refactor(gitops): establish platform ownership boundaries
This commit is contained in:
donghyeon-ka
@@ -0,0 +1,8 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- platform-addons.yaml
|
||||
- platform-services.yaml
|
||||
- systems.yaml
|
||||
- workloads.yaml
|
||||
@@ -0,0 +1,122 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ApplicationSet
|
||||
metadata:
|
||||
name: platform-addons
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "-5"
|
||||
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
|
||||
spec:
|
||||
goTemplate: true
|
||||
goTemplateOptions:
|
||||
- missingkey=error
|
||||
generators:
|
||||
- list:
|
||||
elements:
|
||||
- component: sealed-secrets
|
||||
cluster: dev-k3s
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: kube-system
|
||||
repoURL: https://bitnami.github.io/sealed-secrets
|
||||
chart: sealed-secrets
|
||||
# renovate: datasource=helm depName=sealed-secrets registryUrl=https://bitnami.github.io/sealed-secrets
|
||||
revision: 2.17.9
|
||||
autoSync: "true"
|
||||
helmValues: |
|
||||
fullnameOverride: sealed-secrets-controller
|
||||
keyrenewperiod: 720h
|
||||
image:
|
||||
# renovate: datasource=docker depName=bitnami/sealed-secrets-controller
|
||||
repository: bitnami/sealed-secrets-controller
|
||||
tag: "0.33.1@sha256:e7fad65c2d2f47e48d9ca17408ed56961bfa6a6dd74ccd4a1a214664156534bc"
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 256Mi
|
||||
- component: vault-agent-injector
|
||||
cluster: dev-k3s
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: vault
|
||||
repoURL: https://helm.releases.hashicorp.com
|
||||
chart: vault
|
||||
# renovate: datasource=helm depName=vault registryUrl=https://helm.releases.hashicorp.com
|
||||
revision: 0.32.0
|
||||
autoSync: "false"
|
||||
helmValues: |
|
||||
global:
|
||||
externalVaultAddr: http://vault.vault.svc.cluster.local:8200
|
||||
tlsDisable: true
|
||||
server:
|
||||
enabled: false
|
||||
injector:
|
||||
enabled: true
|
||||
authPath: auth/kubernetes
|
||||
image:
|
||||
# renovate: datasource=docker depName=hashicorp/vault-k8s
|
||||
repository: hashicorp/vault-k8s
|
||||
tag: "1.7.2@sha256:ae3d307658b72a1cf35dab9bdf92c995d45cdc7183af0516857714b5bd0ba84d"
|
||||
webhook:
|
||||
failurePolicy: Fail
|
||||
namespaceSelector:
|
||||
matchLabels:
|
||||
vault-injection: enabled
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 256Mi
|
||||
agentImage:
|
||||
# renovate: datasource=docker depName=hashicorp/vault
|
||||
repository: hashicorp/vault
|
||||
tag: "1.18.5@sha256:750bb37c1638fa194ab37053a81618c61bb0491ddec6fccac87c07a8e6cd8166"
|
||||
template:
|
||||
metadata:
|
||||
name: "{{ .component }}-{{ .cluster }}"
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
|
||||
project-gitops.io/auto-sync-gate: "{{ .autoSync }}"
|
||||
labels:
|
||||
project-gitops.io/cluster: "{{ .cluster }}"
|
||||
project-gitops.io/owner: platform
|
||||
spec:
|
||||
project: platform-addons
|
||||
source:
|
||||
repoURL: "{{ .repoURL }}"
|
||||
chart: "{{ .chart }}"
|
||||
targetRevision: "{{ .revision }}"
|
||||
helm:
|
||||
values: "{{ .helmValues }}"
|
||||
destination:
|
||||
server: "{{ .server }}"
|
||||
namespace: "{{ .namespace }}"
|
||||
syncPolicy:
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- Prune=confirm
|
||||
- PruneLast=true
|
||||
- FailOnSharedResource=true
|
||||
retry:
|
||||
limit: 5
|
||||
refresh: true
|
||||
backoff:
|
||||
duration: 5s
|
||||
factor: 2
|
||||
maxDuration: 3m
|
||||
revisionHistoryLimit: 5
|
||||
templatePatch: |
|
||||
{{- if eq .autoSync "true" }}
|
||||
spec:
|
||||
syncPolicy:
|
||||
automated:
|
||||
enabled: true
|
||||
prune: true
|
||||
selfHeal: true
|
||||
{{- end }}
|
||||
syncPolicy:
|
||||
applicationsSync: create-update
|
||||
preserveResourcesOnDeletion: true
|
||||
@@ -0,0 +1,64 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ApplicationSet
|
||||
metadata:
|
||||
name: platform-services
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "-5"
|
||||
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
|
||||
spec:
|
||||
goTemplate: true
|
||||
goTemplateOptions:
|
||||
- missingkey=error
|
||||
generators:
|
||||
- list:
|
||||
elements:
|
||||
- component: vault
|
||||
cluster: dev-k3s
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: vault
|
||||
path: clusters/dev-k3s/overlays/platform/vault
|
||||
autoSync: "true"
|
||||
template:
|
||||
metadata:
|
||||
name: "{{ .component }}-{{ .cluster }}"
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
|
||||
project-gitops.io/auto-sync-gate: "{{ .autoSync }}"
|
||||
labels:
|
||||
project-gitops.io/cluster: "{{ .cluster }}"
|
||||
project-gitops.io/owner: platform
|
||||
spec:
|
||||
project: platform-services
|
||||
source:
|
||||
repoURL: https://git.learn.hyeonworks.com/donghyeon.kang/project-gitops
|
||||
targetRevision: main
|
||||
path: "{{ .path }}"
|
||||
destination:
|
||||
server: "{{ .server }}"
|
||||
namespace: "{{ .namespace }}"
|
||||
syncPolicy:
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- PruneLast=true
|
||||
- FailOnSharedResource=true
|
||||
retry:
|
||||
limit: 5
|
||||
refresh: true
|
||||
backoff:
|
||||
duration: 5s
|
||||
factor: 2
|
||||
maxDuration: 3m
|
||||
revisionHistoryLimit: 5
|
||||
templatePatch: |
|
||||
{{- if eq .autoSync "true" }}
|
||||
spec:
|
||||
syncPolicy:
|
||||
automated:
|
||||
enabled: true
|
||||
prune: true
|
||||
selfHeal: true
|
||||
{{- end }}
|
||||
syncPolicy:
|
||||
applicationsSync: create-update
|
||||
preserveResourcesOnDeletion: true
|
||||
@@ -0,0 +1,64 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ApplicationSet
|
||||
metadata:
|
||||
name: systems
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "-5"
|
||||
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
|
||||
spec:
|
||||
goTemplate: true
|
||||
goTemplateOptions:
|
||||
- missingkey=error
|
||||
generators:
|
||||
- list:
|
||||
elements:
|
||||
- component: auth-system
|
||||
cluster: dev-k3s
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: auth-system-dev
|
||||
path: clusters/dev-k3s/overlays/systems/auth-system
|
||||
autoSync: "false"
|
||||
template:
|
||||
metadata:
|
||||
name: "{{ .component }}-{{ .cluster }}"
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
|
||||
project-gitops.io/auto-sync-gate: "{{ .autoSync }}"
|
||||
labels:
|
||||
project-gitops.io/cluster: "{{ .cluster }}"
|
||||
project-gitops.io/owner: systems
|
||||
spec:
|
||||
project: systems
|
||||
source:
|
||||
repoURL: https://git.learn.hyeonworks.com/donghyeon.kang/project-gitops
|
||||
targetRevision: main
|
||||
path: "{{ .path }}"
|
||||
destination:
|
||||
server: "{{ .server }}"
|
||||
namespace: "{{ .namespace }}"
|
||||
syncPolicy:
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- PruneLast=true
|
||||
- FailOnSharedResource=true
|
||||
retry:
|
||||
limit: 5
|
||||
refresh: true
|
||||
backoff:
|
||||
duration: 5s
|
||||
factor: 2
|
||||
maxDuration: 3m
|
||||
revisionHistoryLimit: 5
|
||||
templatePatch: |
|
||||
{{- if eq .autoSync "true" }}
|
||||
spec:
|
||||
syncPolicy:
|
||||
automated:
|
||||
enabled: true
|
||||
prune: true
|
||||
selfHeal: true
|
||||
{{- end }}
|
||||
syncPolicy:
|
||||
applicationsSync: create-update
|
||||
preserveResourcesOnDeletion: true
|
||||
@@ -0,0 +1,70 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ApplicationSet
|
||||
metadata:
|
||||
name: workloads
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "-5"
|
||||
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
|
||||
spec:
|
||||
goTemplate: true
|
||||
goTemplateOptions:
|
||||
- missingkey=error
|
||||
generators:
|
||||
- list:
|
||||
elements:
|
||||
- component: auth-server
|
||||
cluster: dev-k3s
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: auth-dev
|
||||
path: clusters/dev-k3s/overlays/workloads/auth-server
|
||||
autoSync: "false"
|
||||
- component: api-server
|
||||
cluster: dev-k3s
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: api-dev
|
||||
path: clusters/dev-k3s/overlays/workloads/api-server
|
||||
autoSync: "false"
|
||||
template:
|
||||
metadata:
|
||||
name: "{{ .component }}-{{ .cluster }}"
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
|
||||
project-gitops.io/auto-sync-gate: "{{ .autoSync }}"
|
||||
labels:
|
||||
project-gitops.io/cluster: "{{ .cluster }}"
|
||||
project-gitops.io/owner: workloads
|
||||
spec:
|
||||
project: workloads
|
||||
source:
|
||||
repoURL: https://git.learn.hyeonworks.com/donghyeon.kang/project-gitops
|
||||
targetRevision: main
|
||||
path: "{{ .path }}"
|
||||
destination:
|
||||
server: "{{ .server }}"
|
||||
namespace: "{{ .namespace }}"
|
||||
syncPolicy:
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- PruneLast=true
|
||||
- FailOnSharedResource=true
|
||||
retry:
|
||||
limit: 5
|
||||
refresh: true
|
||||
backoff:
|
||||
duration: 5s
|
||||
factor: 2
|
||||
maxDuration: 3m
|
||||
revisionHistoryLimit: 5
|
||||
templatePatch: |
|
||||
{{- if eq .autoSync "true" }}
|
||||
spec:
|
||||
syncPolicy:
|
||||
automated:
|
||||
enabled: true
|
||||
prune: true
|
||||
selfHeal: true
|
||||
{{- end }}
|
||||
syncPolicy:
|
||||
applicationsSync: create-update
|
||||
preserveResourcesOnDeletion: true
|
||||
@@ -0,0 +1,6 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- projects
|
||||
- application-sets
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- platform-addons.yaml
|
||||
- platform-services.yaml
|
||||
- systems.yaml
|
||||
- workloads.yaml
|
||||
@@ -0,0 +1,50 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: AppProject
|
||||
metadata:
|
||||
name: platform-addons
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "-10"
|
||||
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
description: Cluster-scoped controllers installed from approved Helm repositories
|
||||
sourceRepos:
|
||||
- https://bitnami.github.io/sealed-secrets
|
||||
- https://helm.releases.hashicorp.com
|
||||
destinations:
|
||||
- namespace: kube-system
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: vault
|
||||
server: https://kubernetes.default.svc
|
||||
clusterResourceWhitelist:
|
||||
- group: ""
|
||||
kind: Namespace
|
||||
- group: apiextensions.k8s.io
|
||||
kind: CustomResourceDefinition
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRoleBinding
|
||||
- group: admissionregistration.k8s.io
|
||||
kind: MutatingWebhookConfiguration
|
||||
namespaceResourceWhitelist:
|
||||
- group: ""
|
||||
kind: ConfigMap
|
||||
- group: ""
|
||||
kind: Secret
|
||||
- group: ""
|
||||
kind: Service
|
||||
- group: ""
|
||||
kind: ServiceAccount
|
||||
- group: apps
|
||||
kind: Deployment
|
||||
- group: policy
|
||||
kind: PodDisruptionBudget
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: RoleBinding
|
||||
orphanedResources:
|
||||
warn: true
|
||||
@@ -0,0 +1,37 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: AppProject
|
||||
metadata:
|
||||
name: platform-services
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "-10"
|
||||
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
description: Shared services owned by this standalone reference platform
|
||||
sourceRepos:
|
||||
- https://git.learn.hyeonworks.com/donghyeon.kang/project-gitops
|
||||
destinations:
|
||||
- namespace: vault
|
||||
server: https://kubernetes.default.svc
|
||||
clusterResourceWhitelist:
|
||||
- group: ""
|
||||
kind: Namespace
|
||||
- group: rbac.authorization.k8s.io
|
||||
kind: ClusterRoleBinding
|
||||
namespaceResourceWhitelist:
|
||||
- group: ""
|
||||
kind: ConfigMap
|
||||
- group: ""
|
||||
kind: PersistentVolumeClaim
|
||||
- group: ""
|
||||
kind: Service
|
||||
- group: ""
|
||||
kind: ServiceAccount
|
||||
- group: apps
|
||||
kind: Deployment
|
||||
- group: networking.k8s.io
|
||||
kind: NetworkPolicy
|
||||
orphanedResources:
|
||||
warn: true
|
||||
@@ -0,0 +1,39 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: AppProject
|
||||
metadata:
|
||||
name: systems
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "-10"
|
||||
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
description: Backing systems dedicated to an example product boundary
|
||||
sourceRepos:
|
||||
- https://git.learn.hyeonworks.com/donghyeon.kang/project-gitops
|
||||
destinations:
|
||||
- namespace: auth-system-dev
|
||||
server: https://kubernetes.default.svc
|
||||
clusterResourceWhitelist:
|
||||
- group: ""
|
||||
kind: Namespace
|
||||
namespaceResourceWhitelist:
|
||||
- group: ""
|
||||
kind: ConfigMap
|
||||
- group: ""
|
||||
kind: Service
|
||||
- group: ""
|
||||
kind: ServiceAccount
|
||||
- group: apps
|
||||
kind: Deployment
|
||||
- group: apps
|
||||
kind: StatefulSet
|
||||
- group: batch
|
||||
kind: Job
|
||||
- group: networking.k8s.io
|
||||
kind: Ingress
|
||||
- group: networking.k8s.io
|
||||
kind: NetworkPolicy
|
||||
orphanedResources:
|
||||
warn: true
|
||||
@@ -0,0 +1,41 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: AppProject
|
||||
metadata:
|
||||
name: workloads
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "-10"
|
||||
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
description: First-party application workloads
|
||||
sourceRepos:
|
||||
- https://git.learn.hyeonworks.com/donghyeon.kang/project-gitops
|
||||
destinations:
|
||||
- namespace: auth-dev
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: api-dev
|
||||
server: https://kubernetes.default.svc
|
||||
clusterResourceWhitelist:
|
||||
- group: ""
|
||||
kind: Namespace
|
||||
namespaceResourceWhitelist:
|
||||
- group: ""
|
||||
kind: ConfigMap
|
||||
- group: ""
|
||||
kind: Service
|
||||
- group: ""
|
||||
kind: ServiceAccount
|
||||
- group: bitnami.com
|
||||
kind: SealedSecret
|
||||
- group: apps
|
||||
kind: Deployment
|
||||
- group: batch
|
||||
kind: Job
|
||||
- group: networking.k8s.io
|
||||
kind: Ingress
|
||||
- group: networking.k8s.io
|
||||
kind: NetworkPolicy
|
||||
orphanedResources:
|
||||
warn: true
|
||||
Reference in New Issue
Block a user