Skip to content

Commit 9f0ecc6

Browse files
roulettedaresroulettedares
committed
feat: argocd rough draft
1 parent 1e577e6 commit 9f0ecc6

11 files changed

+323
-5
lines changed

‎README.md

+4
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,7 @@ The following two paragraphs provide the full list of configuration and output v
125125
| gcp\_project | The name of the GCP project to use | `string` | n/a | yes |
126126
| git\_owner\_requirement\_repos | The git id of the owner for the requirement repositories | `string` | `""` | no |
127127
| gsm | Enables Google Secrets Manager, not available with JX2 | `bool` | `false` | no |
128+
| argocd | Enables gitops sync via ArgoCD instead of git-operator | `bool` | `false` | no |
128129
| ip\_range\_pods | The IP range in CIDR notation to use for pods. Set to /netmask (e.g. /18) to have a range chosen with a specific netmask. Enables VPC-native | `string` | `""` | no |
129130
| ip\_range\_services | The IP range in CIDR notation use for services. Set to /netmask (e.g. /21) to have a range chosen with a specific netmask. Enables VPC-native | `string` | `""` | no |
130131
| jenkins\_x\_namespace | Kubernetes namespace to install Jenkins X in | `string` | `"jx"` | no |
@@ -164,6 +165,9 @@ The following two paragraphs provide the full list of configuration and output v
164165

165166
| Name | Description |
166167
|------|-------------|
168+
| argocd\_sa | The argocd service account object, useful to provide further IAM bindings |
169+
| argocd\_sa\_email | The argocd service account email address, useful to provide further IAM bindings |
170+
| argocd\_sa\_name | The argocd service account name, useful to provide further IAM bindings |
167171
| backup\_bucket\_url | The URL to the bucket for backup storage |
168172
| cluster\_location | The location of the created Kubernetes cluster |
169173
| cluster\_name | The name of the created Kubernetes cluster |

‎main.tf

+18-4
Original file line numberDiff line numberDiff line change
@@ -171,14 +171,15 @@ module "cluster" {
171171
jx_git_operator_version = var.jx_git_operator_version
172172

173173
kuberhealthy = var.kuberhealthy
174+
argocd = var.argocd
174175
}
175176

176177
// ----------------------------------------------------------------------------
177178
// Setup all required resources for using the bank-vaults operator
178179
// See https://github.com/banzaicloud/bank-vaults
179180
// ----------------------------------------------------------------------------
180181
module "vault" {
181-
count = !var.gsm ? 1 : 0
182+
count = ! var.gsm ? 1 : 0
182183
source = "./modules/vault"
183184

184185
gcp_project = var.gcp_project
@@ -196,7 +197,7 @@ module "vault" {
196197
// See https://cloud.google.com/secret-manager
197198
// ----------------------------------------------------------------------------
198199
module "gsm" {
199-
count = var.gsm && !var.jx2 ? 1 : 0
200+
count = var.gsm && ! var.jx2 ? 1 : 0
200201
source = "./modules/gsm"
201202

202203
gcp_project = var.gcp_project
@@ -249,7 +250,20 @@ module "dns" {
249250
module "jx-boot" {
250251
source = "./modules/jx-boot"
251252
depends_on = [module.cluster]
252-
install_vault = !var.gsm ? true : false
253+
install_vault = ! var.gsm ? true : false
254+
}
255+
256+
module "argocd" {
257+
count = var.argocd ? 1 : 0
258+
source = "./modules/argocd"
259+
depends_on = [module.cluster]
260+
261+
gcp_project = var.gcp_project
262+
cluster_name = local.cluster_name
263+
apex_domain = var.apex_domain != "" ? var.apex_domain : var.parent_domain
264+
jx_git_url = var.jx_git_url
265+
jx_bot_username = var.jx_bot_username
266+
jx_bot_token = var.jx_bot_token
253267
}
254268

255269
// ----------------------------------------------------------------------------
@@ -277,7 +291,7 @@ locals {
277291
vault_name = length(module.vault) > 0 ? module.vault[0].vault_name : ""
278292
vault_sa = length(module.vault) > 0 ? module.vault[0].vault_sa : ""
279293
vault_url = var.vault_url
280-
vault_installed = !var.gsm ? true : false
294+
vault_installed = ! var.gsm ? true : false
281295
// Velero
282296
enable_backup = var.enable_backup
283297
velero_sa = module.backup.velero_sa

‎modules/argocd/README.md

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
## Requirements
2+
3+
No requirements.
4+
5+
## Providers
6+
7+
| Name | Version |
8+
|------|---------|
9+
| google | n/a |
10+
| helm | n/a |
11+
12+
## Inputs
13+
14+
| Name | Description | Type | Default | Required |
15+
|------|-------------|------|---------|:--------:|
16+
| apex\_domain | The apex domain to be allocated to the cluster | `string` | n/a | yes |
17+
| cluster\_name | Name of the Kubernetes cluster | `string` | n/a | yes |
18+
| gcp\_project | The name of the GCP project | `string` | n/a | yes |
19+
| helm\_values | Additional settings which will be passed to the Helm chart values, see https://artifacthub.io/packages/helm/argo/argo-cd | `map(any)` | `{}` | no |
20+
| jx\_bot\_token | Bot token used to interact with the Jenkins X cluster git repository | `string` | `""` | no |
21+
| jx\_bot\_username | Bot username used to interact with the Jenkins X cluster git repository | `string` | `""` | no |
22+
| jx\_git\_url | URL for the Jenins X cluster git repository | `string` | `""` | no |
23+
24+
## Outputs
25+
26+
| Name | Description |
27+
|------|-------------|
28+
| argocd\_sa | n/a |
29+
| argocd\_sa\_email | n/a |
30+
| argocd\_sa\_name | n/a |
31+

‎modules/argocd/main.tf

+140
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
// ----------------------------------------------------------------------------
2+
// Create and configure the Argo CD installation
3+
//
4+
// ----------------------------------------------------------------------------
5+
locals {}
6+
7+
resource "helm_release" "bootstrap" {
8+
provider = helm
9+
name = "argocd"
10+
chart = "argo-cd"
11+
namespace = "argocd"
12+
repository = "https://argoproj.github.io/argo-helm"
13+
version = "5.13.6"
14+
create_namespace = true
15+
values = [
16+
jsonencode(
17+
{
18+
"configs" : {
19+
"cm" : {
20+
"resource.compareoptions" : "ignoreAggregatedRoles: true"
21+
}
22+
},
23+
"controller" : {
24+
"serviceAccount" : {
25+
"annotations" : {
26+
"iam.gke.io/gcp-service-account" : "argocd-${var.cluster_name}@${var.gcp_project}.iam.gserviceaccount.com"
27+
}
28+
},
29+
},
30+
"repoServer" : {
31+
"autoscaling" : {
32+
"enabled" : true,
33+
"minReplicas" : 2
34+
},
35+
"initContainers" : [
36+
{
37+
"name" : "download-tools",
38+
"image" : "ghcr.io/helmfile/helmfile:v0.147.0",
39+
"command" : [
40+
"sh",
41+
"-c"
42+
],
43+
"args" : [
44+
"wget -qO /custom-tools/argo-cd-helmfile.sh https://raw.githubusercontent.com/travisghansen/argo-cd-helmfile/master/src/argo-cd-helmfile.sh && chmod +x /custom-tools/argo-cd-helmfile.sh && mv /usr/local/bin/helmfile /custom-tools/helmfile"
45+
],
46+
"volumeMounts" : [
47+
{
48+
"mountPath" : "/custom-tools",
49+
"name" : "custom-tools"
50+
}
51+
]
52+
}
53+
],
54+
"serviceAccount" : {
55+
"annotations" : {
56+
"iam.gke.io/gcp-service-account" : "argocd-${var.cluster_name}@${var.gcp_project}.iam.gserviceaccount.com"
57+
}
58+
},
59+
"volumes" : [
60+
{
61+
"name" : "custom-tools",
62+
"emptyDir" : {}
63+
}
64+
],
65+
"volumeMounts" : [
66+
{
67+
"mountPath" : "/usr/local/bin/argo-cd-helmfile.sh",
68+
"name" : "custom-tools",
69+
"subPath" : "argo-cd-helmfile.sh"
70+
},
71+
{
72+
"mountPath" : "/usr/local/bin/helmfile",
73+
"name" : "custom-tools",
74+
"subPath" : "helmfile"
75+
}
76+
]
77+
},
78+
"server" : {
79+
"autoscaling" : {
80+
"enabled" : true,
81+
"minReplicas" : 2
82+
}
83+
"ingress" : {
84+
"enabled" : true,
85+
"annotations" : {
86+
"nginx.ingress.kubernetes.io/backend-protocol" : "HTTPS",
87+
"nginx.ingress.kubernetes.io/force-ssl-redirect" : "true",
88+
"nginx.ingress.kubernetes.io/ssl-passthrough" : "true"
89+
},
90+
"hosts" : [
91+
"argocd.${var.apex_domain}"
92+
],
93+
"serviceAccount" : {
94+
"annotations" : {
95+
"iam.gke.io/gcp-service-account" : "argocd-${var.cluster_name}@${var.gcp_project}.iam.gserviceaccount.com"
96+
}
97+
}
98+
}
99+
}
100+
}
101+
)
102+
]
103+
104+
set {
105+
name = "configs.cm.configManagementPlugins"
106+
value = <<-EOT
107+
- name: helmfile
108+
init: # Optional command to initialize application source directory
109+
command: ["argo-cd-helmfile.sh"]
110+
args: ["init"]
111+
generate: # Command to generate manifests YAML
112+
command: ["argo-cd-helmfile.sh"]
113+
args: ["generate"]
114+
EOT
115+
}
116+
set {
117+
name = "configs.credentialTemplates.https-creds.url"
118+
value = regex("\\w+://\\w+\\.\\w+", var.jx_git_url)
119+
}
120+
set_sensitive {
121+
name = "configs.credentialTemplates.https-creds.username"
122+
value = var.jx_bot_username
123+
}
124+
set_sensitive {
125+
name = "configs.credentialTemplates.https-creds.password"
126+
value = var.jx_bot_token
127+
}
128+
129+
dynamic "set" {
130+
for_each = var.helm_values
131+
content {
132+
name = set.key
133+
value = set.value
134+
}
135+
}
136+
137+
lifecycle {
138+
ignore_changes = all
139+
}
140+
}

‎modules/argocd/outputs.tf

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
output "argocd_sa" {
2+
value = google_service_account.argocd_sa
3+
}
4+
5+
output "argocd_sa_email" {
6+
value = google_service_account.argocd_sa.email
7+
}
8+
9+
output "argocd_sa_name" {
10+
value = google_service_account.argocd_sa.name
11+
}

‎modules/argocd/serviceaccount.tf

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
// ----------------------------------------------------------------------------
2+
// Setup GCloud Service Accounts
3+
//
4+
// https://www.terraform.io/docs/providers/google/r/google_service_account.html
5+
// https://www.terraform.io/docs/providers/google/r/google_project_iam.html#google_project_iam_member
6+
// ----------------------------------------------------------------------------
7+
// argocd
8+
resource "google_service_account" "argocd_sa" {
9+
provider = google
10+
account_id = "argocd-${var.cluster_name}"
11+
display_name = substr("ArgoCD service account for cluster ${var.cluster_name}", 0, 100)
12+
}
13+
14+
resource "google_project_iam_member" "argocd_sa_secret_manager_admin_binding" {
15+
project = var.gcp_project
16+
provider = google
17+
role = "roles/secretmanager.admin"
18+
member = "serviceAccount:${google_service_account.argocd_sa.email}"
19+
}
20+
21+
resource "google_project_iam_member" "argocd_sa_container_developer_binding" {
22+
project = var.gcp_project
23+
provider = google
24+
role = "roles/container.developer"
25+
member = "serviceAccount:${google_service_account.argocd_sa.email}"
26+
}
27+
28+
resource "google_service_account_iam_member" "argocd_app_controller_sa_workload_identity_user" {
29+
provider = google
30+
service_account_id = google_service_account.argocd_sa.name
31+
role = "roles/iam.workloadIdentityUser"
32+
member = "serviceAccount:${var.gcp_project}.svc.id.goog[argocd/argocd-application-controller]"
33+
}
34+
35+
resource "google_service_account_iam_member" "argocd_repo_server_sa_workload_identity_user" {
36+
provider = google
37+
service_account_id = google_service_account.argocd_sa.name
38+
role = "roles/iam.workloadIdentityUser"
39+
member = "serviceAccount:${var.gcp_project}.svc.id.goog[argocd/argocd-repo-server]"
40+
}
41+
42+
resource "google_service_account_iam_member" "argocd_server_sa_workload_identity_user" {
43+
provider = google
44+
service_account_id = google_service_account.argocd_sa.name
45+
role = "roles/iam.workloadIdentityUser"
46+
member = "serviceAccount:${var.gcp_project}.svc.id.goog[argocd/argocd-server]"
47+
}

‎modules/argocd/variables.tf

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
// ----------------------------------------------------------------------------
2+
// Required Variables
3+
// ----------------------------------------------------------------------------
4+
variable "gcp_project" {
5+
description = "The name of the GCP project"
6+
type = string
7+
}
8+
9+
variable "cluster_name" {
10+
description = "Name of the Kubernetes cluster"
11+
type = string
12+
}
13+
14+
variable "apex_domain" {
15+
description = "The apex domain to be allocated to the cluster"
16+
type = string
17+
}
18+
19+
// ----------------------------------------------------------------------------
20+
// Optional Variables
21+
// ----------------------------------------------------------------------------
22+
23+
variable "jx_git_url" {
24+
description = "URL for the Jenins X cluster git repository"
25+
type = string
26+
default = ""
27+
}
28+
29+
variable "jx_bot_username" {
30+
description = "Bot username used to interact with the Jenkins X cluster git repository"
31+
type = string
32+
default = ""
33+
}
34+
35+
variable "jx_bot_token" {
36+
description = "Bot token used to interact with the Jenkins X cluster git repository"
37+
type = string
38+
default = ""
39+
}
40+
41+
variable "helm_values" {
42+
type = map(any)
43+
description = "Additional settings which will be passed to the Helm chart values, see https://artifacthub.io/packages/helm/argo/argo-cd"
44+
default = {}
45+
}

‎modules/cluster/main.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,7 @@ resource "kubernetes_config_map" "jenkins_x_requirements" {
177177
}
178178

179179
resource "helm_release" "jx-git-operator" {
180-
count = var.jx2 || var.jx_git_url == "" ? 0 : 1
180+
count = var.jx2 || var.argocd || var.jx_git_url == "" ? 0 : 1
181181

182182
provider = helm
183183
name = "jx-git-operator"

‎modules/cluster/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -483,6 +483,12 @@ variable "kuberhealthy" {
483483
default = true
484484
}
485485

486+
variable "argocd" {
487+
description = "Enables Argo CD instead of jx-git-operator"
488+
type = bool
489+
default = false
490+
}
491+
486492
variable "content" {
487493
description = "Interpolated jx-requirements.yml"
488494
type = string

‎output.tf

+14
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,20 @@ output "tekton_sa_name" {
4848
value = module.cluster.tekton_sa_name
4949
}
5050

51+
output "argocd_sa" {
52+
description = "The argocd service account object, useful to provide further IAM bindings"
53+
value = length(module.argocd) > 0 ? module.argocd[0].argocd_sa : null
54+
}
55+
56+
output "argocd_sa_email" {
57+
description = "The argocd service account email address, useful to provide further IAM bindings"
58+
value = length(module.argocd) > 0 ? module.argocd[0].argocd_sa_email : ""
59+
}
60+
61+
output "argocd_sa_name" {
62+
description = "The argocd service account name, useful to provide further IAM bindings"
63+
value = length(module.argocd) > 0 ? module.argocd[0].argocd_sa_name : ""
64+
}
5165

5266
output "jx_requirements" {
5367
description = "The jx-requirements rendered output"

0 commit comments

Comments
 (0)