Have crossplane compositions be managed by ArgoCD
This commit is contained in:
parent
714d59513c
commit
bab8b3091a
4 changed files with 456 additions and 0 deletions
23
kind/stacks/core/crossplane-compositions.yaml
Normal file
23
kind/stacks/core/crossplane-compositions.yaml
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: crossplane-compositions
|
||||
namespace: argocd
|
||||
labels:
|
||||
env: dev
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
project: default
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
destination:
|
||||
name: in-cluster
|
||||
namespace: crossplane-system
|
||||
source:
|
||||
path: stacks/core/crossplane-compositions
|
||||
repoURL: https://gitea.cnoe.localtest.me/giteaAdmin/edfbuilder-shoot.git
|
||||
targetRevision: HEAD
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
apiVersion: edfbuilder.crossplane.io/v1alpha1
|
||||
kind: EDFBuilder
|
||||
metadata:
|
||||
name: kindcluster
|
||||
spec:
|
||||
repoURL: "https://github.com/argoproj/argocd-example-apps.git"
|
||||
|
|
@ -0,0 +1,397 @@
|
|||
apiVersion: apiextensions.crossplane.io/v1
|
||||
kind: Composition
|
||||
metadata:
|
||||
name: edfbuilders.edfbuilder.crossplane.io
|
||||
spec:
|
||||
writeConnectionSecretsToNamespace: crossplane-system
|
||||
compositeTypeRef:
|
||||
apiVersion: edfbuilder.crossplane.io/v1alpha1
|
||||
kind: EDFBuilder
|
||||
mode: Pipeline
|
||||
pipeline:
|
||||
- step: patch-and-transform
|
||||
functionRef:
|
||||
name: crossplane-contrib-function-patch-and-transform
|
||||
input:
|
||||
apiVersion: pt.fn.crossplane.io/v1beta1
|
||||
kind: Resources
|
||||
resources:
|
||||
|
||||
### shell provider config
|
||||
- name: provider-shell
|
||||
base:
|
||||
apiVersion: shell.crossplane.io/v1alpha1
|
||||
kind: ProviderConfig
|
||||
spec:
|
||||
credentials:
|
||||
source: InjectedIdentity
|
||||
patches:
|
||||
- type: FromCompositeFieldPath
|
||||
fromFieldPath: metadata.name
|
||||
toFieldPath: metadata.name
|
||||
readinessChecks:
|
||||
- type: None
|
||||
|
||||
### bash-oneshot
|
||||
- name: bash-oneshot
|
||||
base:
|
||||
apiVersion: provisioning.shell.crossplane.io/v1alpha1
|
||||
kind: Bash
|
||||
metadata:
|
||||
name: bash-oneshot
|
||||
spec:
|
||||
forProvider:
|
||||
script: |
|
||||
# setup
|
||||
DOMAIN=cnoe.localtest.me
|
||||
#CLUSTER_NAME=$(openssl rand -hex 8)
|
||||
CLUSTER_NAME=shoot
|
||||
mkdir -p /tmp/rundir
|
||||
export HOME=/tmp/rundir
|
||||
cd
|
||||
|
||||
# get stacks folder
|
||||
rm -Rf stacks &> /dev/null || true
|
||||
git clone https://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/richardrobertreitz/stacks.git
|
||||
|
||||
# workdir for template helm values files
|
||||
rm -Rf work &> /dev/null || true
|
||||
cp -r stacks/kind work
|
||||
rm -Rf stacks
|
||||
|
||||
# create namespaces
|
||||
echo create namespaces
|
||||
kubectl create namespace argo
|
||||
kubectl create namespace argocd
|
||||
kubectl create namespace gitea
|
||||
kubectl create namespace ingress-nginx
|
||||
|
||||
# create and upload self signed certs
|
||||
echo create and upload self signed certs
|
||||
mkdir -p tls
|
||||
if [[ ! -f tls/$DOMAIN.key || ! -f tls/$DOMAIN.crt ]]; then
|
||||
openssl req -x509 -newkey rsa:4096 -keyout tls/$DOMAIN.key -out tls/$DOMAIN.crt -sha256 -days 3650 -nodes -subj "/C=AB/ST=StateName/L=CityName/O=CompanyName/OU=CompanySectionName/CN=${DOMAIN}" -addext "subjectAltName=DNS:${DOMAIN},DNS:${DOMAIN}"
|
||||
fi
|
||||
if [[ ! -f tls/gitea.$DOMAIN.key || ! -f tls/gitea.$DOMAIN.crt ]]; then
|
||||
openssl req -x509 -newkey rsa:4096 -keyout tls/gitea.$DOMAIN.key -out tls/gitea.$DOMAIN.crt -sha256 -days 3650 -nodes -subj "/C=AB/ST=StateName/L=CityName/O=CompanyName/OU=CompanySectionName/CN=gitea.${DOMAIN}" -addext "subjectAltName=DNS:gitea.${DOMAIN},DNS:gitea.${DOMAIN}"
|
||||
fi
|
||||
kubectl create secret tls -n argocd argocd-net-tls --key tls/$DOMAIN.key --cert tls/$DOMAIN.crt
|
||||
kubectl create secret tls -n gitea forgejo-net-tls --key tls/gitea.$DOMAIN.key --cert tls/gitea.$DOMAIN.crt
|
||||
|
||||
# add gitea certificate into argocd helm values
|
||||
yq e -i ".configs.tls.certificates.\"gitea.$DOMAIN\" = load_str(\"tls/gitea.$DOMAIN.crt\")" work/stacks/core/argocd/values.yaml
|
||||
|
||||
# create a random giteaAdmin password
|
||||
echo create giteaAdmin password
|
||||
kubectl create secret generic -n gitea gitea-credential --from-literal=username=giteaAdmin "--from-literal=password=$(openssl rand -base64 16)"
|
||||
|
||||
# patch coredns
|
||||
echo patch coredns
|
||||
cat <<EOF | kubectl apply -f -
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: coredns-conf-custom
|
||||
namespace: kube-system
|
||||
data:
|
||||
custom.conf: |
|
||||
# insert custom rules here
|
||||
EOF
|
||||
cat <<EOF | kubectl apply -f -
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: coredns-conf-default
|
||||
namespace: kube-system
|
||||
data:
|
||||
default.conf: |
|
||||
# domain names resolves to ingress IP. e.g. gitea.cnoe.localtest.me becomes ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
||||
rewrite name exact gitea.cnoe.localtest.me ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
||||
rewrite name exact cnoe.localtest.me ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
||||
EOF
|
||||
cat <<EOF | kubectl apply -f -
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: coredns
|
||||
namespace: kube-system
|
||||
data:
|
||||
Corefile: |
|
||||
.:53 {
|
||||
errors
|
||||
health {
|
||||
lameduck 5s
|
||||
}
|
||||
ready
|
||||
|
||||
import ../coredns-configs/*.conf
|
||||
|
||||
kubernetes cluster.local in-addr.arpa ip6.arpa {
|
||||
pods insecure
|
||||
fallthrough in-addr.arpa ip6.arpa
|
||||
ttl 30
|
||||
}
|
||||
prometheus :9153
|
||||
forward . /etc/resolv.conf {
|
||||
max_concurrent 1000
|
||||
}
|
||||
cache 30
|
||||
loop
|
||||
reload
|
||||
loadbalance
|
||||
}
|
||||
EOF
|
||||
cat <<EOF | kubectl apply -f -
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kube-dns
|
||||
name: coredns
|
||||
namespace: kube-system
|
||||
spec:
|
||||
progressDeadlineSeconds: 600
|
||||
replicas: 2
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: kube-dns
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 1
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
labels:
|
||||
k8s-app: kube-dns
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: k8s-app
|
||||
operator: In
|
||||
values:
|
||||
- kube-dns
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 100
|
||||
containers:
|
||||
- args:
|
||||
- -conf
|
||||
- /etc/coredns/Corefile
|
||||
image: registry.k8s.io/coredns/coredns:v1.11.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 5
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 8080
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
name: coredns
|
||||
ports:
|
||||
- containerPort: 53
|
||||
name: dns
|
||||
protocol: UDP
|
||||
- containerPort: 53
|
||||
name: dns-tcp
|
||||
protocol: TCP
|
||||
- containerPort: 9153
|
||||
name: metrics
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: 8181
|
||||
scheme: HTTP
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
resources:
|
||||
limits:
|
||||
memory: 170Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 70Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
add:
|
||||
- NET_BIND_SERVICE
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/coredns
|
||||
name: config-volume
|
||||
readOnly: true
|
||||
- mountPath: /etc/coredns-configs
|
||||
name: custom-configs
|
||||
readOnly: true
|
||||
dnsPolicy: Default
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
priorityClassName: system-cluster-critical
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
securityContext: {}
|
||||
serviceAccount: coredns
|
||||
serviceAccountName: coredns
|
||||
terminationGracePeriodSeconds: 30
|
||||
tolerations:
|
||||
- key: CriticalAddonsOnly
|
||||
operator: Exists
|
||||
- effect: NoSchedule
|
||||
key: node-role.kubernetes.io/control-plane
|
||||
volumes:
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: Corefile
|
||||
path: Corefile
|
||||
name: coredns
|
||||
name: config-volume
|
||||
- name: custom-configs
|
||||
projected:
|
||||
sources:
|
||||
- configMap:
|
||||
name: coredns-conf-custom
|
||||
- configMap:
|
||||
name: coredns-conf-default
|
||||
EOF
|
||||
kubectl rollout restart deployment/coredns -n kube-system
|
||||
kubectl rollout status deployment/coredns -n kube-system --timeout=90000s
|
||||
|
||||
# install ingress-nginx
|
||||
echo install ingress-nginx
|
||||
rm -Rf ingress-nginx &> /dev/null
|
||||
git clone https://github.com/kubernetes/ingress-nginx
|
||||
cd ingress-nginx
|
||||
git checkout helm-chart-4.11.3
|
||||
cd ..
|
||||
helm dependency update ./ingress-nginx/charts/ingress-nginx/
|
||||
helm dependency build ./ingress-nginx/charts/ingress-nginx/
|
||||
helm install -n ingress-nginx -f work/stacks/core/ingress-nginx/values.yaml ingress-nginx ./ingress-nginx/charts/ingress-nginx
|
||||
rm -Rf ingress-nginx
|
||||
|
||||
# wait for ingress
|
||||
sleep 5
|
||||
kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller --timeout=90000s
|
||||
|
||||
# install argocd
|
||||
echo install argocd
|
||||
rm -Rf argo-helm &> /dev/null
|
||||
git clone https://github.com/argoproj/argo-helm
|
||||
cd argo-helm
|
||||
git checkout argo-cd-7.7.5
|
||||
cd ..
|
||||
helm dependency update ./argo-helm/charts/argo-cd/
|
||||
helm dependency build ./argo-helm/charts/argo-cd/
|
||||
helm install -n argocd -f work/stacks/core/argocd/values.yaml argocd ./argo-helm/charts/argo-cd
|
||||
rm -Rf argo-helm
|
||||
|
||||
# install forgejo
|
||||
echo install forgejo
|
||||
rm -Rf forgejo-helm &> /dev/null
|
||||
git clone https://code.forgejo.org/forgejo-helm/forgejo-helm.git
|
||||
cd forgejo-helm
|
||||
git checkout v10.1.1
|
||||
cd ..
|
||||
helm dependency build ./forgejo-helm/
|
||||
helm install -n gitea -f work/stacks/core/forgejo/values.yaml forgejo ./forgejo-helm
|
||||
rm -Rf forgejo-helm
|
||||
|
||||
# wait for argocd
|
||||
echo wait for argocd
|
||||
HOST=$(kubectl get ingress -n argocd argocd-server -o yaml | yq -r .status.loadBalancer.ingress\[0\].hostname)
|
||||
while [[ "$HOST" == "null" ]]
|
||||
do
|
||||
sleep 1
|
||||
HOST=$(kubectl get ingress -n argocd argocd-server -o yaml | yq -r .status.loadBalancer.ingress\[0\].hostname)
|
||||
done
|
||||
|
||||
# wait for forgejo
|
||||
echo wait for forgejo
|
||||
HOST=$(kubectl get ingress -n gitea forgejo -o yaml | yq -r .status.loadBalancer.ingress\[0\].hostname)
|
||||
while [[ "$HOST" == "null" ]]
|
||||
do
|
||||
sleep 1
|
||||
HOST=$(kubectl get ingress -n gitea forgejo -o yaml | yq -r .status.loadBalancer.ingress\[0\].hostname)
|
||||
done
|
||||
until curl -k --output /dev/null --silent --head --fail https://gitea.${DOMAIN}; do
|
||||
sleep 1
|
||||
done
|
||||
|
||||
# create the target git repository
|
||||
GIT_USERNAME=giteaAdmin
|
||||
GIT_PASSWORD=$(kubectl get secret -n gitea gitea-credential --output jsonpath="{.data.password}" | base64 --decode)
|
||||
GIT_TOKEN=$(curl -sk -H "Content-Type: application/json" -d '{"name":"idpbuilder","scopes":["read:user","write:user","read:repository","write:repository","read:admin","write:admin"]}' -u $GIT_USERNAME:$GIT_PASSWORD https://gitea.$DOMAIN/api/v1/users/$GIT_USERNAME/tokens | jq -r .sha1)
|
||||
curl -ks -X POST -H 'Content-Type: application/json' -d "{\"name\":\"edfbuilder-$CLUSTER_NAME\"}" "https://gitea.$DOMAIN/api/v1/user/repos?token=$GIT_TOKEN"
|
||||
|
||||
# create and apply a forgejo runner token
|
||||
FORGEJO_RUNNER_TOKEN="$(curl -ks -H 'Content-Type: application/json' "https://gitea.$DOMAIN/api/v1/admin/runners/registration-token?token=$GIT_TOKEN" | jq -r .token)"
|
||||
kubectl create secret generic -n gitea forgejo-runner-token "--from-literal=token=$FORGEJO_RUNNER_TOKEN"
|
||||
|
||||
echo repo created
|
||||
git config --global user.email "bot@undefined.com"
|
||||
git config --global user.name "Bot"
|
||||
|
||||
# upload templated deployment to git repository
|
||||
cd work/
|
||||
git init
|
||||
git checkout -b main
|
||||
git add -A
|
||||
git commit -m "initial commit"
|
||||
git remote add origin https://$GIT_USERNAME:${GIT_TOKEN}@gitea.$DOMAIN/giteaAdmin/edfbuilder-$CLUSTER_NAME.git
|
||||
GIT_SSL_NO_VERIFY=true git push -u origin main
|
||||
cd ..
|
||||
|
||||
# upload forgejo docker registry credentials for use in argo-workflows
|
||||
cat <<EOF | kubectl create secret generic -n argo my-docker-secret --from-file=config.json=/dev/stdin
|
||||
{
|
||||
"auths": {
|
||||
"https://gitea.cnoe.localtest.me": {
|
||||
"auth": "$(echo -n giteaAdmin:$GIT_PASSWORD | base64)"
|
||||
}
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
argocd login --grpc-web-root-path argocd cnoe.localtest.me --insecure --username admin --password "$(kubectl get secret -n argocd argocd-initial-admin-secret --output jsonpath="{.data.password}" | base64 --decode)"
|
||||
|
||||
|
||||
# let argocd takeover core stack and install other stacks
|
||||
kubectl apply -f work/registry/core.yaml
|
||||
kubectl apply -f work/registry/ref-implementation.yaml
|
||||
|
||||
# remove templated deployment
|
||||
rm -Rf work
|
||||
|
||||
# core packages installed, print passwords
|
||||
echo done
|
||||
echo
|
||||
echo -n argocd admin password:\ ; kubectl get secret -n argocd argocd-initial-admin-secret --output jsonpath="{.data.password}" | base64 --decode; echo
|
||||
echo https://$DOMAIN/argocd
|
||||
echo
|
||||
echo forgejo $GIT_USERNAME password: $GIT_PASSWORD token: $GIT_TOKEN
|
||||
echo https://gitea.$DOMAIN
|
||||
echo
|
||||
echo execute ./get-passwords.sh to see all available passwords
|
||||
echo
|
||||
|
||||
# done
|
||||
exit 0
|
||||
patches:
|
||||
- type: FromCompositeFieldPath
|
||||
fromFieldPath: metadata.name
|
||||
toFieldPath: spec.providerConfigRef.name
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
apiVersion: apiextensions.crossplane.io/v1
|
||||
kind: CompositeResourceDefinition
|
||||
metadata:
|
||||
name: edfbuilders.edfbuilder.crossplane.io
|
||||
spec:
|
||||
connectionSecretKeys:
|
||||
- kubeconfig
|
||||
group: edfbuilder.crossplane.io
|
||||
names:
|
||||
kind: EDFBuilder
|
||||
listKind: EDFBuilderList
|
||||
plural: edfbuilders
|
||||
singular: edfbuilders
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
served: true
|
||||
referenceable: true
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: A EDFBuilder is a composite resource that represents a K8S Cluster with edfbuilder Installed
|
||||
type: object
|
||||
properties:
|
||||
spec:
|
||||
type: object
|
||||
properties:
|
||||
repoURL:
|
||||
type: string
|
||||
description: URL to ArgoCD stack of stacks repo
|
||||
required:
|
||||
- repoURL
|
||||
Loading…
Reference in a new issue