Skip to content

Commit b310f2b

Browse files
nihussmannnihussmann
committed
centralized Repos via Operator, RBACs, Projects and Applications for Argocd
1 parent 5a8cbe4 commit b310f2b

File tree

57 files changed

+1417
-462
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

57 files changed

+1417
-462
lines changed

‎.gitignore‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,11 @@
22
.run
33
*.iml
44
target
5+
6+
#includes just the .sh files in local
7+
.scripts/local/**
8+
!scripts/local/**/*.sh
9+
510
# do not check in the workspace
611
workspace/
712

@@ -18,4 +23,4 @@ terraform/account.json
1823

1924
gitops-playground.jar
2025
jenkins-plugins
21-
/charts/
26+
/charts/

‎argocd/argocd/applications/argocd.ftl.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,4 +29,4 @@ spec:
2929
syncPolicy:
3030
automated:
3131
prune: false # is set to false to prevent argo from deleting itself
32-
selfHeal: true
32+
selfHeal: true

‎argocd/argocd/applications/bootstrap.ftl.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,4 @@ spec:
2121
syncPolicy:
2222
automated:
2323
prune: false # is set to false to prevent projects to be deleted by accident
24-
selfHeal: true
24+
selfHeal: true

‎argocd/argocd/applications/cluster-resources.ftl.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,4 +20,4 @@ spec:
2020
syncPolicy:
2121
automated:
2222
prune: false # is set to false to prevent projects to be deleted by accident
23-
selfHeal: true
23+
selfHeal: true

‎argocd/argocd/applications/projects.ftl.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,4 +20,4 @@ spec:
2020
syncPolicy:
2121
automated:
2222
prune: false # is set to false to prevent projects to be deleted by accident
23-
selfHeal: true
23+
selfHeal: true

‎argocd/argocd/multiTenant/central/applications/argocd.ftl.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: ${namePrefix}argocd
5+
namespace: argocd
6+
annotations:
7+
# Only app with the sync-status-unknown alert, so that we only get one alert when SCM is not reachable.
8+
# Otherwise, there would be a spam wave by every application everytime the SCM is not reachable.
9+
<#if mail.active?? && mail.active>
10+
notifications.argoproj.io/subscribe.on-sync-status-unknown.email: ${argocd.emailToAdmin}
11+
</#if>
12+
# finalizer disabled, because otherwise everything under this Application would be deleted as well, if this Application is deleted by accident
13+
# finalizers:
14+
# - resources-finalizer.argocd.argoproj.io
15+
spec:
16+
destination:
17+
server: https://kubernetes.default.svc
18+
namespace: ${namePrefix}argocd
19+
project: ${tenantName}
20+
source:
21+
path: ${argocd.isOperator?string("operator/", "argocd/")}
22+
repoURL: ${scmm.centralScmmUrl}/repo/${namePrefix}argocd/argocd
23+
targetRevision: main
24+
# needed to sync the operator/rbac folder
25+
<#if argocd.isOperator??>
26+
directory:
27+
recurse: true
28+
</#if>
29+
syncPolicy:
30+
automated:
31+
prune: false # is set to false to prevent argo from deleting itself
32+
selfHeal: true

‎argocd/argocd/multiTenant/central/applications/bootstrap.ftl.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# This is the root Applications, which manages all other applications with the app-of-apps-pattern.
2+
apiVersion: argoproj.io/v1alpha1
3+
kind: Application
4+
metadata:
5+
name: ${namePrefix}bootstrap
6+
namespace: argocd
7+
# finalizer disabled, because otherwise everything under this Application would be deleted as well, if this Application is deleted by accident
8+
# finalizers:
9+
# - resources-finalizer.argocd.argoproj.io
10+
spec:
11+
destination:
12+
server: https://kubernetes.default.svc
13+
namespace: ${namePrefix}argocd
14+
project: ${tenantName}
15+
source:
16+
path: multiTenant/central/applications/
17+
repoURL: ${scmm.centralScmmUrl}/repo/${namePrefix}argocd/argocd
18+
targetRevision: main
19+
directory:
20+
recurse: true
21+
syncPolicy:
22+
automated:
23+
prune: false # is set to false to prevent projects to be deleted by accident
24+
selfHeal: true

‎argocd/argocd/multiTenant/central/applications/cluster-resources.ftl.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: ${namePrefix}cluster-resources
5+
namespace: argocd
6+
# finalizer disabled, because otherwise everything under this Application would be deleted as well, if this Application is deleted by accident
7+
# finalizers:
8+
# - resources-finalizer.argocd.argoproj.io
9+
spec:
10+
destination:
11+
namespace: ${namePrefix}argocd
12+
server: https://kubernetes.default.svc
13+
project: ${tenantName}
14+
source:
15+
path: argocd/
16+
repoURL: ${scmm.centralScmmUrl}/repo/${namePrefix}argocd/cluster-resources
17+
targetRevision: main
18+
directory:
19+
recurse: true
20+
syncPolicy:
21+
automated:
22+
prune: false # is set to false to prevent projects to be deleted by accident
23+
selfHeal: true

‎argocd/argocd/multiTenant/central/applications/projects.ftl.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: ${namePrefix}projects
5+
namespace: argocd
6+
# finalizer disabled, because otherwise everything under this Application would be deleted as well, if this Application is deleted by accident
7+
# finalizers:
8+
# - resources-finalizer.argocd.argoproj.io
9+
spec:
10+
destination:
11+
server: https://kubernetes.default.svc
12+
namespace: ${namePrefix}argocd
13+
project: ${tenantName}
14+
source:
15+
path: multiTenant/central/projects/
16+
repoURL: ${scmm.centralScmmUrl}/repo/${namePrefix}argocd/argocd
17+
targetRevision: main
18+
directory:
19+
recurse: true
20+
syncPolicy:
21+
automated:
22+
prune: false # is set to false to prevent projects to be deleted by accident
23+
selfHeal: true

‎argocd/argocd/multiTenant/central/projects/tenant.ftl.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: AppProject
3+
metadata:
4+
name: ${tenantName}
5+
namespace: argocd
6+
spec:
7+
description: Contains Cluster Ressources for MultiTentant Mode
8+
destinations:
9+
- namespace: '*'
10+
server: https://kubernetes.default.svc
11+
sourceRepos:
12+
- ${scmm.centralScmmUrl}/repo/${namePrefix}argocd/argocd
13+
- ${scmm.centralScmmUrl}/repo/${namePrefix}argocd/cluster-resources
14+
<#if mirrorRepos>
15+
- ${scmm.repoUrl}3rd-party-dependencies/kube-prometheus-stack<#if scmm.provider == "gitlab">.git</#if>
16+
- ${scmm.repoUrl}3rd-party-dependencies/mailhog<#if scmm.provider == "gitlab">.git</#if>
17+
- ${scmm.repoUrl}3rd-party-dependencies/ingress-nginx<#if scmm.provider == "gitlab">.git</#if>
18+
- ${scmm.repoUrl}3rd-party-dependencies/external-secrets<#if scmm.provider == "gitlab">.git</#if>
19+
- ${scmm.repoUrl}3rd-party-dependencies/vault<#if scmm.provider == "gitlab">.git</#if>
20+
- ${scmm.repoUrl}3rd-party-dependencies/cert-manager<#if scmm.provider == "gitlab">.git</#if>
21+
<#else>
22+
- https://prometheus-community.github.io/helm-charts
23+
- https://codecentric.github.io/helm-charts
24+
- https://kubernetes.github.io/ingress-nginx
25+
- https://helm.releases.hashicorp.com
26+
- https://charts.external-secrets.io
27+
- https://charts.jetstack.io
28+
</#if>
29+
30+
# allow to only see application resources from the specified namespace
31+
sourceNamespaces:
32+
- '*'
33+
34+
# Allow all namespaced-scoped resources to be created
35+
namespaceResourceWhitelist:
36+
- group: '*'
37+
kind: '*'
38+
39+
# Deny all cluster-scoped resources from being created. Least privilege.
40+
clusterResourceWhitelist:

0 commit comments

Comments
 (0)