Skip to content

Commit 4c05bb5

Browse files
syedhaseebahmedsyedhaseebahmed
committed
global secrets sync
1 parent ed77700 commit 4c05bb5

File tree

11 files changed

+336
-0
lines changed

11 files changed

+336
-0
lines changed

‎apps/appsets/appset-understack-site-only.yaml‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
---
2+
apiVersion: argoproj.io/v1alpha1
3+
kind: ApplicationSet
4+
metadata:
5+
name: understack-site-only
6+
spec:
7+
syncPolicy:
8+
applicationsSync: create-update
9+
# for infrastructure resources we don't want to delete things automatically
10+
preserveResourcesOnDeletion: true
11+
ignoreApplicationDifferences:
12+
- jsonPointers:
13+
# Allow temporarily disabling auto-sync for troubleshooting
14+
# https://argo-cd.readthedocs.io/en/stable/operator-manual/applicationset/Controlling-Resource-Modification/#allow-temporarily-toggling-auto-sync
15+
- /spec/syncPolicy/automated
16+
goTemplate: true
17+
goTemplateOptions: ["missingkey=error"]
18+
generators:
19+
# matrixes clusters with the applications
20+
- matrix:
21+
generators:
22+
- merge:
23+
mergeKeys:
24+
# merge cluster configs based on cluster name
25+
- name
26+
generators:
27+
# load all site clusters
28+
- clusters:
29+
selector:
30+
matchLabels:
31+
understack.rackspace.com/role: site
32+
values:
33+
# these should always be replaced by further rules below but provide
34+
# a default for the merge operations below
35+
understack_url: 'https://github.com/rackerlabs/understack.git'
36+
understack_ref: 'main'
37+
deploy_url: 'https://github.com/rackerlabs/understack.git'
38+
deploy_ref: 'main'
39+
# dev clusters allow some overrides
40+
- clusters:
41+
selector:
42+
matchLabels:
43+
understack.rackspace.com/env: dev
44+
values:
45+
understack_url: '{{index .metadata.annotations "uc_repo_git_url"}}'
46+
understack_ref: '{{index .metadata.annotations "uc_repo_ref"}}'
47+
deploy_url: '{{index .metadata.annotations "uc_deploy_git_url"}}'
48+
deploy_ref: '{{index .metadata.annotations "uc_deploy_ref"}}'
49+
# now the applications matrixed with the clusters
50+
- merge:
51+
mergeKeys:
52+
# merge config based on component name
53+
- component
54+
generators:
55+
- git:
56+
repoURL: '{{ .values.understack_url }}'
57+
revision: '{{ .values.understack_ref }}'
58+
files:
59+
- path: "apps/site-only/*.yaml"
60+
- git:
61+
repoURL: '{{ .values.deploy_url }}'
62+
revision: '{{ .values.deploy_ref }}'
63+
files:
64+
# this reads the overrides per cluster
65+
- path: '{{ .name }}/apps.yaml'
66+
selector:
67+
matchExpressions:
68+
# if you set skip to any value for the component in apps.yaml, this will disable it
69+
- key: skip
70+
operator: DoesNotExist
71+
template:
72+
metadata:
73+
name: '{{.name}}-{{.component}}'
74+
# we should never set the finalizer here as the applicationsSync policy will handle it
75+
annotations:
76+
argocd.argoproj.io/compare-options: ServerSideDiff=true,IncludeMutationWebhook=true
77+
spec:
78+
project: understack
79+
destination:
80+
server: '{{.server}}'
81+
namespace: '{{coalesce (get . "componentNamespace") .component}}'
82+
syncPolicy:
83+
automated:
84+
# auto-sync is enabled
85+
enabled: true
86+
# prune resources no longer present in the application during sync
87+
prune: true
88+
# sync should be run if a change is detected in the resource objects
89+
selfHeal: true
90+
syncOptions:
91+
# Create the namespace we are using if it doesn't already exist.
92+
- CreateNamespace=true
93+
# Use the server side apply behavior of kubernetes for resources, we've got the
94+
# compare option set above to support this.
95+
- ServerSideApply=true
96+
# Resources might have mutated fields and we want to allow those to be set without
97+
# ArgoCD coming back and smacking them back. The ignoreDifferences templatePatch
98+
# uses this feature.
99+
- RespectIgnoreDifferences=true
100+
# Enable selective sync so that resources that have a difference are applied
101+
# instead of always applying all resources. This prevents us from always
102+
# running jobs.
103+
# https://argo-cd.readthedocs.io/en/stable/user-guide/sync-options/#selective-sync
104+
- ApplyOutOfSyncOnly=true
105+
managedNamespaceMetadata:
106+
annotations:
107+
# ArgoCD can create our namespace but let's not delete it
108+
argocd.argoproj.io/sync-options: Delete=false
109+
templatePatch: |
110+
spec:
111+
{{- $root := . }}
112+
{{- if hasKey . "sources" }}
113+
sources:
114+
{{- range $source := .sources }}
115+
{{- if hasKey $source "ref" }}
116+
- ref: {{ $source.ref }}
117+
{{- if eq $source.ref "understack" }}
118+
repoURL: {{ $root.values.understack_url }}
119+
targetRevision: {{ $root.values.understack_ref }}
120+
{{- else if eq $source.ref "deploy" }}
121+
repoURL: {{ $root.values.deploy_url }}
122+
targetRevision: {{ $root.values.deploy_ref }}
123+
{{- end }}
124+
{{- else}}
125+
- repoURL: {{ $source.repoURL }}
126+
targetRevision: {{ $source.targetRevision }}
127+
{{- end }}
128+
{{- if hasKey $source "chart" }}
129+
chart: {{ $source.chart }}
130+
{{- end }}
131+
{{- if hasKey $source "helm" }}
132+
helm:
133+
{{- if hasKey $source "chart" }}
134+
releaseName: {{ $source.chart }}
135+
{{- end }}
136+
{{- if hasKey $source.helm "valueFiles" }}
137+
valueFiles:
138+
{{- range $vf := $source.helm.valueFiles }}
139+
# until dynamic parameters exist this must be done
140+
- {{ $vf | replace "{{.name}}" $root.name }}
141+
{{- end }}
142+
ignoreMissingValueFiles: true
143+
{{- end }}
144+
{{- if hasKey $source.helm "fileParameters" }}
145+
fileParameters:
146+
{{- range $fp := $source.helm.fileParameters }}
147+
# until dynamic parameters exist this must be done
148+
- name: {{ $fp.name }}
149+
path: {{ $fp.path | replace "{{.name}}" $root.name }}
150+
{{- end }}
151+
{{- end }}
152+
{{- if hasKey $source.helm "valuesObject" }}
153+
valuesObject: {{ $source.helm.valuesObject | toJson }}
154+
# indentation matters so collapse to single line with toJson to keep it
155+
{{- end }}
156+
{{- end }}
157+
{{- if hasKey $source "kustomize" }}
158+
kustomize: {{ $source.kustomize | toJson | replace "{{.dns_zone}}" (index $root.metadata.annotations "dns_zone") }}
159+
{{- end }}
160+
{{- if hasKey $source "path" }}
161+
path: {{ $source.path | replace "{{.name}}" $root.name }}
162+
{{- end }}
163+
{{- end }}
164+
{{- end }}
165+
{{- if hasKey . "ignoreDifferences" }}
166+
# indentation matters so collapse to single line with toJson to keep it
167+
ignoreDifferences: {{ .ignoreDifferences | toJson }}
168+
{{- end }}

‎apps/appsets/project-understack.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,10 @@ spec:
2929
server: '*'
3030
- namespace: 'kube-system'
3131
server: '*'
32+
- namespace: 'site-secrets'
33+
server: '*'
34+
- namespace: 'global-secrets'
35+
server: '*'
3236
clusterResourceWhitelist:
3337
- group: '*'
3438
kind: '*'

‎apps/global/site-secrets.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
component: site-secrets
3+
sources:
4+
- ref: understack
5+
path: 'components/site-secrets'
6+
# - ref: deploy
7+
# path: '{{.name}}/manifests/site-secrets'

‎apps/kustomization.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ resources:
88
- appsets/appset-understack-operators.yaml
99
- appsets/appset-understack-global.yaml
1010
- appsets/appset-understack-site.yaml
11+
- appsets/appset-understack-site-only.yaml
1112
- appsets/appset-understack-openstack.yaml
1213

1314
# you can do something like below to allow your deployment repo

‎apps/site-only/global-secrets-sync.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
component: global-secrets
3+
sources:
4+
- ref: understack
5+
path: 'components/global-secrets'
6+
helm:
7+
releaseName: global-secrets
8+
valueFiles:
9+
- $deploy/{{.name}}/helm-configs/global-secrets.yaml
10+
ignoreMissingValueFiles: true
11+
- ref: deploy
12+
path: '{{.name}}/manifests/global-secrets'

‎components/global-secrets/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎components/global-secrets/Chart.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: v2
2+
name: global-secrets
3+
description: Orchestrating secrets across kubernetes clusters (global-site) using External SecretStore
4+
type: application
5+
version: 0.1.0
6+
appVersion: "1.0"

‎components/global-secrets/templates/cluster-secret-store.yaml.tmpl‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
{{- range .Values.global.stores }}
3+
apiVersion: external-secrets.io/v1
4+
kind: ClusterSecretStore
5+
metadata:
6+
name: {{ .name }}
7+
spec:
8+
provider:
9+
kubernetes:
10+
remoteNamespace: {{ .remoteNamespace }}
11+
server:
12+
url: {{ .kubernetesServerUrl }}
13+
caProvider:
14+
type: Secret
15+
name: {{ .authSecret.name }}
16+
key: {{ .authSecret.crtKey }}
17+
namespace: {{ .authSecret.namespace }}
18+
auth:
19+
token:
20+
bearerToken:
21+
name: {{ .authSecret.name }}
22+
key: {{ .authSecret.tokenKey }}
23+
namespace: {{ .authSecret.namespace }}
24+
---
25+
{{- end }}

‎components/global-secrets/templates/external-secrets.yaml.tpl‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
{{- range .Values.site.secrets }}
3+
apiVersion: external-secrets.io/v1
4+
kind: ExternalSecret
5+
metadata:
6+
name: {{ .name }}
7+
namespace: {{ .namespace }}
8+
spec:
9+
refreshInterval: 1h
10+
secretStoreRef:
11+
kind: ClusterSecretStore
12+
name: {{ .secretStore }}
13+
target:
14+
name: {{ .name }}
15+
creationPolicy: Owner
16+
template:
17+
engineVersion: v2
18+
data:
19+
{{- range $k, $v := .templateData }}
20+
{{ $k }}: {{ $v | quote }}
21+
{{- end }}
22+
data:
23+
{{- range .data }}
24+
- secretKey: {{ .secretKey }}
25+
remoteRef:
26+
key: {{ .remoteRef.key }}
27+
property: {{ .remoteRef.property }}
28+
conversionStrategy: {{ .remoteRef.conversionStrategy | default "Default" }}
29+
decodingStrategy: {{ .remoteRef.decodingStrategy | default "None" }}
30+
metadataPolicy: {{ .remoteRef.metadataPolicy | default "None" }}
31+
{{- end }}
32+
---
33+
{{- end }}

‎components/global-secrets/values.yaml‎

Whitespace-only changes.

0 commit comments

Comments
 (0)