Skip to content

Commit 27ee1ff

Browse files
emilyzhengemilyzheng
committed
feat(CLOUDDST-30417): add component image-rbac-proxy
Signed-off-by: Emily Zheng <yuzheng@redhat.com>
1 parent 7e4a7df commit 27ee1ff

File tree

23 files changed

+413
-0
lines changed

23 files changed

+413
-0
lines changed

‎argo-cd-apps/base/member/infra-deployments/image-rbac-proxy/image-rbac-proxy.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: ApplicationSet
3+
metadata:
4+
name: image-rbac-proxy
5+
spec:
6+
generators:
7+
- merge:
8+
mergeKeys:
9+
- nameNormalized
10+
generators:
11+
- clusters:
12+
values:
13+
sourceRoot: components/image-rbac-proxy
14+
environment: staging
15+
clusterDir: base
16+
- list:
17+
elements:
18+
- nameNormalized: stone-stage-p01
19+
values.clusterDir: stone-stage-p01
20+
- nameNormalized: stone-stg-rh01
21+
values.clusterDir: stone-stg-rh01
22+
template:
23+
metadata:
24+
name: image-rbac-proxy-{{nameNormalized}}
25+
spec:
26+
project: default
27+
source:
28+
path: '{{values.sourceRoot}}/{{values.environment}}/{{values.clusterDir}}'
29+
repoURL: https://github.com/redhat-appstudio/infra-deployments.git
30+
targetRevision: main
31+
destination:
32+
namespace: image-rbac-proxy
33+
server: '{{server}}'
34+
syncPolicy:
35+
automated:
36+
prune: true
37+
selfHeal: true
38+
syncOptions:
39+
- CreateNamespace=true
40+
retry:
41+
limit: -1
42+
backoff:
43+
duration: 10s
44+
factor: 2
45+
maxDuration: 3m

‎argo-cd-apps/base/member/infra-deployments/image-rbac-proxy/kustomization.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
resources:
4+
- image-rbac-proxy.yaml
5+
components:
6+
- ../../../../k-components/deploy-to-member-cluster-merge-generator

‎argo-cd-apps/base/member/infra-deployments/kustomization.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ resources:
1313
- etcd-shield
1414
- internal-services
1515
- image-controller
16+
- image-rbac-proxy
1617
- multi-platform-controller
1718
- perf-team-prometheus-reader
1819
- project-controller

‎components/cluster-secret-store/base/appsre-stonesoup-vault-secret-store.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ spec:
3939
- konflux-ci
4040
- konflux-ui
4141
- image-controller
42+
- image-rbac-proxy
4243
- multi-platform-controller
4344
- openshift-logging
4445
- quality-dashboard

‎components/image-rbac-proxy/OWNERS‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# See the OWNERS docs: https://go.k8s.io/owners
2+
3+
approvers:
4+
- emilyzheng
5+
6+
reviewers:
7+
- emilyzheng

‎components/image-rbac-proxy/README.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
title: Image RBAC Proxy
3+
---
4+
5+
Deployment of [image-rbac-proxy](https://github.com/konflux-ci/image-rbac-proxy)
6+
7+
## Proxy secrets
8+
9+
List of secrets:
10+
11+
| Name | Source | Description |
12+
| ------------- | ------------ | ----------------------------------|
13+
| quay-username | appsre vault | Quay username for image pull |
14+
| quay-password | appsre vault | Quay password for image pull |

‎components/image-rbac-proxy/base/allow-argocd-to-manage.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: RoleBinding
3+
metadata:
4+
name: grant-argocd
5+
namespace: image-rbac-proxy
6+
roleRef:
7+
apiGroup: rbac.authorization.k8s.io
8+
kind: ClusterRole
9+
name: admin
10+
subjects:
11+
- kind: ServiceAccount
12+
name: openshift-gitops-argocd-application-controller
13+
namespace: openshift-gitops

‎components/image-rbac-proxy/base/kustomization.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
namespace: image-rbac-proxy
4+
resources:
5+
- allow-argocd-to-manage.yaml
6+
- quay-robot-account.yaml
7+
- route.yaml

‎components/image-rbac-proxy/base/quay-robot-account.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: external-secrets.io/v1beta1
2+
kind: ExternalSecret
3+
metadata:
4+
name: quay-robot-account
5+
namespace: image-rbac-proxy
6+
annotations:
7+
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
8+
argocd.argoproj.io/sync-wave: "-1"
9+
spec:
10+
dataFrom:
11+
- extract:
12+
key: staging/image-rbac-proxy/quay-robot-account
13+
refreshInterval: 5m
14+
secretStoreRef:
15+
kind: ClusterSecretStore
16+
name: appsre-stonesoup-vault
17+
target:
18+
creationPolicy: Owner
19+
deletionPolicy: Delete
20+
name: quay-robot-account
21+
template:
22+
data:
23+
quay-username: '{{ .quay-username }}'
24+
quay-password: '{{ .quay-password }}'

‎components/image-rbac-proxy/base/route.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
apiVersion: route.openshift.io/v1
3+
kind: Route
4+
metadata:
5+
name: image-rbac-proxy
6+
namespace: image-rbac-proxy
7+
spec:
8+
to:
9+
kind: Service
10+
name: image-rbac-proxy
11+
tls:
12+
insecureEdgeTerminationPolicy: Redirect
13+
termination: reencrypt
14+
---
15+
apiVersion: route.openshift.io/v1
16+
kind: Route
17+
metadata:
18+
name: dex
19+
namespace: image-rbac-proxy
20+
spec:
21+
path: /idp
22+
to:
23+
kind: Service
24+
name: dex
25+
tls:
26+
insecureEdgeTerminationPolicy: Redirect
27+
termination: reencrypt

0 commit comments

Comments
 (0)