator: "Exists"
metricsAddr: ":8095"
env: []
priorityClassName: ""
daemonsetAnnotations: {}
podAnnotations: {}
podLabels: {}
# volumes is a list of volumes made available to secrets store csi driver.
volumes: null
# - name: foo
# emptyDir: {}
# volumeMounts is a list of volumeMounts for secrets store csi driver.
volumeMounts: null
# - name: foo
# mountPath: /bar
# readOnly: true
# log level. Uses V logs (klog)
logVerbosity: 0
# logging format JSON
logFormatJSON: false
livenessProbe:
port: 9808
logLevel: 2
## Maximum size in bytes of gRPC response from plugins
maxCallRecvMsgSize: 4194304
## Install Default RBAC roles and bindings
rbac:
install: true
pspEnabled: false
## Install RBAC roles and bindings required for K8S Secrets syncing if true
syncSecret:
enabled: false
## Enable secret rotation feature [alpha]
enableSecretRotation: false
## Secret rotation poll interval duration
rotationPollInterval:
## Provider HealthCheck
providerHealthCheck: false
## Provider HealthCheck interval
providerHealthCheckInterval: 2m
imagePullSecrets: []
## This allows CSI drivers to impersonate the pods that they mount the volumes for.
# refer to https://kubernetes-csi.github.io/docs/token-requests.html for more details.
# Supported only for Kubernetes v1.20+
tokenRequests: []
# - audience: aud1
# - audience: aud2
# -- Labels to apply to all resources
commonLabels: {}
# team_name: dev

0
internal/resources/templates/helm-apps/releases/authentication/keycloak.yml.tmpl Normal file
View File

1
internal/resources/templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl
View File

@@ -11,6 +11,7 @@
values:
services:
- domain: {{ .Modules.Cicd.ArgoCd.Expose.Domain }}
path: {{ .Modules.Cicd.ArgoCd.Expose.Path }}
address: argo-cd-argocd-server
port: 80
secretName: argo-cd-server-tls

3
internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl
View File

@@ -89,6 +89,9 @@
configs:
params:
server.insecure: true
{{- if not (eq .Modules.Cicd.ArgoCd.Expose.Path "/" ) }}
server.rootpath: '{{ .Modules.Cicd.ArgoCd.Expose.Path }}'
{{- end }}
secret:
argocdServerAdminPassword: {{ .Modules.Cicd.ArgoCd.AdminPassword }}

6
internal/resources/templates/helm-apps/releases/observability/observability.yml.tmpl
View File

@@ -209,6 +209,7 @@
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Visualization.Grafana.Enabled }}
serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
domain: &grafanaDomain {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
path: {{ .Modules.Observability.Visualization.Grafana.Expose.Path }}
{{- if eq .Modules.Observability.Visualization.Grafana.Expose.Type "NodePort" }}
serviceNodePort: {{ .Modules.Observability.Visualization.Grafana.Expose.NodePortHttp }}
{{- end }}
@@ -225,7 +226,10 @@
config:
server: |
enable_gzip = true
root_url = {{ if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
root_url = {{ if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}{{ .Modules.Observability.Visualization.Grafana.Expose.Path }}
{{- if not (eq .Modules.Observability.Visualization.Grafana.Expose.Path "/") }}
serve_from_sub_path = true
{{- end }}
security: |
admin_user = admin

2
internal/resources/templates/helm-apps/releases/registry/harbor.yml.tmpl
View File

@@ -41,7 +41,7 @@
port: 443
nodePort: {{ .Modules.Registry.Expose.NodePortHttps }}
externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain }}
externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain }}{{ if not (eq .Modules.Registry.Expose.Path "/") }}{{ .Modules.Registry.Expose.Path }}{{ end }}
persistence:
resourcePolicy: "keep"
persistentVolumeClaim:

7
internal/resources/templates/helm-apps/releases/secrets-storage/vault.yml.tmpl
View File

@@ -710,6 +710,7 @@
ui:
enabled: true
domain: {{ .Modules.SecretsStorage.Expose.Domain }}
path: {{ .Modules.SecretsStorage.Expose.Path }}
publishNotReadyAddresses: true
# The service should only contain selectors for active Vault pod
activeVaultPodOnly: false
@@ -785,7 +786,11 @@
pod:
annotations: {}
tolerations: []
tolerations:
- key: node-role.kubernetes.io/master
effect: NoSchedule
- key: node-role.kubernetes.io/control-plane
effect: NoSchedule
nodeSelector: {}
affinity: {}
extraLabels: {}

2
internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl
View File

@@ -154,7 +154,7 @@ cert_manager_dns_config:
- "8.8.4.4"
# MetalLB deployment
{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Install }}
{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Enabled }}
metallb_enabled: true
{{- else }}
metallb_enabled: false

2
internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl
View File

@@ -126,7 +126,7 @@ kube_proxy_mode: ipvs
# configure arp_ignore and arp_announce to avoid answering ARP queries from kube-ipvs0 interface
# must be set to true for MetalLB, kube-vip(ARP enabled) to work
{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Install }}
{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Enabled }}
kube_proxy_strict_arp: true
{{- else }}
kube_proxy_strict_arp: false

263
kubespray/inventory/group_vars/k8s_cluster/addons.yml
View File

@@ -2895,7 +2895,251 @@ releases:
chart_ref: kube-forge/secrets-store-csi-driver
chart_version: 1.4.3
release_state: "present"
values:
linux:
enabled: true
image:
repository: registry.k8s.io/csi-secrets-store/driver
tag: v1.4.3
#digest: sha256:
pullPolicy: IfNotPresent
crds:
enabled: true
image:
repository: registry.k8s.io/csi-secrets-store/driver-crds
tag: v1.4.3
pullPolicy: IfNotPresent
## Optionally override resource limits for crd hooks(jobs)
resources: {}
# requests:
# cpu: "100m"
# memory: "128Mi"
# limits:
# cpu: "500m"
# memory: "512Mi"
annotations: {}
podLabels: {}
## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: type
operator: NotIn
values:
- virtual-kubelet
driver:
resources:
limits:
cpu: 200m
memory: 200Mi
requests:
cpu: 50m
memory: 100Mi
registrarImage:
repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
tag: v2.10.0
#digest: sha256:
pullPolicy: IfNotPresent
registrar:
resources:
limits:
cpu: 100m
memory: 100Mi
requests:
cpu: 10m
memory: 20Mi
logVerbosity: 5
livenessProbeImage:
repository: registry.k8s.io/sig-storage/livenessprobe
tag: v2.12.0
#digest: sha256:
pullPolicy: IfNotPresent
livenessProbe:
resources:
limits:
cpu: 100m
memory: 100Mi
requests:
cpu: 10m
memory: 20Mi
updateStrategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
kubeletRootDir: /var/lib/kubelet
providersDir: /var/run/secrets-store-csi-providers
additionalProvidersDirs:
- /etc/kubernetes/secrets-store-csi-providers
nodeSelector: {}
# ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
# An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
tolerations:
- operator: "Exists"
metricsAddr: ":8095"
env: []
priorityClassName: ""
daemonsetAnnotations: {}
podAnnotations: {}
podLabels: {}
# volumes is a list of volumes made available to secrets store csi driver.
volumes: null
# - name: foo
# emptyDir: {}
# volumeMounts is a list of volumeMounts for secrets store csi driver.
volumeMounts: null
# - name: foo
# mountPath: /bar
# readOnly: true
windows:
enabled: false
image:
repository: registry.k8s.io/csi-secrets-store/driver
tag: v1.4.3
#digest: sha256:
pullPolicy: IfNotPresent
## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: type
operator: NotIn
values:
- virtual-kubelet
driver:
resources:
limits:
cpu: 400m
memory: 400Mi
requests:
cpu: 100m
memory: 100Mi
registrarImage:
repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
tag: v2.10.0
#digest: sha256:
pullPolicy: IfNotPresent
registrar:
resources:
limits:
cpu: 200m
memory: 200Mi
requests:
cpu: 100m
memory: 100Mi
logVerbosity: 5
livenessProbeImage:
repository: registry.k8s.io/sig-storage/livenessprobe
tag: v2.12.0
#digest: sha256:
pullPolicy: IfNotPresent
livenessProbe:
resources:
limits:
cpu: 200m
memory: 200Mi
requests:
cpu: 100m
memory: 100Mi
updateStrategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
kubeletRootDir: C:\var\lib\kubelet
providersDir: C:\\k\\secrets-store-csi-providers
additionalProvidersDirs:
nodeSelector: {}
# ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
# An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
tolerations:
- operator: "Exists"
metricsAddr: ":8095"
env: []
priorityClassName: ""
daemonsetAnnotations: {}
podAnnotations: {}
podLabels: {}
# volumes is a list of volumes made available to secrets store csi driver.
volumes: null
# - name: foo
# emptyDir: {}
# volumeMounts is a list of volumeMounts for secrets store csi driver.
volumeMounts: null
# - name: foo
# mountPath: /bar
# readOnly: true
# log level. Uses V logs (klog)
logVerbosity: 0
# logging format JSON
logFormatJSON: false
livenessProbe:
port: 9808
logLevel: 2
## Maximum size in bytes of gRPC response from plugins
maxCallRecvMsgSize: 4194304
## Install Default RBAC roles and bindings
rbac:
install: true
pspEnabled: false
## Install RBAC roles and bindings required for K8S Secrets syncing if true
syncSecret:
enabled: false
## Enable secret rotation feature [alpha]
enableSecretRotation: false
## Secret rotation poll interval duration
rotationPollInterval:
## Provider HealthCheck
providerHealthCheck: false
## Provider HealthCheck interval
providerHealthCheckInterval: 2m
imagePullSecrets: []
## This allows CSI drivers to impersonate the pods that they mount the volumes for.
# refer to https://kubernetes-csi.github.io/docs/token-requests.html for more details.
# Supported only for Kubernetes v1.20+
tokenRequests: []
# - audience: aud1
# - audience: aud2
# -- Labels to apply to all resources
commonLabels: {}
# team_name: dev
- name: fluent-operator
namespace: observability
create_namespace: true
@@ -3793,6 +4037,7 @@ releases:
enabled: true
serviceMonitor: true
domain: &grafanaDomain grafana.disk.lt.t1.cloud
path: /
image:
repository: grafana/grafana
tag: 10.4.1
@@ -3806,7 +4051,7 @@ releases:
config:
server: |
enable_gzip = true
root_url = https://grafana.disk.lt.t1.cloud
root_url = https://grafana.disk.lt.t1.cloud/
security: |
admin_user = admin
@@ -4355,7 +4600,7 @@ releases:
namespace: cicd
create_namespace: true
chart_ref: kube-forge/argo-cd
chart_version: 5.46.7
chart_version: 6.7.10
release_state: "present"
values:
crds:
@@ -4413,7 +4658,7 @@ releases:
server.insecure: true
secret:
argocdServerAdminPassword: $2a$10$N3yN5AWSH6e7MfcQUt7/NOJpXacdWK1vPRiZPbzsUsMWNqCy9G8l6
argocdServerAdminPassword: $2a$10$eb0YB2bJ/B9XvAOACyvWGOUMDfyOO.Jfej8DyA.7MhzzwhopgkVFq
repositories:
# add default helm-repository from harbor
@@ -4421,7 +4666,7 @@ releases:
cm:
create: true
url: "https://argocd.disk.lt.t1.cloud"
url: "https://cicd.disk.lt.t1.cloud"
accounts.developer: login
accounts.guest: login
@@ -5139,7 +5384,8 @@ releases:
release_state: "present"
values:
services:
- domain: argocd.disk.lt.t1.cloud
- domain: cicd.disk.lt.t1.cloud
path: /
address: argo-cd-argocd-server
port: 80
secretName: argo-cd-server-tls
@@ -5854,6 +6100,7 @@ releases:
ui:
enabled: true
domain: vault.disk.lt.t1.cloud
path: /
publishNotReadyAddresses: true
# The service should only contain selectors for active Vault pod
activeVaultPodOnly: false
@@ -5924,7 +6171,11 @@ releases:
pod:
annotations: {}
tolerations: []
tolerations:
- key: node-role.kubernetes.io/master
effect: NoSchedule
- key: node-role.kubernetes.io/control-plane
effect: NoSchedule
nodeSelector: {}
affinity: {}
extraLabels: {}