-
Notifications
You must be signed in to change notification settings - Fork 127
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: migrate GCP account and update cluster (#28)
* add gcp infra for remote-state and user access Signed-off-by: Alexandre Gaudreault <[email protected]> * add gke and networking Signed-off-by: Alexandre Gaudreault <[email protected]> * update cert-manager Signed-off-by: Alexandre Gaudreault <[email protected]> * update ingress to use ingressClassName Signed-off-by: Alexandre Gaudreault <[email protected]> * kustomize fix Signed-off-by: Alexandre Gaudreault <[email protected]> * add dns and external-dns Signed-off-by: Alexandre Gaudreault <[email protected]> * info logs Signed-off-by: Alexandre Gaudreault <[email protected]> * add external-dns to argo Signed-off-by: Alexandre Gaudreault <[email protected]> * fix Jenkins sync Signed-off-by: Alexandre Gaudreault <[email protected]> * update jenkins to v2 Signed-off-by: Alexandre Gaudreault <[email protected]> * update cert-manager resources Signed-off-by: Alexandre Gaudreault <[email protected]> * missing one Signed-off-by: Alexandre Gaudreault <[email protected]> * update prometheus Signed-off-by: Alexandre Gaudreault <[email protected]> * update upstream Signed-off-by: Alexandre Gaudreault <[email protected]> * fix prometheus sync crds Signed-off-by: Alexandre Gaudreault <[email protected]> * update istio Signed-off-by: Alexandre Gaudreault <[email protected]> * fix governor Signed-off-by: Alexandre Gaudreault <[email protected]> * fix cert-manager Signed-off-by: Alexandre Gaudreault <[email protected]> * update rollout Signed-off-by: Alexandre Gaudreault <[email protected]> * fix ingress and use less resources Signed-off-by: Alexandre Gaudreault <[email protected]> * remove Jenkins Signed-off-by: Alexandre Gaudreault <[email protected]> * update governor image Signed-off-by: Alexandre Gaudreault <[email protected]> * refactor argo-events Signed-off-by: Alexandre Gaudreault <[email protected]> * update dex to newer version Signed-off-by: Alexandre Gaudreault <[email protected]> * fix cert-manager wrong namespace Signed-off-by: Alexandre Gaudreault <[email protected]> * prometheus deployment doc Signed-off-by: Alexandre Gaudreault <[email protected]> * update issuer email Signed-off-by: Alexandre Gaudreault <[email protected]> * add dex config Signed-off-by: Alexandre Gaudreault <[email protected]> * dex docs Signed-off-by: Alexandre Gaudreault <[email protected]> * dns setup Signed-off-by: Alexandre Gaudreault <[email protected]> * fix image name for governor Signed-off-by: Alexandre Gaudreault <[email protected]> * add argocd auth secret Signed-off-by: Alexandre Gaudreault <[email protected]> * update argo base Signed-off-by: Alexandre Gaudreault <[email protected]> * revert secret in app Signed-off-by: Alexandre Gaudreault <[email protected]> * argocd rbac as code Signed-off-by: Alexandre Gaudreault <[email protected]> * fix argo dex config Signed-off-by: Alexandre Gaudreault <[email protected]> * add external-dns app Signed-off-by: Alexandre Gaudreault <[email protected]> * remove dns logging Signed-off-by: Alexandre Gaudreault <[email protected]> * add codeowners Signed-off-by: Alexandre Gaudreault <[email protected]> * add docs about workflow secrets Signed-off-by: Alexandre Gaudreault <[email protected]> * dex HA-er Signed-off-by: Alexandre Gaudreault <[email protected]> * add service account token for workflow Signed-off-by: Alexandre Gaudreault <[email protected]> * fix kustomize for workflow Signed-off-by: Alexandre Gaudreault <[email protected]> * dex would need a shared state to be HA Signed-off-by: Alexandre Gaudreault <[email protected]> * add missing default token for workflows rbac Signed-off-by: Alexandre Gaudreault <[email protected]> * typo Signed-off-by: Alexandre Gaudreault <[email protected]> * use another sa as default login Signed-off-by: Alexandre Gaudreault <[email protected]> * workflow: add real read-only role Signed-off-by: Alexandre Gaudreault <[email protected]> * split workflows in 2 folder to make it easier to follow Signed-off-by: Alexandre Gaudreault <[email protected]> * use proper namespace Signed-off-by: Alexandre Gaudreault <[email protected]> * fix Signed-off-by: Alexandre Gaudreault <[email protected]> * workflow split namespace Signed-off-by: Alexandre Gaudreault <[email protected]> * switch to clusterRole for multi-ns binding Signed-off-by: Alexandre Gaudreault <[email protected]> * move sa to playground ns Signed-off-by: Alexandre Gaudreault <[email protected]> * update binding Signed-off-by: Alexandre Gaudreault <[email protected]> * workflow token not necessary Signed-off-by: Alexandre Gaudreault <[email protected]> * move artifact config in ns Signed-off-by: Alexandre Gaudreault <[email protected]> * move auth to managed namespace... weird Signed-off-by: Alexandre Gaudreault <[email protected]> * move events to playground. does not seem to support split controller Signed-off-by: Alexandre Gaudreault <[email protected]> * manifest have namespace hardcoded Signed-off-by: Alexandre Gaudreault <[email protected]> * base apps Signed-off-by: Alexandre Gaudreault <[email protected]> * reorder Signed-off-by: Alexandre Gaudreault <[email protected]> * Update docs & code review Signed-off-by: Alexandre Gaudreault <[email protected]> --------- Signed-off-by: Alexandre Gaudreault <[email protected]>
- Loading branch information
1 parent
58b3c6d
commit f06dea5
Showing
143 changed files
with
43,216 additions
and
56,841 deletions.
There are no files selected for viewing
Validating CODEOWNERS rules …
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| # # Infrastructure | ||
| # /infrastructure/ @agaudreault @leoluz | ||
| # /argocd/overlays/production/argocd-rbac-cm.yaml @agaudreault @leoluz | ||
| # /external-dns/values.yaml @agaudreault @leoluz |
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| # Argo Workflows | ||
|
|
||
| ### Initial deployment | ||
|
|
||
| You currently have to create secrets manually | ||
|
|
||
| ``` | ||
| kubectl apply -n argo -f resources/argo-server-sso-secret.yaml | ||
| kubectl apply -n argo -f resources/argo-workflows-webhook-clients-secret.yaml | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| - op: replace | ||
| path: /kind | ||
| value: ClusterRole | ||
| - op: replace | ||
| path: /metadata/name | ||
| value: argo-workflows-argo-role |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| - op: replace | ||
| path: /roleRef/kind | ||
| value: ClusterRole | ||
| - op: replace | ||
| path: /roleRef/name | ||
| value: argo-workflows-argo-role |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,61 +1,6 @@ | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: Role | ||
| metadata: | ||
| name: argo-server-role | ||
| rules: | ||
| - apiGroups: | ||
| - '' | ||
| resources: | ||
| - configmaps | ||
| verbs: | ||
| - get | ||
| - watch | ||
| - list | ||
| - apiGroups: | ||
| - '' | ||
| resources: | ||
| - secrets | ||
| verbs: | ||
| - get | ||
| - create | ||
| - list | ||
| - watch | ||
| - apiGroups: | ||
| - '' | ||
| resources: | ||
| - pods | ||
| - pods/exec | ||
| - pods/log | ||
| verbs: | ||
| - get | ||
| - list | ||
| - watch | ||
| - apiGroups: | ||
| - '' | ||
| resources: | ||
| - events | ||
| verbs: | ||
| - patch | ||
| - watch | ||
| - apiGroups: | ||
| - '' | ||
| resources: | ||
| - serviceaccounts | ||
| verbs: | ||
| - get | ||
| - list | ||
| - watch | ||
| - apiGroups: | ||
| - argoproj.io | ||
| resources: | ||
| - eventsources | ||
| - sensors | ||
| - workflows | ||
| - workfloweventbindings | ||
| - workflowtemplates | ||
| - cronworkflows | ||
| - cronworkflows/finalizers | ||
| verbs: | ||
| - get | ||
| - list | ||
| - watch | ||
| - op: replace | ||
| path: /kind | ||
| value: ClusterRole | ||
| - op: replace | ||
| path: /metadata/name | ||
| value: argo-workflows-argo-server-role |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| - op: replace | ||
| path: /roleRef/kind | ||
| value: ClusterRole | ||
| - op: replace | ||
| path: /roleRef/name | ||
| value: argo-workflows-argo-server-role |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| name: workflow-controller | ||
| spec: | ||
| template: | ||
| spec: | ||
| containers: | ||
| - name: workflow-controller | ||
| args: | ||
| - --namespaced | ||
| - --managed-namespace | ||
| - workflow-playground |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: RoleBinding | ||
| metadata: | ||
| name: argo-server-binding | ||
| namespace: workflow-playground # Gives permission in the managed namespace | ||
| roleRef: | ||
| apiGroup: rbac.authorization.k8s.io | ||
| kind: ClusterRole | ||
| name: argo-workflows-argo-server-role | ||
| subjects: | ||
| - kind: ServiceAccount | ||
| name: argo-server | ||
| namespace: argo |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,16 +1,16 @@ | ||
| apiVersion: cert-manager.io/v1alpha2 | ||
| apiVersion: cert-manager.io/v1 | ||
| kind: Issuer | ||
| metadata: | ||
| name: argo-workflows-issuer | ||
| spec: | ||
| acme: | ||
| server: https://acme-v02.api.letsencrypt.org/directory | ||
| email: amatyushentsev@gmail.com | ||
| email: argoproj@gmail.com | ||
| privateKeySecretRef: | ||
| name: letsencrypt | ||
| solvers: | ||
| # An empty 'selector' means that this solver matches all domains | ||
| - selector: {} | ||
| http01: | ||
| ingress: | ||
| class: nginx | ||
| # An empty 'selector' means that this solver matches all domains | ||
| - selector: {} | ||
| http01: | ||
| ingress: | ||
| class: nginx |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: ClusterRole | ||
| metadata: | ||
| name: argo-workflows-read-only | ||
| rules: | ||
| - apiGroups: | ||
| - argoproj.io | ||
| resources: | ||
| - clusterworkflowtemplates | ||
| - clusteranalysistemplates | ||
| verbs: | ||
| - get | ||
| - list | ||
| - watch |
32 changes: 32 additions & 0 deletions
32
argo-workflows/resources/rbac/read-only-namespaced-clusterrole.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: ClusterRole | ||
| metadata: | ||
| name: argo-workflows-read-only-namespaced | ||
| rules: | ||
| - apiGroups: | ||
| - '' | ||
| resources: | ||
| - pods | ||
| - pods/log | ||
| verbs: | ||
| - get | ||
| - list | ||
| - apiGroups: | ||
| - '' | ||
| resources: | ||
| - events | ||
| verbs: | ||
| - watch | ||
| - apiGroups: | ||
| - argoproj.io | ||
| resources: | ||
| - eventsources | ||
| - sensors | ||
| - workflows | ||
| - workfloweventbindings | ||
| - workflowtemplates | ||
| - cronworkflows | ||
| verbs: | ||
| - get | ||
| - list | ||
| - watch |
4 changes: 2 additions & 2 deletions
4
...-workflows/resources/read-write-role.yaml → ...ac/read-write-namespaced-clusterrole.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| /argo-cd-auth-secret.yaml |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.