diff --git a/kind/stacks/core/crossplane-compositions.yaml b/kind/stacks/core/crossplane-compositions.yaml new file mode 100644 index 0000000..86751bd --- /dev/null +++ b/kind/stacks/core/crossplane-compositions.yaml @@ -0,0 +1,23 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: crossplane-compositions + namespace: argocd + labels: + env: dev + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true + destination: + name: in-cluster + namespace: crossplane-system + source: + path: stacks/core/crossplane-compositions + repoURL: https://gitea.cnoe.localtest.me/giteaAdmin/edfbuilder-shoot.git + targetRevision: HEAD diff --git a/kind/stacks/core/crossplane-compositions/edfbuilder/cluster.yaml b/kind/stacks/core/crossplane-compositions/edfbuilder/cluster.yaml new file mode 100644 index 0000000..63db7b4 --- /dev/null +++ b/kind/stacks/core/crossplane-compositions/edfbuilder/cluster.yaml @@ -0,0 +1,6 @@ +apiVersion: edfbuilder.crossplane.io/v1alpha1 +kind: EDFBuilder +metadata: + name: kindcluster +spec: + repoURL: "https://github.com/argoproj/argocd-example-apps.git" diff --git a/kind/stacks/core/crossplane-compositions/edfbuilder/composition.yaml b/kind/stacks/core/crossplane-compositions/edfbuilder/composition.yaml new file mode 100644 index 0000000..ae12569 --- /dev/null +++ b/kind/stacks/core/crossplane-compositions/edfbuilder/composition.yaml @@ -0,0 +1,397 @@ +apiVersion: apiextensions.crossplane.io/v1 +kind: Composition +metadata: + name: edfbuilders.edfbuilder.crossplane.io +spec: + writeConnectionSecretsToNamespace: crossplane-system + compositeTypeRef: + apiVersion: edfbuilder.crossplane.io/v1alpha1 + kind: EDFBuilder + mode: Pipeline + pipeline: + - step: patch-and-transform + functionRef: + name: crossplane-contrib-function-patch-and-transform + input: + apiVersion: pt.fn.crossplane.io/v1beta1 + kind: Resources + resources: + + ### shell provider config + - name: provider-shell + base: + apiVersion: shell.crossplane.io/v1alpha1 + kind: ProviderConfig + spec: + credentials: + source: InjectedIdentity + patches: + - type: FromCompositeFieldPath + fromFieldPath: metadata.name + toFieldPath: metadata.name + readinessChecks: + - type: None + + ### bash-oneshot + - name: bash-oneshot + base: + apiVersion: provisioning.shell.crossplane.io/v1alpha1 + kind: Bash + metadata: + name: bash-oneshot + spec: + forProvider: + script: | + # setup + DOMAIN=cnoe.localtest.me + #CLUSTER_NAME=$(openssl rand -hex 8) + CLUSTER_NAME=shoot + mkdir -p /tmp/rundir + export HOME=/tmp/rundir + cd + + # get stacks folder + rm -Rf stacks &> /dev/null || true + git clone https://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/richardrobertreitz/stacks.git + + # workdir for template helm values files + rm -Rf work &> /dev/null || true + cp -r stacks/kind work + rm -Rf stacks + + # create namespaces + echo create namespaces + kubectl create namespace argo + kubectl create namespace argocd + kubectl create namespace gitea + kubectl create namespace ingress-nginx + + # create and upload self signed certs + echo create and upload self signed certs + mkdir -p tls + if [[ ! -f tls/$DOMAIN.key || ! -f tls/$DOMAIN.crt ]]; then + openssl req -x509 -newkey rsa:4096 -keyout tls/$DOMAIN.key -out tls/$DOMAIN.crt -sha256 -days 3650 -nodes -subj "/C=AB/ST=StateName/L=CityName/O=CompanyName/OU=CompanySectionName/CN=${DOMAIN}" -addext "subjectAltName=DNS:${DOMAIN},DNS:${DOMAIN}" + fi + if [[ ! -f tls/gitea.$DOMAIN.key || ! -f tls/gitea.$DOMAIN.crt ]]; then + openssl req -x509 -newkey rsa:4096 -keyout tls/gitea.$DOMAIN.key -out tls/gitea.$DOMAIN.crt -sha256 -days 3650 -nodes -subj "/C=AB/ST=StateName/L=CityName/O=CompanyName/OU=CompanySectionName/CN=gitea.${DOMAIN}" -addext "subjectAltName=DNS:gitea.${DOMAIN},DNS:gitea.${DOMAIN}" + fi + kubectl create secret tls -n argocd argocd-net-tls --key tls/$DOMAIN.key --cert tls/$DOMAIN.crt + kubectl create secret tls -n gitea forgejo-net-tls --key tls/gitea.$DOMAIN.key --cert tls/gitea.$DOMAIN.crt + + # add gitea certificate into argocd helm values + yq e -i ".configs.tls.certificates.\"gitea.$DOMAIN\" = load_str(\"tls/gitea.$DOMAIN.crt\")" work/stacks/core/argocd/values.yaml + + # create a random giteaAdmin password + echo create giteaAdmin password + kubectl create secret generic -n gitea gitea-credential --from-literal=username=giteaAdmin "--from-literal=password=$(openssl rand -base64 16)" + + # patch coredns + echo patch coredns + cat < /dev/null + git clone https://github.com/kubernetes/ingress-nginx + cd ingress-nginx + git checkout helm-chart-4.11.3 + cd .. + helm dependency update ./ingress-nginx/charts/ingress-nginx/ + helm dependency build ./ingress-nginx/charts/ingress-nginx/ + helm install -n ingress-nginx -f work/stacks/core/ingress-nginx/values.yaml ingress-nginx ./ingress-nginx/charts/ingress-nginx + rm -Rf ingress-nginx + + # wait for ingress + sleep 5 + kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller --timeout=90000s + + # install argocd + echo install argocd + rm -Rf argo-helm &> /dev/null + git clone https://github.com/argoproj/argo-helm + cd argo-helm + git checkout argo-cd-7.7.5 + cd .. + helm dependency update ./argo-helm/charts/argo-cd/ + helm dependency build ./argo-helm/charts/argo-cd/ + helm install -n argocd -f work/stacks/core/argocd/values.yaml argocd ./argo-helm/charts/argo-cd + rm -Rf argo-helm + + # install forgejo + echo install forgejo + rm -Rf forgejo-helm &> /dev/null + git clone https://code.forgejo.org/forgejo-helm/forgejo-helm.git + cd forgejo-helm + git checkout v10.1.1 + cd .. + helm dependency build ./forgejo-helm/ + helm install -n gitea -f work/stacks/core/forgejo/values.yaml forgejo ./forgejo-helm + rm -Rf forgejo-helm + + # wait for argocd + echo wait for argocd + HOST=$(kubectl get ingress -n argocd argocd-server -o yaml | yq -r .status.loadBalancer.ingress\[0\].hostname) + while [[ "$HOST" == "null" ]] + do + sleep 1 + HOST=$(kubectl get ingress -n argocd argocd-server -o yaml | yq -r .status.loadBalancer.ingress\[0\].hostname) + done + + # wait for forgejo + echo wait for forgejo + HOST=$(kubectl get ingress -n gitea forgejo -o yaml | yq -r .status.loadBalancer.ingress\[0\].hostname) + while [[ "$HOST" == "null" ]] + do + sleep 1 + HOST=$(kubectl get ingress -n gitea forgejo -o yaml | yq -r .status.loadBalancer.ingress\[0\].hostname) + done + until curl -k --output /dev/null --silent --head --fail https://gitea.${DOMAIN}; do + sleep 1 + done + + # create the target git repository + GIT_USERNAME=giteaAdmin + GIT_PASSWORD=$(kubectl get secret -n gitea gitea-credential --output jsonpath="{.data.password}" | base64 --decode) + GIT_TOKEN=$(curl -sk -H "Content-Type: application/json" -d '{"name":"idpbuilder","scopes":["read:user","write:user","read:repository","write:repository","read:admin","write:admin"]}' -u $GIT_USERNAME:$GIT_PASSWORD https://gitea.$DOMAIN/api/v1/users/$GIT_USERNAME/tokens | jq -r .sha1) + curl -ks -X POST -H 'Content-Type: application/json' -d "{\"name\":\"edfbuilder-$CLUSTER_NAME\"}" "https://gitea.$DOMAIN/api/v1/user/repos?token=$GIT_TOKEN" + + # create and apply a forgejo runner token + FORGEJO_RUNNER_TOKEN="$(curl -ks -H 'Content-Type: application/json' "https://gitea.$DOMAIN/api/v1/admin/runners/registration-token?token=$GIT_TOKEN" | jq -r .token)" + kubectl create secret generic -n gitea forgejo-runner-token "--from-literal=token=$FORGEJO_RUNNER_TOKEN" + + echo repo created + git config --global user.email "bot@undefined.com" + git config --global user.name "Bot" + + # upload templated deployment to git repository + cd work/ + git init + git checkout -b main + git add -A + git commit -m "initial commit" + git remote add origin https://$GIT_USERNAME:${GIT_TOKEN}@gitea.$DOMAIN/giteaAdmin/edfbuilder-$CLUSTER_NAME.git + GIT_SSL_NO_VERIFY=true git push -u origin main + cd .. + + # upload forgejo docker registry credentials for use in argo-workflows + cat <