Skip to content

Commit d2b0dc7

Browse files
csantanaprcsantanapr
authored
Merge pull request #5 from gitops-bridge-dev/private-git-example
Add example to show private git credentials for argocd
2 parents 26b102e + 89284f6 commit d2b0dc7

File tree

9 files changed

+565
-0
lines changed

9 files changed

+565
-0
lines changed

‎argocd/iac/terraform/examples/eks/private-git/README.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# ArgoCD on Amazon EKS
2+
3+
This example shows how to deploy Amazon EKS with addons configured via ArgoCD
4+
5+
The example demonstrate how to use private git repository for addons and workload.
6+
7+
The example reads your private ssh key, and creates two secretes to access the git repository for addons and another one for workloads
8+
9+
## Prerequisites
10+
- Create a Github ssh key file, example assumes the file path `~/.ssh/id_rsa`, update `main.tf` if using a different location
11+
12+
Deploy EKS Cluster
13+
```shell
14+
terraform init
15+
terraform apply
16+
```
17+
18+
Access Terraform output to configure `kubectl` and `argocd`
19+
```shell
20+
terraform output
21+
```
22+
23+
Destroy EKS Cluster
24+
```shell
25+
cd hub
26+
./destroy.sh
27+
```

‎argocd/iac/terraform/examples/eks/private-git/bootstrap/addons.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: bootstrap-addons
5+
namespace: 'argocd'
6+
spec:
7+
destination:
8+
server: https://kubernetes.default.svc
9+
namespace: 'argocd'
10+
project: default
11+
source:
12+
path: ${path}
13+
repoURL: ${repoURL}
14+
targetRevision: ${targetRevision}
15+
directory:
16+
recurse: true
17+
exclude: exclude/*
18+
syncPolicy:
19+
automated: {}

‎argocd/iac/terraform/examples/eks/private-git/bootstrap/workloads.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: bootstrap-workloads
5+
namespace: 'argocd'
6+
finalizers:
7+
- resources-finalizer.argocd.argoproj.io
8+
spec:
9+
destination:
10+
server: https://kubernetes.default.svc
11+
namespace: 'guestbook'
12+
project: default
13+
source:
14+
path: ${path}
15+
repoURL: ${repoURL}
16+
targetRevision: ${targetRevision}
17+
syncPolicy:
18+
automated: {}
19+
syncOptions:
20+
- CreateNamespace=true

‎argocd/iac/terraform/examples/eks/private-git/destroy.sh‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/bin/bash
2+
3+
set -x
4+
5+
# Delete the Ingress/SVC before removing the addons
6+
TMPFILE=$(mktemp)
7+
terraform output -raw configure_kubectl > "$TMPFILE"
8+
source "$TMPFILE"
9+
10+
kubectl delete svc -n argocd argo-cd-argocd-server
11+
12+
terraform destroy -target="module.gitops_bridge_bootstrap" -auto-approve
13+
terraform destroy -target="module.eks_blueprints_addons" -auto-approve
14+
terraform destroy -target="module.eks" -auto-approve
15+
terraform destroy -target="module.vpc" -auto-approve
16+
terraform destroy -auto-approve

‎argocd/iac/terraform/examples/eks/private-git/main.tf‎

Lines changed: 299 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,299 @@
1+
provider "aws" {
2+
region = local.region
3+
}
4+
data "aws_caller_identity" "current" {}
5+
data "aws_availability_zones" "available" {}
6+
7+
provider "helm" {
8+
kubernetes {
9+
host = module.eks.cluster_endpoint
10+
cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
11+
12+
exec {
13+
api_version = "client.authentication.k8s.io/v1beta1"
14+
command = "aws"
15+
# This requires the awscli to be installed locally where Terraform is executed
16+
args = ["eks", "get-token", "--cluster-name", module.eks.cluster_name, "--region", local.region]
17+
}
18+
}
19+
}
20+
21+
provider "kubectl" {
22+
host = module.eks.cluster_endpoint
23+
cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
24+
exec {
25+
api_version = "client.authentication.k8s.io/v1beta1"
26+
args = ["eks", "get-token", "--cluster-name", module.eks.cluster_name, "--region", local.region]
27+
command = "aws"
28+
}
29+
load_config_file = false
30+
apply_retry_count = 15
31+
}
32+
33+
provider "kubernetes" {
34+
host = module.eks.cluster_endpoint
35+
cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
36+
37+
exec {
38+
api_version = "client.authentication.k8s.io/v1beta1"
39+
command = "aws"
40+
# This requires the awscli to be installed locally where Terraform is executed
41+
args = ["eks", "get-token", "--cluster-name", module.eks.cluster_name, "--region", local.region]
42+
}
43+
}
44+
45+
locals {
46+
name = "ex-${replace(basename(path.cwd), "_", "-")}"
47+
environment = "dev"
48+
region = "us-west-2"
49+
cluster_version = "1.27"
50+
51+
git_private_ssh_key = "~/.ssh/id_rsa" # Update with the git ssh key to be used by ArgoCD
52+
53+
gitops_addons_org = "git@github.com:gitops-bridge-dev"
54+
gitops_addons_repo = "gitops-bridge-argocd-control-plane-template"
55+
gitops_addon_path = "bootstrap/control-plane/addons"
56+
gitops_addon_revision = "HEAD"
57+
58+
gitops_workloads_org = "git@github.com:argoproj"
59+
gitops_workloads_repo = "argocd-example-apps"
60+
gitops_workloads_path = "helm-guestbook"
61+
gitops_workloads_revision = "HEAD"
62+
63+
aws_addons = {
64+
enable_cert_manager = true
65+
#enable_aws_efs_csi_driver = true
66+
#enable_aws_fsx_csi_driver = true
67+
#enable_aws_cloudwatch_metrics = true
68+
#enable_aws_privateca_issuer = true
69+
#enable_cluster_autoscaler = true
70+
#enable_external_dns = true
71+
#enable_external_secrets = true
72+
#enable_aws_load_balancer_controller = true
73+
#enable_fargate_fluentbit = true
74+
#enable_aws_for_fluentbit = true
75+
#enable_aws_node_termination_handler = true
76+
#enable_karpenter = true
77+
#enable_velero = true
78+
#enable_aws_gateway_api_controller = true
79+
#enable_aws_ebs_csi_resources = true # generate gp2 and gp3 storage classes for ebs-csi
80+
#enable_aws_secrets_store_csi_driver_provider = true
81+
}
82+
oss_addons = {
83+
#enable_argo_rollouts = true
84+
#enable_argo_workflows = true
85+
#enable_cluster_proportional_autoscaler = true
86+
#enable_gatekeeper = true
87+
#enable_gpu_operator = true
88+
#enable_ingress_nginx = true
89+
#enable_kyverno = true
90+
#enable_kube_prometheus_stack = true
91+
enable_metrics_server = true
92+
#enable_prometheus_adapter = true
93+
#enable_secrets_store_csi_driver = true
94+
#enable_vpa = true
95+
#enable_foo = true # you can add any addon here, make sure to update the gitops repo with the corresponding application set
96+
}
97+
addons = merge(local.aws_addons, local.oss_addons, { kubernetes_version = local.cluster_version })
98+
99+
addons_metadata = merge(
100+
module.eks_blueprints_addons.gitops_metadata,
101+
{
102+
aws_cluster_name = module.eks.cluster_name
103+
aws_region = local.region
104+
aws_account_id = data.aws_caller_identity.current.account_id
105+
aws_vpc_id = module.vpc.vpc_id
106+
},
107+
{
108+
gitops_bridge_repo_url = "${local.gitops_addons_org}/${local.gitops_addons_repo}"
109+
gitops_bridge_repo_revision = local.gitops_addon_revision
110+
}
111+
)
112+
113+
argocd_bootstrap_app_of_apps = {
114+
addons = templatefile("${path.module}/bootstrap/addons.yaml", {
115+
repoURL = "${local.gitops_addons_org}/${local.gitops_addons_repo}"
116+
path = local.gitops_addon_path
117+
targetRevision = local.gitops_addon_revision
118+
})
119+
workloads = templatefile("${path.module}/bootstrap/workloads.yaml", {
120+
repoURL = "${local.gitops_workloads_org}/${local.gitops_workloads_repo}"
121+
path = local.gitops_workloads_path
122+
targetRevision = local.gitops_workloads_revision
123+
})
124+
}
125+
126+
vpc_cidr = "10.0.0.0/16"
127+
azs = slice(data.aws_availability_zones.available.names, 0, 3)
128+
129+
tags = {
130+
Blueprint = local.name
131+
GithubRepo = "github.com/csantanapr/terraform-gitops-bridge"
132+
}
133+
}
134+
135+
################################################################################
136+
# GitOps Bridge: Private ssh keys for git
137+
################################################################################
138+
resource "kubernetes_namespace" "argocd" {
139+
depends_on = [ module.eks_blueprints_addons ]
140+
metadata {
141+
name = "argocd"
142+
}
143+
}
144+
resource "kubernetes_secret" "git_secrets" {
145+
depends_on = [ kubernetes_namespace.argocd ]
146+
for_each = {
147+
git-addons = {
148+
type = "git"
149+
url = local.gitops_addons_org
150+
sshPrivateKey = file(pathexpand(local.git_private_ssh_key))
151+
}
152+
git-workloads = {
153+
type = "git"
154+
url = local.gitops_addons_org
155+
sshPrivateKey = file(pathexpand(local.git_private_ssh_key))
156+
}
157+
}
158+
metadata {
159+
name = each.key
160+
namespace = kubernetes_namespace.argocd.metadata[0].name
161+
labels = {
162+
"argocd.argoproj.io/secret-type" = "repo-creds"
163+
}
164+
}
165+
data = each.value
166+
}
167+
168+
################################################################################
169+
# GitOps Bridge: Metadata
170+
################################################################################
171+
module "gitops_bridge_metadata" {
172+
source = "../../../modules/gitops-bridge-metadata"
173+
174+
cluster_name = module.eks.cluster_name
175+
environment = local.environment
176+
metadata = local.addons_metadata
177+
addons = local.addons
178+
}
179+
180+
################################################################################
181+
# GitOps Bridge: Bootstrap
182+
################################################################################
183+
module "gitops_bridge_bootstrap" {
184+
source = "../../../modules/gitops-bridge-bootstrap"
185+
186+
argocd_cluster = module.gitops_bridge_metadata.argocd
187+
argocd_bootstrap_app_of_apps = local.argocd_bootstrap_app_of_apps
188+
argocd = { create_namespace = false }
189+
depends_on = [kubernetes_secret.git_secrets]
190+
}
191+
192+
193+
################################################################################
194+
# EKS Blueprints Addons
195+
################################################################################
196+
module "eks_blueprints_addons" {
197+
source = "aws-ia/eks-blueprints-addons/aws"
198+
version = "~> 1.0"
199+
200+
cluster_name = module.eks.cluster_name
201+
cluster_endpoint = module.eks.cluster_endpoint
202+
cluster_version = module.eks.cluster_version
203+
oidc_provider_arn = module.eks.oidc_provider_arn
204+
205+
# Using GitOps Bridge
206+
create_kubernetes_resources = false
207+
208+
# EKS Blueprints Addons
209+
enable_cert_manager = try(local.aws_addons.enable_cert_manager, false)
210+
enable_aws_efs_csi_driver = try(local.aws_addons.enable_aws_efs_csi_driver, false)
211+
enable_aws_fsx_csi_driver = try(local.aws_addons.enable_aws_fsx_csi_driver, false)
212+
enable_aws_cloudwatch_metrics = try(local.aws_addons.enable_aws_cloudwatch_metrics, false)
213+
enable_aws_privateca_issuer = try(local.aws_addons.enable_aws_privateca_issuer, false)
214+
enable_cluster_autoscaler = try(local.aws_addons.enable_cluster_autoscaler, false)
215+
enable_external_dns = try(local.aws_addons.enable_external_dns, false)
216+
enable_external_secrets = try(local.aws_addons.enable_external_secrets, false)
217+
enable_aws_load_balancer_controller = try(local.aws_addons.enable_aws_load_balancer_controller, false)
218+
enable_fargate_fluentbit = try(local.aws_addons.enable_fargate_fluentbit, false)
219+
enable_aws_for_fluentbit = try(local.aws_addons.enable_aws_for_fluentbit, false)
220+
enable_aws_node_termination_handler = try(local.aws_addons.enable_aws_node_termination_handler, false)
221+
enable_karpenter = try(local.aws_addons.enable_karpenter, false)
222+
enable_velero = try(local.aws_addons.enable_velero, false)
223+
enable_aws_gateway_api_controller = try(local.aws_addons.enable_aws_gateway_api_controller, false)
224+
225+
tags = local.tags
226+
}
227+
228+
################################################################################
229+
# EKS Cluster
230+
################################################################################
231+
#tfsec:ignore:aws-eks-enable-control-plane-logging
232+
module "eks" {
233+
source = "terraform-aws-modules/eks/aws"
234+
version = "~> 19.13"
235+
236+
cluster_name = local.name
237+
cluster_version = local.cluster_version
238+
cluster_endpoint_public_access = true
239+
240+
241+
vpc_id = module.vpc.vpc_id
242+
subnet_ids = module.vpc.private_subnets
243+
244+
eks_managed_node_groups = {
245+
initial = {
246+
instance_types = ["t3.medium"]
247+
248+
min_size = 3
249+
max_size = 10
250+
desired_size = 3
251+
}
252+
}
253+
# EKS Addons
254+
cluster_addons = {
255+
vpc-cni = {
256+
# Specify the VPC CNI addon should be deployed before compute to ensure
257+
# the addon is configured before data plane compute resources are created
258+
# See README for further details
259+
before_compute = true
260+
most_recent = true # To ensure access to the latest settings provided
261+
configuration_values = jsonencode({
262+
env = {
263+
# Reference docs https://docs.aws.amazon.com/eks/latest/userguide/cni-increase-ip-addresses.html
264+
ENABLE_PREFIX_DELEGATION = "true"
265+
WARM_PREFIX_TARGET = "1"
266+
}
267+
})
268+
}
269+
}
270+
tags = local.tags
271+
}
272+
273+
################################################################################
274+
# Supporting Resources
275+
################################################################################
276+
module "vpc" {
277+
source = "terraform-aws-modules/vpc/aws"
278+
version = "~> 5.0"
279+
280+
name = local.name
281+
cidr = local.vpc_cidr
282+
283+
azs = local.azs
284+
private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]
285+
public_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 48)]
286+
287+
enable_nat_gateway = true
288+
single_nat_gateway = true
289+
290+
public_subnet_tags = {
291+
"kubernetes.io/role/elb" = 1
292+
}
293+
294+
private_subnet_tags = {
295+
"kubernetes.io/role/internal-elb" = 1
296+
}
297+
298+
tags = local.tags
299+
}

0 commit comments

Comments
 (0)