Migrate DORA RDS Cluster to KRO and ACK

gitops/addons/bootstrap/default/addons.yaml

@@ -163,6 +163,40 @@ ack-s3:
       managedFieldsManagers:
         - kube-controller-manager
 
+ack-rds:
+  enabled: false
+  enableACK: false
+  annotationsAppSet:
+    argocd.argoproj.io/sync-wave: '-1' # Needs to be after kro RGD
+  namespace: ack-system
+  chartName: rds-chart
+  defaultVersion: '1.7.6'
+  chartNamespace: aws-controllers-k8s
+  chartRepository: public.ecr.aws
+  releaseName: rds-chart
+  selector:
+    matchExpressions:
+      - key: enable_ack_rds
+        operator: In
+        values: ['true']
+  valuesObject:
+    aws:
+      region: '{{.metadata.annotations.aws_region}}'
+    serviceAccount:
+      name: '{{default "ack-rds-controller" (index .metadata.annotations "ack_rds_service_account")}}'
+  ignoreDifferences:
+    - group: apiextensions.k8s.io
+      kind: CustomResourceDefinition
+      jsonPointers:
+        - /metadata/annotations/controller-gen.kubebuilder.io~1version
+      jqPathExpressions:
+        - '.spec.versions[].schema.openAPIV3Schema | .. | .generateName?'
+        - '.spec.versions[].schema.openAPIV3Schema | .. | .description?'
+    - group: apiextensions.k8s.io
+      kind: CustomResourceDefinition
+      managedFieldsManagers:
+        - kube-controller-manager
+
 ack-dynamodb:
   enabled: false
   enableACK: false
@@ -617,7 +651,7 @@ kro-manifests:
   path: '{{.metadata.annotations.addons_repo_basepath}}charts/kro/resource-groups/manifests'
   directory:
     recurse: true
-    exclude: '{cicd-pipeline/**,huggingface/**,ray-service/**}'
+    exclude: '{cicd-pipeline/**,huggingface/**,ray-service/**,rds/**}'
   selector:
     matchExpressions:
       - key: enable_kro_manifests
@@ -1046,6 +1080,11 @@ devlake:
   valuesObject:
     clusterName: '{{.metadata.annotations.aws_cluster_name}}'
     clusterRegion: '{{.metadata.annotations.aws_region}}'
+    awsAccountId: '{{.metadata.annotations.aws_account_id}}'
+    resourcePrefix: '{{.metadata.annotations.resource_prefix}}'
+    rds:
+      privateSubnetIds: '{{.metadata.annotations.aws_subnet_ids}}'
+      vpcId: '{{.metadata.annotations.aws_vpc_id}}'
     devlake:
       grafana:
         enabled: false

gitops/addons/charts/devlake/templates/external-secret.yaml

@@ -77,13 +77,13 @@ spec:
     match:
       secretKey: EXTERNAL_URL
       remoteRef:
-        remoteKey: peeks-devlake/mysql-connection
+        remoteKey: {{ .Values.clusterName }}/devlake-mysql-connection
         property: db_url
   - conversionStrategy: None
     match:
       secretKey: MYSQL_ROOT_PASSWORD
       remoteRef:
-        remoteKey: peeks-devlake/mysql-connection
+        remoteKey: {{ .Values.clusterName }}/devlake-mysql-connection
         property: root_password
 
 

gitops/addons/charts/devlake/templates/iam-role-selectors.yaml

@@ -0,0 +1,33 @@
+apiVersion: services.k8s.aws/v1alpha1
+kind: IAMRoleSelector
+metadata:
+  name: {{ .Values.namespace | default "devlake" }}-ec2
+  annotations:
+    argocd.argoproj.io/sync-wave: "-3"
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  arn: arn:aws:iam::{{ .Values.awsAccountId }}:role/{{ .Values.resourcePrefix }}-cluster-mgmt-ec2
+  namespaceSelector:
+    names:
+      - {{ .Values.namespace | default "devlake" }}
+  resourceTypeSelector:
+    - group: ec2.services.k8s.aws
+      kind: ""
+      version: ""
+---
+apiVersion: services.k8s.aws/v1alpha1
+kind: IAMRoleSelector
+metadata:
+  name: {{ .Values.namespace | default "devlake" }}-rds
+  annotations:
+    argocd.argoproj.io/sync-wave: "-3"
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  arn: arn:aws:iam::{{ .Values.awsAccountId }}:role/{{ .Values.resourcePrefix }}-cluster-mgmt-rds
+  namespaceSelector:
+    names:
+      - {{ .Values.namespace | default "devlake" }}
+  resourceTypeSelector:
+    - group: rds.services.k8s.aws
+      kind: ""
+      version: ""

gitops/addons/charts/devlake/templates/rds-ack.yaml

@@ -0,0 +1,15 @@
+apiVersion: kro.run/v1alpha1
+kind: RelationalDatabase
+metadata:
+  name: devlake-mysql
+  namespace: {{ .Values.namespace | default "devlake" }}
+  annotations:
+    argocd.argoproj.io/sync-wave: "-2"
+spec:
+  databaseName: devlake
+  engineVersion: {{ .Values.rds.engineVersion | default "8.0.mysql_aurora.3.10.0" }}
+  instanceClass: {{ .Values.rds.instanceClass | default "db.r5.large" }}
+  region: {{ .Values.clusterRegion }}
+  privateSubnetIds: {{ splitList "," .Values.rds.privateSubnetIds | toJson }}
+  vpcId: {{ .Values.rds.vpcId }}
+  createService: true

gitops/addons/charts/devlake/templates/setup-workflow.yaml

@@ -44,7 +44,7 @@ spec:
         arguments:
           parameters:
           - name: connection-secret-namespace
-            value: "crossplane-system"
+            value: {{ .Values.namespace | default "devlake" }}
       - name: create-secrets
         template: create-secrets
         arguments:
@@ -75,16 +75,16 @@ spec:
       command: ["/bin/sh", "-c"]
       args:
       - |
-        SECRET_NAME=$(kubectl get secrets -n {{`{{inputs.parameters.connection-secret-namespace}}`}} -o name | grep "devlake-mysql.*cluster-mysql-connection$" | head -1 | cut -d'/' -f2)
+        SECRET_NAME=$(kubectl get secrets -n {{`{{inputs.parameters.connection-secret-namespace}}`}} -o name | grep "devlake-mysql-credentials" | head -1 | cut -d'/' -f2)
 
         if [ -z "$SECRET_NAME" ]; then
           echo "Secret not found yet"
           exit 1
         fi
 
-        # Check if password is available in the secret
-        endpoint=$(kubectl get secret ${SECRET_NAME} -n {{`{{inputs.parameters.connection-secret-namespace}}`}} -o jsonpath='{.data.endpoint}' 2>/dev/null | base64 -d 2>/dev/null || true)
-        password=$(kubectl get secret ${SECRET_NAME} -n {{`{{inputs.parameters.connection-secret-namespace}}`}} -o jsonpath='{.data.attribute\.master_password}' 2>/dev/null | base64 -d 2>/dev/null || true)
+        # Read credentials from RGD-created secret (keys: host, password)
+        endpoint=$(kubectl get secret ${SECRET_NAME} -n {{`{{inputs.parameters.connection-secret-namespace}}`}} -o jsonpath='{.data.host}' 2>/dev/null | base64 -d 2>/dev/null || true)
+        password=$(kubectl get secret ${SECRET_NAME} -n {{`{{inputs.parameters.connection-secret-namespace}}`}} -o jsonpath='{.data.password}' 2>/dev/null | base64 -d 2>/dev/null || true)
 
         if [ -z "$password" ] || [ -z "$endpoint" ]; then
           echo "Secret found but values not available yet"
@@ -130,10 +130,6 @@ spec:
         merico_password=$(kubectl get secret mysql-passwords -n devlake -o jsonpath='{.data.DEVLAKE_MYSQL_PASSWORD}' | base64 -d)
         grafana_password=$(kubectl get secret mysql-passwords -n devlake -o jsonpath='{.data.GRAFANA_MYSQL_PASSWORD}' | base64 -d)
 
-        # Create service pointing to the RDS endpoint
-        kubectl delete service devlake-mysql-service -n devlake --ignore-not-found
-        kubectl create service externalname devlake-mysql-service --external-name="${endpoint}" -n devlake --dry-run=client -o yaml | kubectl apply -f -
-
         # Create auth secret with credentials
         kubectl delete secret devlake-mysql-auth -n devlake --ignore-not-found
         kubectl create secret generic devlake-mysql-auth -n devlake \

gitops/addons/charts/grafana-dashboards/templates/external-secret.yaml

@@ -75,5 +75,5 @@ spec:
       conversionStrategy: Default
       decodingStrategy: None
       metadataPolicy: None
-      key: peeks-devlake/mysql-connection
+      key: {{ .Values.clusterName }}/devlake-mysql-connection
       property: db_url