Compare commits
7 Commits
b4395306b0
...
d9a2bdb903
Author | SHA1 | Date | |
---|---|---|---|
d9a2bdb903 | |||
bca7f5fd45 | |||
68997b535d | |||
ca69b55492 | |||
01832f2e41 | |||
94dd2f395e | |||
6a7c0b6085 |
@ -6,8 +6,8 @@ ARG ALPINE_VERSION
|
||||
ARG KUBE_VERSION=1.31
|
||||
|
||||
ARG SOPS_VERSION="3.9.4"
|
||||
ARG VALS_VERSION="0.39.1"
|
||||
ARG HELM_SECRETS_VERSION="4.6.2"
|
||||
ARG VALS_VERSION="0.39.4"
|
||||
ARG HELM_SECRETS_VERSION="4.6.3"
|
||||
|
||||
RUN cd /etc/apk/keys && \
|
||||
wget "https://cdn.zero-downtime.net/alpine/stefan@zero-downtime.net-61bb6bfb.rsa.pub" && \
|
||||
@ -24,6 +24,7 @@ RUN cd /etc/apk/keys && \
|
||||
py3-yaml \
|
||||
restic \
|
||||
helm \
|
||||
apache2-utils \
|
||||
ytt@testing \
|
||||
etcd-ctl@edge-community \
|
||||
cri-tools@kubezero \
|
||||
|
@ -45,6 +45,7 @@ helm template $CHARTS/kubezero -f $WORKDIR/kubezero-values.yaml --kube-version $
|
||||
|
||||
# Root KubeZero apply directly and exit
|
||||
if [ ${ARTIFACTS[0]} == "kubezero" ]; then
|
||||
[ -f $CHARTS/kubezero/hooks.d/pre-install.sh ] && . $CHARTS/kubezero/hooks.d/pre-install.sh
|
||||
kubectl replace -f $WORKDIR/kubezero/templates $(field_manager $ARGOCD)
|
||||
exit $?
|
||||
|
||||
|
@ -16,7 +16,10 @@ pre_control_plane_upgrade_cluster() {
|
||||
post_control_plane_upgrade_cluster() {
|
||||
# delete previous root app controlled by kubezero module
|
||||
kubectl delete application kubezero-git-sync -n argocd || true
|
||||
kubectl delete appproject kubezero -n argocd || true
|
||||
|
||||
# Patch appproject to keep SyncWindow in place
|
||||
kubectl patch appproject kubezero -n argocd --type json -p='[{"op": "remove", "path": "/metadata/labels"}]' || true
|
||||
kubectl patch appproject kubezero -n argocd --type json -p='[{"op": "remove", "path": "/metadata/annotations"}]' || true
|
||||
}
|
||||
|
||||
|
||||
|
@ -44,10 +44,21 @@ function field_manager() {
|
||||
}
|
||||
|
||||
|
||||
function get_kubezero_secret() {
|
||||
export _key="$1"
|
||||
function get_secret_val() {
|
||||
local ns=$1
|
||||
local secret=$2
|
||||
local val=$(kubectl get secret -n $ns $secret -o yaml | yq ".data.\"$3\"")
|
||||
|
||||
kubectl get secrets -n kubezero kubezero-secrets -o yaml | yq '.data.[env(_key)]' | base64 -d -w0
|
||||
if [ "$val" != "null" ]; then
|
||||
echo -n $val | base64 -d -w0
|
||||
else
|
||||
echo ""
|
||||
fi
|
||||
}
|
||||
|
||||
|
||||
function get_kubezero_secret() {
|
||||
get_secret_val kubezero kubezero-secrets "$1"
|
||||
}
|
||||
|
||||
|
||||
@ -55,7 +66,9 @@ function set_kubezero_secret() {
|
||||
local key="$1"
|
||||
local val="$2"
|
||||
|
||||
kubectl patch secret -n kubezero kubezero-secrets --patch="{\"data\": { \"$key\": \"$(echo -n $val |base64 -w0)\" }}"
|
||||
if [ -n "$val" ]; then
|
||||
kubectl patch secret -n kubezero kubezero-secrets --patch="{\"data\": { \"$key\": \"$(echo -n "$val" |base64 -w0)\" }}"
|
||||
fi
|
||||
}
|
||||
|
||||
|
||||
@ -70,7 +83,6 @@ function get_kubezero_values() {
|
||||
fi
|
||||
}
|
||||
|
||||
|
||||
# Overwrite kubezero-values CM with file
|
||||
function update_kubezero_cm() {
|
||||
kubectl get cm -n kubezero kubezero-values -o=yaml | \
|
||||
@ -140,7 +152,7 @@ function delete_ns() {
|
||||
|
||||
# Extract crds via helm calls
|
||||
function crds() {
|
||||
helm secrets --evaluate-templates template $(chart_location $chart) -n $namespace --name-template $module $targetRevision --include-crds -f $WORKDIR/values.yaml $API_VERSIONS --kube-version $KUBE_VERSION $@ | python3 -c '
|
||||
helm template $(chart_location $chart) -n $namespace --name-template $module $targetRevision --include-crds -f $WORKDIR/values.yaml $API_VERSIONS --kube-version $KUBE_VERSION $@ | python3 -c '
|
||||
#!/usr/bin/python3
|
||||
import yaml
|
||||
import sys
|
||||
@ -212,7 +224,7 @@ function _helm() {
|
||||
|
||||
if [ $action == "crds" ]; then
|
||||
# Pre-crd hook
|
||||
[ -f $WORKDIR/$chart/hooks.d/pre-crds.sh ] && (cd $WORKDIR; bash ./$chart/hooks.d/pre-crds.sh)
|
||||
[ -f $WORKDIR/$chart/hooks.d/pre-crds.sh ] && . $WORKDIR/$chart/hooks.d/pre-crds.sh
|
||||
|
||||
crds
|
||||
|
||||
@ -224,7 +236,7 @@ function _helm() {
|
||||
create_ns $namespace
|
||||
|
||||
# Optional pre hook
|
||||
[ -f $WORKDIR/$chart/hooks.d/pre-install.sh ] && (cd $WORKDIR; bash ./$chart/hooks.d/pre-install.sh)
|
||||
[ -f $WORKDIR/$chart/hooks.d/pre-install.sh ] && . $WORKDIR/$chart/hooks.d/pre-install.sh
|
||||
|
||||
render
|
||||
[ $action == "replace" ] && kubectl replace -f $WORKDIR/helm.yaml $(field_manager $ARGOCD) && rc=$? || rc=$?
|
||||
@ -233,7 +245,7 @@ function _helm() {
|
||||
[ $action == "apply" -o $rc -ne 0 ] && kubectl apply -f $WORKDIR/helm.yaml --server-side --force-conflicts $(field_manager $ARGOCD) && rc=$? || rc=$?
|
||||
|
||||
# Optional post hook
|
||||
[ -f $WORKDIR/$chart/hooks.d/post-install.sh ] && (cd $WORKDIR; bash ./$chart/hooks.d/post-install.sh)
|
||||
[ -f $WORKDIR/$chart/hooks.d/post-install.sh ] && . $WORKDIR/$chart/hooks.d/post-install.sh
|
||||
|
||||
elif [ $action == "delete" ]; then
|
||||
render
|
||||
|
@ -20,13 +20,13 @@ echo "Checking that all pods in kube-system are running ..."
|
||||
[ "$ARGOCD" == "true" ] && disable_argo
|
||||
|
||||
# Check if we already have all controllers on the current version
|
||||
OLD_CONTROLLERS=$(kubectl get nodes -l "node-role.kubernetes.io/control-plane=" --no-headers=true | grep -cv $KUBE_VERSION || true)
|
||||
#OLD_CONTROLLERS=$(kubectl get nodes -l "node-role.kubernetes.io/control-plane=" --no-headers=true | grep -cv $KUBE_VERSION || true)
|
||||
|
||||
# All controllers already on current version
|
||||
if [ "$OLD_CONTROLLERS" == "0" ]; then
|
||||
# All controllers already on current version
|
||||
control_plane_upgrade finalize_cluster_upgrade
|
||||
# Otherwise run control plane upgrade
|
||||
else
|
||||
# Otherwise run control plane upgrade
|
||||
control_plane_upgrade kubeadm_upgrade
|
||||
fi
|
||||
|
||||
@ -38,7 +38,7 @@ read -r
|
||||
#[ "$ARGOCD" == "true" ] && kubectl edit app kubezero -n argocd || kubectl edit cm kubezero-values -n kubezero
|
||||
|
||||
# upgrade modules
|
||||
control_plane_upgrade "apply_kubezero apply_network, apply_addons, apply_storage, apply_operators"
|
||||
control_plane_upgrade "apply_kubezero, apply_network, apply_addons, apply_storage, apply_operators"
|
||||
|
||||
echo "Checking that all pods in kube-system are running ..."
|
||||
waitSystemPodsRunning
|
||||
@ -47,6 +47,9 @@ echo "Applying remaining KubeZero modules..."
|
||||
|
||||
control_plane_upgrade "apply_cert-manager, apply_istio, apply_istio-ingress, apply_istio-private-ingress, apply_logging, apply_metrics, apply_telemetry, apply_argo"
|
||||
|
||||
# we replace the project during v1.31 so disable again
|
||||
[ "$ARGOCD" == "true" ] && disable_argo
|
||||
|
||||
# Final step is to commit the new argocd kubezero app
|
||||
kubectl get app kubezero -n argocd -o yaml | yq 'del(.status) | del(.metadata) | del(.operation) | .metadata.name="kubezero" | .metadata.namespace="argocd"' | yq 'sort_keys(..)' > $ARGO_APP
|
||||
|
||||
|
@ -25,3 +25,4 @@
|
||||
README.md.gotmpl
|
||||
dashboards.yaml
|
||||
jsonnet
|
||||
update.sh
|
||||
|
@ -1,6 +1,6 @@
|
||||
# kubezero-argo
|
||||
|
||||

|
||||

|
||||
|
||||
KubeZero Argo - Events, Workflow, CD
|
||||
|
||||
@ -18,8 +18,8 @@ Kubernetes: `>= 1.30.0-0`
|
||||
|
||||
| Repository | Name | Version |
|
||||
|------------|------|---------|
|
||||
| https://argoproj.github.io/argo-helm | argo-cd | 7.8.9 |
|
||||
| https://argoproj.github.io/argo-helm | argo-events | 2.4.13 |
|
||||
| https://argoproj.github.io/argo-helm | argo-cd | 7.8.13 |
|
||||
| https://argoproj.github.io/argo-helm | argo-events | 2.4.14 |
|
||||
| https://argoproj.github.io/argo-helm | argocd-image-updater | 0.12.0 |
|
||||
| https://cdn.zero-downtime.net/charts/ | kubezero-lib | 0.2.1 |
|
||||
|
||||
@ -42,6 +42,7 @@ Kubernetes: `>= 1.30.0-0`
|
||||
| argo-cd.configs.params."controller.sync.timeout.seconds" | int | `1800` | |
|
||||
| argo-cd.configs.params."server.enable.gzip" | bool | `true` | |
|
||||
| argo-cd.configs.params."server.insecure" | bool | `true` | |
|
||||
| argo-cd.configs.secret.argocdServerAdminPassword | string | `"secretref+k8s://v1/Secret/kubezero/kubezero-secrets/argo-cd.adminPassword"` | |
|
||||
| argo-cd.configs.secret.createSecret | bool | `false` | |
|
||||
| argo-cd.configs.ssh.extraHosts | string | `"git.zero-downtime.net ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC7UgK7Z4dDcuIW1uMOsuwhrqdkJCvYG/ZjHtLM7WaKFxVRnzNnNkQJNncWIGNDUQ1xxrbsoSNRZDtk0NlOjNtx2aApSWl4iWghkpXELvsZtOZ7I9FSC/E6ImLC3KWfK7P0mhZaF6kHPfpu8Y6pjUyLBTpV1AaVwr0I8onyqGazJOVotTFaBFEi/sT0O2FUk7agwZYfj61w3JGOy3c+fmBcK3lXf/QM90tosOpJNuJ7n5Vk5FDDLkl9rO4XR/+mXHFvITiWb8F5C50YAwjYcy36yWSSryUAAHAuqpgotwh65vSG6fZvFhmEwO2BrCkOV5+k8iRfhy/yZODJzZ5V/5cbMbdZrY6lm/p5/S1wv8BEyPekBGdseqQjEO0IQiQHcMrfgTrrQ7ndbZzVZRByZI+wbGFkBCzNSJcNsoiHjs2EblxYyuW0qUvvrBxLnySvaxyPm4BOukSAZAOEaUrajpQlnHdnY1CGcgbwxw0LNv3euKQ3tDJSUlKO0Wd8d85PRv1THW4Ui9Lhsmv+BPA2vJZDOkx/n0oyPFAB0oyd5JNM38eFxLCmPC2OE63gDP+WmzVO61YCVTnvhpQjEOLawEWVFsk0y25R5z5BboDqJaOFnZF6i517O96cn17z3Ls4hxw3+0rlKczYRoyfUHs7KQENa4mY8YlJweNTBgld//RMUQ=="` | |
|
||||
| argo-cd.configs.styles | string | `".sidebar__logo img { content: url(https://cdn.zero-downtime.net/assets/kubezero/logo-small-64.png); }\n.sidebar__logo__text-logo { height: 0em; }\n.sidebar { background: linear-gradient(to bottom, #6A4D79, #493558, #2D1B30, #0D0711); }\n"` | |
|
||||
@ -53,24 +54,19 @@ Kubernetes: `>= 1.30.0-0`
|
||||
| argo-cd.dex.enabled | bool | `false` | |
|
||||
| argo-cd.enabled | bool | `false` | |
|
||||
| argo-cd.global.image.repository | string | `"public.ecr.aws/zero-downtime/zdt-argocd"` | |
|
||||
| argo-cd.global.image.tag | string | `"v2.14.5"` | |
|
||||
| argo-cd.global.image.tag | string | `"v2.14.7"` | |
|
||||
| argo-cd.global.logging.format | string | `"json"` | |
|
||||
| argo-cd.global.networkPolicy.create | bool | `true` | |
|
||||
| argo-cd.istio.enabled | bool | `false` | |
|
||||
| argo-cd.istio.gateway | string | `"istio-ingress/ingressgateway"` | |
|
||||
| argo-cd.istio.ipBlocks | list | `[]` | |
|
||||
| argo-cd.kubezero.bootstrap | bool | `false` | |
|
||||
| argo-cd.kubezero.bootstrap | bool | `false` | deploy the KubeZero Project and GitSync Root App |
|
||||
| argo-cd.kubezero.path | string | `"/"` | |
|
||||
| argo-cd.kubezero.repoUrl | string | `"https://git.my.org/thiscluster"` | |
|
||||
| argo-cd.kubezero.repoUrl | string | `""` | |
|
||||
| argo-cd.kubezero.sshPrivateKey | string | `"secretref+k8s://v1/Secret/kubezero/kubezero-secrets/argo-cd.kubezero.sshPrivateKey"` | |
|
||||
| argo-cd.kubezero.targetRevision | string | `"HEAD"` | |
|
||||
| argo-cd.notifications.enabled | bool | `false` | |
|
||||
| argo-cd.redisSecretInit.enabled | bool | `false` | |
|
||||
| argo-cd.repoServer.clusterRoleRules.enabled | bool | `true` | |
|
||||
| argo-cd.repoServer.clusterRoleRules.rules[0].apiGroups[0] | string | `""` | |
|
||||
| argo-cd.repoServer.clusterRoleRules.rules[0].resources[0] | string | `"secrets"` | |
|
||||
| argo-cd.repoServer.clusterRoleRules.rules[0].verbs[0] | string | `"get"` | |
|
||||
| argo-cd.repoServer.clusterRoleRules.rules[0].verbs[1] | string | `"watch"` | |
|
||||
| argo-cd.repoServer.clusterRoleRules.rules[0].verbs[2] | string | `"list"` | |
|
||||
| argo-cd.repoServer.metrics.enabled | bool | `false` | |
|
||||
| argo-cd.repoServer.metrics.serviceMonitor.enabled | bool | `true` | |
|
||||
| argo-cd.repoServer.volumeMounts[0].mountPath | string | `"/home/argocd/.kube"` | |
|
||||
|
27
charts/kubezero-argo/hooks.d/pre-install.sh
Normal file → Executable file
27
charts/kubezero-argo/hooks.d/pre-install.sh
Normal file → Executable file
@ -1,6 +1,25 @@
|
||||
#!/bin/sh
|
||||
# Bootstrap kubezero-git-sync app only if it doesnt exist yet
|
||||
kubectl get application kubezero-git-sync -n argocd || \
|
||||
yq -i '.argo-cd.kubezero.bootstrap=true' $WORKDIR/values.yaml
|
||||
|
||||
# Bootstrap kubezero-git-sync app if it doenst exist
|
||||
kubectl get application kubezero-git-sync -n argocd && rc=$? || rc=$?
|
||||
# Ensure we have an adminPassword or migrate existing one
|
||||
PW=$(get_kubezero_secret argo-cd.adminPassword)
|
||||
if [ -z "$PW" ]; then
|
||||
# Check for existing password in actual secret
|
||||
NEW_PW=$(get_secret_val argocd argocd-secret "admin.password")
|
||||
|
||||
[ $rc != 0 ] && yq -i '.argo-cd.kubezero.bootstrap=true' values.yaml
|
||||
if [ -z "$NEW_PW" ];then
|
||||
ARGO_PWD=$(date +%s | sha256sum | base64 | head -c 12 ; echo)
|
||||
NEW_PW=$(htpasswd -nbBC 10 "" $ARGO_PWD | tr -d ':\n' | sed 's/$2y/$2a/')
|
||||
|
||||
set_kubezero_secret argo-cd.adminPasswordClear $ARGO_PWD
|
||||
fi
|
||||
|
||||
set_kubezero_secret argo-cd.adminPassword "$NEW_PW"
|
||||
fi
|
||||
|
||||
# GitSync privateKey
|
||||
GITKEY=$(get_kubezero_secret argo-cd.kubezero.sshPrivateKey)
|
||||
if [ -z "$GITKEY" ]; then
|
||||
set_kubezero_secret argo-cd.kubezero.sshPrivateKey "Insert ssh Private Key from your git server"
|
||||
fi
|
||||
|
@ -1,22 +0,0 @@
|
||||
# KubeZero secrets
|
||||
#
|
||||
test: supergeheim
|
||||
secrets:
|
||||
- name: argocd-secret
|
||||
optional: false
|
||||
data:
|
||||
admin.password: test
|
||||
admin.passwordMtime: now
|
||||
server.secretkey: boohoo
|
||||
- name: zero-downtime-gitea
|
||||
optional: true
|
||||
data:
|
||||
name: zero-downtime-gitea
|
||||
type: git
|
||||
url: ssh://git@git.zero-downtime.net/quark/kube-grandnagus.git
|
||||
sshPrivateKey: |
|
||||
boohooKey
|
||||
metadata:
|
||||
labels:
|
||||
argocd.argoproj.io/secret-type: repository
|
||||
|
13
charts/kubezero-argo/templates/argo-cd/admin-secret.yaml
Normal file
13
charts/kubezero-argo/templates/argo-cd/admin-secret.yaml
Normal file
@ -0,0 +1,13 @@
|
||||
{{- if index .Values "argo-cd" "enabled" }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: argocd-secret
|
||||
namespace: argocd
|
||||
labels:
|
||||
{{- include "kubezero-lib.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
stringData:
|
||||
admin.password: {{ index .Values "argo-cd" "configs" "secret" "argocdServerAdminPassword" }}
|
||||
admin.passwordMtime: {{ default (dateInZone "2006-01-02T15:04:05Z" (now) "UTC") }}
|
||||
{{- end }}
|
@ -1,9 +1,11 @@
|
||||
{{- if index .Values "argo-cd" "kubezero" "bootstrap" }}
|
||||
{{- if and (index .Values "argo-cd" "kubezero" "bootstrap") (index .Values "argo-cd" "kubezero" "repoUrl") }}
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: kubezero-git-sync
|
||||
namespace: argocd
|
||||
labels:
|
||||
{{- include "kubezero-lib.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "-20"
|
||||
spec:
|
||||
|
@ -0,0 +1,16 @@
|
||||
{{- if and (index .Values "argo-cd" "kubezero" "sshPrivateKey") (index .Values "argo-cd" "kubezero" "repoUrl") }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: kubezero-git-sync
|
||||
namespace: argocd
|
||||
labels:
|
||||
argocd.argoproj.io/secret-type: repository
|
||||
{{- include "kubezero-lib.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
stringData:
|
||||
name: kubezero-git-sync
|
||||
type: git
|
||||
url: {{ index .Values "argo-cd" "kubezero" "repoUrl" }}
|
||||
sshPrivateKey: {{ index .Values "argo-cd" "kubezero" "sshPrivateKey" }}
|
||||
{{- end }}
|
@ -1,9 +1,11 @@
|
||||
{{- if index .Values "argo-cd" "kubezero" "bootstrap" }}
|
||||
{{- if and (index .Values "argo-cd" "kubezero" "bootstrap") (index .Values "argo-cd" "kubezero" "repoUrl") }}
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: AppProject
|
||||
metadata:
|
||||
name: kubezero
|
||||
namespace: argocd
|
||||
labels:
|
||||
{{- include "kubezero-lib.labels" . | nindent 4 }}
|
||||
spec:
|
||||
clusterResourceWhitelist:
|
||||
- group: '*'
|
||||
|
@ -81,10 +81,9 @@ argo-cd:
|
||||
|
||||
secret:
|
||||
createSecret: false
|
||||
|
||||
# `htpasswd -nbBC 10 "" $ARGO_PWD | tr -d ':\n' | sed 's/$2y/$2a/' | base64 -w0`
|
||||
# argocdServerAdminPassword: "$2a$10$ivKzaXVxMqdeDSfS3nqi1Od3iDbnL7oXrixzDfZFRHlXHnAG6LydG"
|
||||
# argocdServerAdminPassword: "ref+file://secrets.yaml#/test"
|
||||
# argocdServerAdminPasswordMtime: "2020-04-24T15:33:09BST"
|
||||
argocdServerAdminPassword: secretref+k8s://v1/Secret/kubezero/kubezero-secrets/argo-cd.adminPassword
|
||||
|
||||
ssh:
|
||||
extraHosts: "git.zero-downtime.net ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC7UgK7Z4dDcuIW1uMOsuwhrqdkJCvYG/ZjHtLM7WaKFxVRnzNnNkQJNncWIGNDUQ1xxrbsoSNRZDtk0NlOjNtx2aApSWl4iWghkpXELvsZtOZ7I9FSC/E6ImLC3KWfK7P0mhZaF6kHPfpu8Y6pjUyLBTpV1AaVwr0I8onyqGazJOVotTFaBFEi/sT0O2FUk7agwZYfj61w3JGOy3c+fmBcK3lXf/QM90tosOpJNuJ7n5Vk5FDDLkl9rO4XR/+mXHFvITiWb8F5C50YAwjYcy36yWSSryUAAHAuqpgotwh65vSG6fZvFhmEwO2BrCkOV5+k8iRfhy/yZODJzZ5V/5cbMbdZrY6lm/p5/S1wv8BEyPekBGdseqQjEO0IQiQHcMrfgTrrQ7ndbZzVZRByZI+wbGFkBCzNSJcNsoiHjs2EblxYyuW0qUvvrBxLnySvaxyPm4BOukSAZAOEaUrajpQlnHdnY1CGcgbwxw0LNv3euKQ3tDJSUlKO0Wd8d85PRv1THW4Ui9Lhsmv+BPA2vJZDOkx/n0oyPFAB0oyd5JNM38eFxLCmPC2OE63gDP+WmzVO61YCVTnvhpQjEOLawEWVFsk0y25R5z5BboDqJaOFnZF6i517O96cn17z3Ls4hxw3+0rlKczYRoyfUHs7KQENa4mY8YlJweNTBgld//RMUQ=="
|
||||
@ -125,6 +124,7 @@ argo-cd:
|
||||
name: kubeconfigs
|
||||
|
||||
# Allow vals to read internal secrets across all namespaces
|
||||
# @ignored
|
||||
clusterRoleRules:
|
||||
enabled: true
|
||||
rules:
|
||||
@ -132,6 +132,27 @@ argo-cd:
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
|
||||
# @ignored
|
||||
initContainers:
|
||||
- name: create-kubeconfig
|
||||
image: '{{ default .Values.global.image.repository .Values.repoServer.image.repository }}:{{ default (include "argo-cd.defaultTag" .) .Values.repoServer.image.tag }}'
|
||||
imagePullPolicy: '{{ default .Values.global.image.imagePullPolicy .Values.repoServer.image.imagePullPolicy }}'
|
||||
command:
|
||||
- /usr/local/bin/sa2kubeconfig.sh
|
||||
- /home/argocd/.kube/config
|
||||
volumeMounts:
|
||||
- mountPath: /home/argocd/.kube
|
||||
name: kubeconfigs
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
readOnlyRootFilesystem: true
|
||||
allowPrivilegeEscalation: false
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
|
||||
server:
|
||||
# Rename former https port to grpc, works with istio + insecure
|
||||
service:
|
||||
@ -163,12 +184,14 @@ argo-cd:
|
||||
ipBlocks: []
|
||||
|
||||
kubezero:
|
||||
# only set this once initially to prevent the circular dependency
|
||||
# -- deploy the KubeZero Project and GitSync Root App
|
||||
bootstrap: false
|
||||
|
||||
repoUrl: "https://git.my.org/thiscluster"
|
||||
# valid git+ssh repository url
|
||||
repoUrl: ""
|
||||
path: "/"
|
||||
targetRevision: HEAD
|
||||
sshPrivateKey: secretref+k8s://v1/Secret/kubezero/kubezero-secrets/argo-cd.kubezero.sshPrivateKey
|
||||
|
||||
argocd-image-updater:
|
||||
enabled: false
|
||||
|
@ -30,7 +30,7 @@ dependencies:
|
||||
repository: https://aquasecurity.github.io/helm-charts/
|
||||
condition: trivy.enabled
|
||||
- name: renovate
|
||||
version: 39.212.0
|
||||
version: 39.213.3
|
||||
repository: https://docs.renovatebot.com/helm-charts
|
||||
condition: renovate.enabled
|
||||
kubeVersion: ">= 1.25.0"
|
||||
|
@ -21,4 +21,8 @@
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
Chart.lock
|
||||
|
||||
README.md.gotmpl
|
||||
dashboards.yaml
|
||||
jsonnet
|
||||
update.sh
|
||||
|
@ -35,11 +35,10 @@ Kubernetes: `>= 1.31.0-0`
|
||||
| addons.targetRevision | string | `"0.8.13"` | |
|
||||
| argo.argo-cd.enabled | bool | `false` | |
|
||||
| argo.argo-cd.istio.enabled | bool | `false` | |
|
||||
| argo.argocd-apps.enabled | bool | `false` | |
|
||||
| argo.argocd-image-updater.enabled | bool | `false` | |
|
||||
| argo.enabled | bool | `false` | |
|
||||
| argo.namespace | string | `"argocd"` | |
|
||||
| argo.targetRevision | string | `"0.2.9"` | |
|
||||
| argo.targetRevision | string | `"0.3.1"` | |
|
||||
| cert-manager.enabled | bool | `false` | |
|
||||
| cert-manager.namespace | string | `"cert-manager"` | |
|
||||
| cert-manager.targetRevision | string | `"0.9.12"` | |
|
||||
|
@ -1,41 +0,0 @@
|
||||
kind: ApplicationSet
|
||||
metadata:
|
||||
name: kubezero
|
||||
namespace: argocd
|
||||
labels:
|
||||
{{- include "kubezero-lib.labels" . | nindent 4 }}
|
||||
spec:
|
||||
generators:
|
||||
- git:
|
||||
repoURL: {{ .Values.kubezero.applicationSet.repoURL }}
|
||||
revision: {{ .Values.kubezero.applicationSet.revision }}
|
||||
files:
|
||||
{{- toYaml .Values.kubezero.applicationSet.files | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
name: kubezero
|
||||
spec:
|
||||
project: kubezero
|
||||
source:
|
||||
repoURL: https://cdn.zero-downtime.net/charts
|
||||
chart: kubezero
|
||||
targetRevision: '{{ "{{" }} kubezero.version {{ "}}" }}'
|
||||
helm:
|
||||
parameters:
|
||||
# We use this to detect if we are called from ArgoCD
|
||||
- name: argocdAppName
|
||||
value: $ARGOCD_APP_NAME
|
||||
# This breaks the recursion, otherwise we install another kubezero project and app
|
||||
# To be removed once we applicationSet is working and AppProject is moved back to ArgoCD chart
|
||||
- name: installKubeZero
|
||||
value: "false"
|
||||
valueFiles:
|
||||
- '{{ "{{" }} kubezero.valuesPath {{ "}}" }}/kubezero.yaml'
|
||||
- '{{ "{{" }} kubezero.valuesPath {{ "}}" }}/values.yaml'
|
||||
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: argocd
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true
|
6
charts/kubezero/hooks.d/pre-install.sh
Normal file
6
charts/kubezero/hooks.d/pre-install.sh
Normal file
@ -0,0 +1,6 @@
|
||||
# ensure we have a basic kubezero secret for cluster bootstrap and defaults
|
||||
kubectl get secret kubezero-secrets -n kubezero && rc=$? || rc=$?
|
||||
|
||||
if [ $rc != 0 ]; then
|
||||
kubectl create secret generic kubezero-secrets -n kubezero
|
||||
fi
|
@ -1,7 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
ns=$(kubectl get ns -l argocd.argoproj.io/instance | grep -v NAME | awk '{print $1}')
|
||||
|
||||
for n in $ns; do
|
||||
kubectl label --overwrite namespace $n 'argocd.argoproj.io/instance-'
|
||||
done
|
@ -1,25 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License;
|
||||
# you may not use this file except in compliance with the Elastic License.
|
||||
|
||||
# Script to migrate an existing ECK 1.2.1 installation to Helm.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
RELEASE_NAMESPACE=${RELEASE_NAMESPACE:-"elastic-system"}
|
||||
|
||||
echo "Uninstalling ECK"
|
||||
kubectl delete -n "${RELEASE_NAMESPACE}" \
|
||||
serviceaccount/elastic-operator \
|
||||
secret/elastic-webhook-server-cert \
|
||||
clusterrole.rbac.authorization.k8s.io/elastic-operator \
|
||||
clusterrole.rbac.authorization.k8s.io/elastic-operator-view \
|
||||
clusterrole.rbac.authorization.k8s.io/elastic-operator-edit \
|
||||
clusterrolebinding.rbac.authorization.k8s.io/elastic-operator \
|
||||
rolebinding.rbac.authorization.k8s.io/elastic-operator \
|
||||
service/elastic-webhook-server \
|
||||
statefulset.apps/elastic-operator \
|
||||
validatingwebhookconfiguration.admissionregistration.k8s.io/elastic-webhook.k8s.elastic.co
|
||||
|
@ -25,7 +25,8 @@ spec:
|
||||
repoURL: {{ default "https://cdn.zero-downtime.net/charts" (index .Values $name "repository") }}
|
||||
targetRevision: {{ default "HEAD" ( index .Values $name "targetRevision" ) | quote }}
|
||||
helm:
|
||||
skipTests: true
|
||||
# add with 1.32
|
||||
#skipTests: true
|
||||
valuesObject:
|
||||
{{- include (print $name "-values") $ | nindent 8 }}
|
||||
|
||||
|
@ -115,7 +115,7 @@ logging:
|
||||
argo:
|
||||
enabled: false
|
||||
namespace: argocd
|
||||
targetRevision: 0.3.0
|
||||
targetRevision: 0.3.1
|
||||
argo-cd:
|
||||
enabled: false
|
||||
istio:
|
||||
|
11
docs/hooks.md
Normal file
11
docs/hooks.md
Normal file
@ -0,0 +1,11 @@
|
||||
# KubeZero Helm hooks
|
||||
|
||||
## Abstract
|
||||
Scripts within the `hooks.d` folder of each chart are executed at the respective times when the charts are applied via libhelm.
|
||||
|
||||
*These hooks do NOT work via ArgoCD*
|
||||
|
||||
## Flow
|
||||
- hooks are execute as part of the libhelm tasks like `apply`
|
||||
- are running with the current kubectl context
|
||||
- executed at root working directory, eg. set a value for helm the scripts can edit the `./values.yaml` file.
|
@ -3,6 +3,7 @@
|
||||
## What's new - Major themes
|
||||
- all KubeZero and support AMIs based on [Alpine 3.21](https://alpinelinux.org/posts/Alpine-3.21.0-released.html)
|
||||
- network policies for ArgoCD
|
||||
- Nvidia worker nodes are labeled with detected GPU product code
|
||||
- Prometheus upgraded to V3, reducing CPU and memory requirements, see [upstream blog](https://prometheus.io/blog/2024/11/14/prometheus-3-0/)
|
||||
|
||||
## Features and fixes
|
||||
@ -10,10 +11,10 @@
|
||||
|
||||
## Version upgrades
|
||||
- cilium 1.16.6
|
||||
- istio 1.24.2
|
||||
- ArgoCD 2.14.3 [custom ZDT image](https://git.zero-downtime.net/ZeroDownTime/zdt-argocd)
|
||||
- istio 1.24.3
|
||||
- ArgoCD 2.14.5 [custom ZDT image](https://git.zero-downtime.net/ZeroDownTime/zdt-argocd)
|
||||
- Prometheus 3.1.0 / Grafana 11.5.1
|
||||
- Nvidia container toolkit 1.17, drivers 565.57.01, Cuda 12.7
|
||||
- Nvidia container toolkit 1.17.4, drivers 570.86.15, Cuda 12.8
|
||||
|
||||
## Resources
|
||||
- [Kubernetes v1.31 upstream release blog](https://kubernetes.io/blog/2024/08/13/kubernetes-v1-31-release/)
|
||||
|
@ -18,7 +18,7 @@ update_jsonnet() {
|
||||
|
||||
update_helm() {
|
||||
#helm repo update
|
||||
helm dep update
|
||||
helm dep build
|
||||
}
|
||||
|
||||
# AWS public ECR
|
||||
|
Loading…
x
Reference in New Issue
Block a user