Skip to content

Commit 2a470dc

Browse files
foster-rhfoster-rh
authored
Merge pull request #11 from rh-mobb/foster/acm-stuff
Foster/acm stuff
2 parents 2520455 + 27bfddf commit 2a470dc

12 files changed

Lines changed: 208 additions & 3 deletions

File tree

‎charts/app-of-apps-acm-team-onboarding/Chart.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: v2
2+
name: app-of-apps-acm-team-onboarding
3+
description: Chart to onboard teams on an ACM hub with AppProjects, RBAC, and placement infrastructure for spoke deployment via ApplicationSets
4+
version: 0.1.0
5+
home: https://rh-mobb.github.io/validated-pattern-helm-charts/
6+
maintainers:
7+
- name: rh-mobb

‎charts/app-of-apps-acm-team-onboarding/templates/appproject.yaml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{{ range $app := .Values.applications }}
2+
{{ if $app.gitopsCreate }}
3+
---
4+
apiVersion: argoproj.io/v1alpha1
5+
kind: AppProject
6+
metadata:
7+
name: {{ $app.apmnum }}-{{ $app.appserviceNumber }}-project
8+
namespace: {{ $.Values.gitopsNamespace }}
9+
finalizers:
10+
- resources-finalizer.argocd.argoproj.io
11+
spec:
12+
description: "{{ $app.apmnum }}-{{ $app.appserviceNumber }} team project (ACM spoke deployment)"
13+
sourceNamespaces:
14+
- {{ $app.apmnum }}-{{ $app.appserviceNumber }}-team
15+
sourceRepos:
16+
{{- toYaml $app.appProject.repos | nindent 4 }}
17+
clusterResourceWhitelist:
18+
- group: ''
19+
kind: Namespace
20+
destinations:
21+
{{- range $ns := $app.appProject.spokeNamespaces }}
22+
- namespace: {{ $ns }}
23+
server: 'https://kubernetes.default.svc'
24+
{{- end }}
25+
{{- if $app.appProject.destinations }}
26+
{{- toYaml $app.appProject.destinations | nindent 4 }}
27+
{{- end }}
28+
roles:
29+
{{- if $app.appProject.roles }}
30+
{{- toYaml $app.appProject.roles | nindent 4 }}
31+
{{- else }}
32+
- name: team-appset-admin
33+
description: "Allows {{ $app.appProject.adGroup }} to manage applications and applicationsets"
34+
policies:
35+
- "p, proj:{{ $app.apmnum }}-{{ $app.appserviceNumber }}-project:team-appset-admin, applications, *, {{ $app.apmnum }}-{{ $app.appserviceNumber }}-project/*, allow"
36+
- "p, proj:{{ $app.apmnum }}-{{ $app.appserviceNumber }}-project:team-appset-admin, applicationsets, *, {{ $app.apmnum }}-{{ $app.appserviceNumber }}-project/*, allow"
37+
groups:
38+
- {{ $app.appProject.adGroup }}
39+
{{- end }}
40+
{{- end }}
41+
{{- end }}

‎charts/app-of-apps-acm-team-onboarding/templates/clusterrolebinding.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRoleBinding
4+
metadata:
5+
name: {{ .Values.gitopsNamespace }}-applicationset-placementdecision-reader
6+
annotations:
7+
argocd.argoproj.io/sync-wave: "10"
8+
roleRef:
9+
apiGroup: rbac.authorization.k8s.io
10+
kind: ClusterRole
11+
name: applicationset-placementdecision-reader
12+
subjects:
13+
- kind: ServiceAccount
14+
name: {{ .Values.gitopsNamespace }}-applicationset-controller
15+
namespace: {{ .Values.gitopsNamespace }}

‎charts/app-of-apps-acm-team-onboarding/templates/managedclusterset-binding.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
apiVersion: cluster.open-cluster-management.io/v1beta2
3+
kind: ManagedClusterSetBinding
4+
metadata:
5+
name: global
6+
namespace: {{ .Values.gitopsNamespace }}
7+
finalizers:
8+
- resources-finalizer.argocd.argoproj.io
9+
annotations:
10+
argocd.argoproj.io/sync-wave: "10"
11+
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
12+
spec:
13+
clusterSet: global

‎charts/app-of-apps-acm-team-onboarding/templates/namespace.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{{ range $app := .Values.applications }}
2+
{{ if $app.gitopsCreate }}
3+
---
4+
apiVersion: v1
5+
kind: Namespace
6+
metadata:
7+
name: {{ $app.apmnum }}-{{ $app.appserviceNumber }}-team
8+
labels:
9+
argocd.argoproj.io/managed-by: {{ $.Values.gitopsNamespace }}
10+
{{- if $app.labels }}
11+
{{- toYaml $app.labels | nindent 4 }}
12+
{{- end }}
13+
{{- if $app.annotations }}
14+
annotations:
15+
{{- toYaml $app.annotations | nindent 4 }}
16+
{{- end }}
17+
{{- end }}
18+
{{- end }}

‎charts/app-of-apps-acm-team-onboarding/templates/placement.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
apiVersion: cluster.open-cluster-management.io/v1beta1
3+
kind: Placement
4+
metadata:
5+
name: all-spoke-clusters
6+
namespace: {{ .Values.gitopsNamespace }}
7+
finalizers:
8+
- resources-finalizer.argocd.argoproj.io
9+
annotations:
10+
argocd.argoproj.io/sync-wave: "10"
11+
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
12+
spec:
13+
clusterSets:
14+
- global
15+
predicates:
16+
- requiredClusterSelector:
17+
labelSelector:
18+
matchExpressions:
19+
- key: acm
20+
operator: In
21+
values:
22+
- spoke
23+
decisionStrategy:
24+
groupStrategy:
25+
clustersPerDecisionGroup: 100
26+
decisionGroups:
27+
- groupName: spoke-clusters
28+
groupClusterSelector:
29+
labelSelector:
30+
matchLabels: {}
31+
---
32+
apiVersion: v1
33+
kind: ConfigMap
34+
metadata:
35+
name: acm-placement
36+
namespace: {{ .Values.gitopsNamespace }}
37+
annotations:
38+
argocd.argoproj.io/sync-wave: "10"
39+
data:
40+
apiVersion: cluster.open-cluster-management.io/v1beta1
41+
kind: placementdecisions
42+
statusListKey: decisions
43+
matchKey: clusterName

‎charts/app-of-apps-acm-team-onboarding/templates/role.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{{ range $app := .Values.applications }}
2+
{{ if $app.gitopsCreate }}
3+
---
4+
apiVersion: rbac.authorization.k8s.io/v1
5+
kind: Role
6+
metadata:
7+
name: {{ $app.apmnum }}-{{ $app.appserviceNumber }}-appset-admin
8+
namespace: {{ $app.apmnum }}-{{ $app.appserviceNumber }}-team
9+
rules:
10+
- apiGroups:
11+
- argoproj.io
12+
resources:
13+
- applicationsets
14+
verbs:
15+
- get
16+
- list
17+
- watch
18+
- create
19+
- update
20+
- patch
21+
- delete
22+
- apiGroups:
23+
- argoproj.io
24+
resources:
25+
- applications
26+
verbs:
27+
- get
28+
- list
29+
- watch
30+
---
31+
apiVersion: rbac.authorization.k8s.io/v1
32+
kind: RoleBinding
33+
metadata:
34+
name: {{ $app.apmnum }}-{{ $app.appserviceNumber }}-appset-admin
35+
namespace: {{ $app.apmnum }}-{{ $app.appserviceNumber }}-team
36+
roleRef:
37+
apiGroup: rbac.authorization.k8s.io
38+
kind: Role
39+
name: {{ $app.apmnum }}-{{ $app.appserviceNumber }}-appset-admin
40+
subjects:
41+
- apiGroup: rbac.authorization.k8s.io
42+
kind: Group
43+
name: {{ $app.appProject.adGroup }}
44+
{{- end }}
45+
{{- end }}

‎charts/app-of-apps-acm-team-onboarding/values.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
gitopsNamespace: application-gitops
2+
3+
# applications:
4+
# - name: istio-demo
5+
# apmnum: "istio"
6+
# appserviceNumber: "demo"
7+
# gitopsCreate: true
8+
# appProject:
9+
# adGroup: PFAUTHAD
10+
# repos:
11+
# - 'https://rh-mobb.github.io/validated-pattern-helm-charts'
12+
# - 'https://github.com/rh-mobb/rosa-cluster-config.git'
13+
# spokeNamespaces:
14+
# - istio-system
15+
# - istio-demo

‎charts/application-gitops/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: v1
22
description: Chart to generate argocd apps
33
name: application-gitops
4-
version: 1.5.0
4+
version: 1.5.1
55
home: https://rh-mobb.github.io/validated-pattern-helm-charts/
66
maintainers:
77
- name: rh-mobb

‎charts/application-gitops/templates/argocd-crd.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,14 @@ spec:
1313
- '*-team'
1414
- application-gitops
1515
applicationInstanceLabelKey: argocd.argoproj.io/instance
16+
applicationSet:
17+
resources:
18+
limits:
19+
cpu: '1'
20+
memory: 512Mi
21+
requests:
22+
cpu: 250m
23+
memory: 256Mi
1624
controller:
1725
processors: {}
1826
resources:

0 commit comments

Comments
 (0)