Skip to content

Commit 8c38963

Browse files
roulettedaresroulettedares
committed
feat: argocd rough draft
1 parent 1e577e6 commit 8c38963

10 files changed

+305
-5
lines changed

‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,7 @@ The following two paragraphs provide the full list of configuration and output v
125125
| gcp\_project | The name of the GCP project to use | `string` | n/a | yes |
126126
| git\_owner\_requirement\_repos | The git id of the owner for the requirement repositories | `string` | `""` | no |
127127
| gsm | Enables Google Secrets Manager, not available with JX2 | `bool` | `false` | no |
128+
| argocd | Enables gitops sync via ArgoCD instead of git-operator | `bool` | `false` | no |
128129
| ip\_range\_pods | The IP range in CIDR notation to use for pods. Set to /netmask (e.g. /18) to have a range chosen with a specific netmask. Enables VPC-native | `string` | `""` | no |
129130
| ip\_range\_services | The IP range in CIDR notation use for services. Set to /netmask (e.g. /21) to have a range chosen with a specific netmask. Enables VPC-native | `string` | `""` | no |
130131
| jenkins\_x\_namespace | Kubernetes namespace to install Jenkins X in | `string` | `"jx"` | no |

‎main.tf

+27-4
Original file line numberDiff line numberDiff line change
@@ -171,14 +171,15 @@ module "cluster" {
171171
jx_git_operator_version = var.jx_git_operator_version
172172

173173
kuberhealthy = var.kuberhealthy
174+
argocd = var.argocd
174175
}
175176

176177
// ----------------------------------------------------------------------------
177178
// Setup all required resources for using the bank-vaults operator
178179
// See https://github.com/banzaicloud/bank-vaults
179180
// ----------------------------------------------------------------------------
180181
module "vault" {
181-
count = !var.gsm ? 1 : 0
182+
count = ! var.gsm ? 1 : 0
182183
source = "./modules/vault"
183184

184185
gcp_project = var.gcp_project
@@ -196,7 +197,7 @@ module "vault" {
196197
// See https://cloud.google.com/secret-manager
197198
// ----------------------------------------------------------------------------
198199
module "gsm" {
199-
count = var.gsm && !var.jx2 ? 1 : 0
200+
count = var.gsm && ! var.jx2 ? 1 : 0
200201
source = "./modules/gsm"
201202

202203
gcp_project = var.gcp_project
@@ -249,7 +250,29 @@ module "dns" {
249250
module "jx-boot" {
250251
source = "./modules/jx-boot"
251252
depends_on = [module.cluster]
252-
install_vault = !var.gsm ? true : false
253+
install_vault = ! var.gsm ? true : false
254+
}
255+
256+
module "argocd" {
257+
count = var.argocd ? 1 : 0
258+
source = "./modules/argocd"
259+
depends_on = [module.cluster]
260+
261+
gcp_project = var.gcp_project
262+
cluster_name = local.cluster_name
263+
apex_domain = var.apex_domain != "" ? var.apex_domain : var.parent_domain
264+
cluster_location = local.location
265+
cluster_network = var.cluster_network
266+
cluster_subnetwork = var.cluster_subnetwork
267+
cluster_id = random_id.random.hex
268+
jenkins_x_namespace = var.jenkins_x_namespace
269+
270+
content = local.content
271+
272+
jx_git_url = var.jx_git_url
273+
jx_bot_username = var.jx_bot_username
274+
jx_bot_token = var.jx_bot_token
275+
jx_git_operator_version = var.jx_git_operator_version
253276
}
254277

255278
// ----------------------------------------------------------------------------
@@ -277,7 +300,7 @@ locals {
277300
vault_name = length(module.vault) > 0 ? module.vault[0].vault_name : ""
278301
vault_sa = length(module.vault) > 0 ? module.vault[0].vault_sa : ""
279302
vault_url = var.vault_url
280-
vault_installed = !var.gsm ? true : false
303+
vault_installed = ! var.gsm ? true : false
281304
// Velero
282305
enable_backup = var.enable_backup
283306
velero_sa = module.backup.velero_sa

‎modules/argocd/README.md

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
## Requirements
2+
3+
No requirements.
4+
5+
## Providers
6+
7+
| Name | Version |
8+
|------|---------|
9+
| google | n/a |
10+
| helm | n/a |
11+
12+
## Inputs
13+
14+
| Name | Description | Type | Default | Required |
15+
|------|-------------|------|---------|:--------:|
16+
| apex\_domain | The apex domain to be allocated to the cluster | `string` | n/a | yes |
17+
| cluster\_name | Name of the Kubernetes cluster | `string` | n/a | yes |
18+
| gcp\_project | The name of the GCP project | `string` | n/a | yes |
19+
| helm\_values | Additional settings which will be passed to the Helm chart values, see https://artifacthub.io/packages/helm/argo/argo-cd | `map(any)` | `{}` | no |
20+
| jx\_bot\_token | Bot token used to interact with the Jenkins X cluster git repository | `string` | `""` | no |
21+
| jx\_bot\_username | Bot username used to interact with the Jenkins X cluster git repository | `string` | `""` | no |
22+
| jx\_git\_url | URL for the Jenins X cluster git repository | `string` | `""` | no |
23+
24+
## Outputs
25+
26+
| Name | Description |
27+
|------|-------------|
28+
| argocd\_sa\_email | n/a |
29+
| argocd\_sa\_name | n/a |
30+

‎modules/argocd/main.tf

+135
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
// ----------------------------------------------------------------------------
2+
// Create and configure the Argo CD installation
3+
//
4+
// ----------------------------------------------------------------------------
5+
locals {}
6+
7+
resource "helm_release" "bootstrap" {
8+
provider = helm
9+
name = "argocd"
10+
chart = "argo-cd"
11+
namespace = "argocd"
12+
repository = "https://argoproj.github.io/argo-helm"
13+
version = "5.6.1"
14+
create_namespace = true
15+
values = [
16+
jsonencode(
17+
{
18+
"controller" : {
19+
"serviceAccount" : {
20+
"annotations" : {
21+
"iam.gke.io/gcp-service-account" : "argocd-${var.cluster_name}@${var.gcp_project}.iam.gserviceaccount.com"
22+
}
23+
},
24+
},
25+
"repoServer" : {
26+
"autoscaling" : {
27+
"enabled" : true,
28+
"minReplicas" : 2
29+
},
30+
"initContainers" : [
31+
{
32+
"name" : "download-tools",
33+
"image" : "ghcr.io/helmfile/helmfile:v0.147.0",
34+
"command" : [
35+
"sh",
36+
"-c"
37+
],
38+
"args" : [
39+
"wget -qO /custom-tools/argo-cd-helmfile.sh https://raw.githubusercontent.com/travisghansen/argo-cd-helmfile/master/src/argo-cd-helmfile.sh && chmod +x /custom-tools/argo-cd-helmfile.sh && mv /usr/local/bin/helmfile /custom-tools/helmfile"
40+
],
41+
"volumeMounts" : [
42+
{
43+
"mountPath" : "/custom-tools",
44+
"name" : "custom-tools"
45+
}
46+
]
47+
}
48+
],
49+
"serviceAccount" : {
50+
"annotations" : {
51+
"iam.gke.io/gcp-service-account" : "argocd-${var.cluster_name}@${var.gcp_project}.iam.gserviceaccount.com"
52+
}
53+
},
54+
"volumes" : [
55+
{
56+
"name" : "custom-tools",
57+
"emptyDir" : {}
58+
}
59+
],
60+
"volumeMounts" : [
61+
{
62+
"mountPath" : "/usr/local/bin/argo-cd-helmfile.sh",
63+
"name" : "custom-tools",
64+
"subPath" : "argo-cd-helmfile.sh"
65+
},
66+
{
67+
"mountPath" : "/usr/local/bin/helmfile",
68+
"name" : "custom-tools",
69+
"subPath" : "helmfile"
70+
}
71+
]
72+
},
73+
"server" : {
74+
"autoscaling" : {
75+
"enabled" : true,
76+
"minReplicas" : 2
77+
}
78+
"ingress" : {
79+
"enabled" : true,
80+
"annotations" : {
81+
"nginx.ingress.kubernetes.io/backend-protocol" : "HTTPS",
82+
"nginx.ingress.kubernetes.io/force-ssl-redirect" : "true",
83+
"nginx.ingress.kubernetes.io/ssl-passthrough" : "true"
84+
},
85+
"hosts" : [
86+
"argocd.${var.apex_domain}"
87+
],
88+
"serviceAccount" : {
89+
"annotations" : {
90+
"iam.gke.io/gcp-service-account" : "argocd-${var.cluster_name}@${var.gcp_project}.iam.gserviceaccount.com"
91+
}
92+
}
93+
}
94+
}
95+
}
96+
)
97+
]
98+
99+
set {
100+
name = "server.config.configManagementPlugins"
101+
value = <<-EOT
102+
- name: helmfile
103+
init: # Optional command to initialize application source directory
104+
command: ["argo-cd-helmfile.sh"]
105+
args: ["init"]
106+
generate: # Command to generate manifests YAML
107+
command: ["argo-cd-helmfile.sh"]
108+
args: ["generate"]
109+
EOT
110+
}
111+
set {
112+
name = "configs.credentialTemplates.https-creds.url"
113+
value = regex("\\w+://\\w+\\.\\w+", var.jx_git_url)
114+
}
115+
set_sensitive {
116+
name = "configs.credentialTemplates.https-creds.username"
117+
value = var.jx_bot_username
118+
}
119+
set_sensitive {
120+
name = "configs.credentialTemplates.https-creds.password"
121+
value = var.jx_bot_token
122+
}
123+
124+
dynamic "set" {
125+
for_each = var.helm_values
126+
content {
127+
name = set.key
128+
value = set.value
129+
}
130+
}
131+
132+
lifecycle {
133+
# ignore_changes = all
134+
}
135+
}

‎modules/argocd/outputs.tf

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
output "argocd_sa_email" {
2+
value = google_service_account.argocd_sa.email
3+
}
4+
5+
output "argocd_sa_name" {
6+
value = google_service_account.argocd_sa.name
7+
}

‎modules/argocd/serviceaccount.tf

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
// ----------------------------------------------------------------------------
2+
// Setup GCloud Service Accounts
3+
//
4+
// https://www.terraform.io/docs/providers/google/r/google_service_account.html
5+
// https://www.terraform.io/docs/providers/google/r/google_project_iam.html#google_project_iam_member
6+
// ----------------------------------------------------------------------------
7+
// argocd
8+
resource "google_service_account" "argocd_sa" {
9+
provider = google
10+
account_id = "argocd-${var.cluster_name}"
11+
display_name = substr("ArgoCD service account for cluster ${var.cluster_name}", 0, 100)
12+
}
13+
14+
resource "google_project_iam_member" "argocd_sa_secret_manager_admin_binding" {
15+
project = var.gcp_project
16+
provider = google
17+
role = "roles/secretmanager.admin"
18+
member = "serviceAccount:${google_service_account.argocd_sa.email}"
19+
}
20+
21+
resource "google_project_iam_member" "argocd_sa_container_developer_binding" {
22+
project = var.gcp_project
23+
provider = google
24+
role = "roles/container.developer"
25+
member = "serviceAccount:${google_service_account.argocd_sa.email}"
26+
}
27+
28+
resource "google_service_account_iam_member" "argocd_app_controller_sa_workload_identity_user" {
29+
provider = google
30+
service_account_id = google_service_account.argocd_sa.name
31+
role = "roles/iam.workloadIdentityUser"
32+
member = "serviceAccount:${var.gcp_project}.svc.id.goog[argocd/argocd-application-controller]"
33+
}
34+
35+
resource "google_service_account_iam_member" "argocd_repo_server_sa_workload_identity_user" {
36+
provider = google
37+
service_account_id = google_service_account.argocd_sa.name
38+
role = "roles/iam.workloadIdentityUser"
39+
member = "serviceAccount:${var.gcp_project}.svc.id.goog[argocd/argocd-repo-server]"
40+
}
41+
42+
resource "google_service_account_iam_member" "argocd_server_sa_workload_identity_user" {
43+
provider = google
44+
service_account_id = google_service_account.argocd_sa.name
45+
role = "roles/iam.workloadIdentityUser"
46+
member = "serviceAccount:${var.gcp_project}.svc.id.goog[argocd/argocd-server]"
47+
}

‎modules/argocd/variables.tf

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
// ----------------------------------------------------------------------------
2+
// Required Variables
3+
// ----------------------------------------------------------------------------
4+
variable "gcp_project" {
5+
description = "The name of the GCP project"
6+
type = string
7+
}
8+
9+
variable "cluster_name" {
10+
description = "Name of the Kubernetes cluster"
11+
type = string
12+
}
13+
14+
variable "apex_domain" {
15+
description = "The apex domain to be allocated to the cluster"
16+
type = string
17+
}
18+
19+
// ----------------------------------------------------------------------------
20+
// Optional Variables
21+
// ----------------------------------------------------------------------------
22+
23+
variable "jx_git_url" {
24+
description = "URL for the Jenins X cluster git repository"
25+
type = string
26+
default = ""
27+
}
28+
29+
variable "jx_bot_username" {
30+
description = "Bot username used to interact with the Jenkins X cluster git repository"
31+
type = string
32+
default = ""
33+
}
34+
35+
variable "jx_bot_token" {
36+
description = "Bot token used to interact with the Jenkins X cluster git repository"
37+
type = string
38+
default = ""
39+
}
40+
41+
variable "helm_values" {
42+
type = map(any)
43+
description = "Additional settings which will be passed to the Helm chart values, see https://artifacthub.io/packages/helm/argo/argo-cd"
44+
default = {}
45+
}

‎modules/cluster/main.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,7 @@ resource "kubernetes_config_map" "jenkins_x_requirements" {
177177
}
178178

179179
resource "helm_release" "jx-git-operator" {
180-
count = var.jx2 || var.jx_git_url == "" ? 0 : 1
180+
count = var.jx2 || var.argocd || var.jx_git_url == "" ? 0 : 1
181181

182182
provider = helm
183183
name = "jx-git-operator"

‎modules/cluster/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -483,6 +483,12 @@ variable "kuberhealthy" {
483483
default = true
484484
}
485485

486+
variable "argocd" {
487+
description = "Enables Argo CD instead of jx-git-operator"
488+
type = bool
489+
default = false
490+
}
491+
486492
variable "content" {
487493
description = "Interpolated jx-requirements.yml"
488494
type = string

‎variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -297,6 +297,12 @@ variable "gsm" {
297297
default = false
298298
}
299299

300+
variable "argocd" {
301+
description = "Enables Argo CD instead of jx-git-operator"
302+
type = bool
303+
default = false
304+
}
305+
300306
variable "jx_git_url" {
301307
description = "URL for the Jenins X cluster git repository"
302308
type = string

0 commit comments

Comments
 (0)