Initial commit

argocd/.gitignore

@@ -0,0 +1,4 @@
+argocd.yml
+repo-credentials.yml
+id_*
+ssh_known_hosts

argocd/README.md

@@ -0,0 +1,59 @@
+# Workflow
+
+Most applications in our Kubernetes cluster are managed by ArgoCD.
+
+
+# Deployment
+
+To deploy ArgoCD:
+
+```bash
+helm repo add argo-cd https://argoproj.github.io/argo-helm
+kubectl create secret -n argocd generic argocd-secret # Initialize empty secret for sessions
+helm template -n argocd --release-name k6 argo-cd/argo-cd --include-crds -f values.yaml > argocd.yml
+kubectl apply -f argocd.yml -n argocd
+kubectl -n argocd rollout restart deployment/k6-argocd-redis
+kubectl -n argocd rollout restart deployment/k6-argocd-repo-server
+kubectl -n argocd rollout restart deployment/k6-argocd-server
+kubectl -n argocd rollout restart deployment/k6-argocd-notifications-controller
+kubectl -n argocd rollout restart statefulset/k6-argocd-application-controller
+```
+
+Note: Refer to Authelia README for OIDC secret setup
+
+
+# Setting up Git secrets
+
+Generate SSH key to access Gitea:
+
+```
+ssh-keygen -t ecdsa -f id_ecdsa -C argocd.k-space.ee -P ''
+kubectl -n argocd create secret generic gitea-kube \
+  --from-literal=type=git \
+  --from-literal=url=git@git.k-space.ee:k-space/kube \
+  --from-file=sshPrivateKey=id_ecdsa
+kubectl -n argocd create secret generic gitea-kube-staging \
+  --from-literal=type=git \
+  --from-literal=url=git@git.k-space.ee:k-space/kube-staging \
+  --from-file=sshPrivateKey=id_ecdsa
+kubectl label -n argocd secret gitea-kube argocd.argoproj.io/secret-type=repository
+kubectl label -n argocd secret gitea-kube-staging argocd.argoproj.io/secret-type=repository
+rm -fv id_ecdsa
+```
+
+Have Gitea admin reset password for user `argocd` and log in with that account.
+Add the SSH key for user `argocd` from file `id_ecdsa.pub`.
+Delete any other SSH keys associated with Gitea user `argocd`.
+
+
+# Adding applications
+
+To add application make sure it's manifest is placed as `application.yml` in
+the relevant namespace:
+
+```
+./update.sh
+kubectl apply -n argocd -f applications --recursive
+```
+
+Do not manually add manifests under `applications/`

argocd/application.tpl

@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: foobar
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: 'git@git.k-space.ee:k-space/kube.git'
+    path: foobar
+    targetRevision: HEAD
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: foobar
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true

argocd/applications/authelia.yml

@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: authelia
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: 'git@git.k-space.ee:k-space/kube.git'
+    path: authelia
+    targetRevision: HEAD
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: authelia
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true

argocd/applications/camtiler.yml

@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: camtiler
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: 'git@git.k-space.ee:k-space/kube.git'
+    path: camtiler
+    targetRevision: HEAD
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: camtiler
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true

argocd/applications/drone-execution.yml

@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: drone-execution
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: 'git@git.k-space.ee:k-space/kube.git'
+    path: drone-execution
+    targetRevision: HEAD
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: drone-execution
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true

argocd/applications/drone.yml

@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: drone
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: 'git@git.k-space.ee:k-space/kube.git'
+    path: drone
+    targetRevision: HEAD
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: drone
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true

argocd/applications/etherpad.yml

@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: etherpad
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: 'git@git.k-space.ee:k-space/kube.git'
+    path: etherpad
+    targetRevision: HEAD
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: etherpad
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true

argocd/applications/external-dns.yml

@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-dns
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: 'git@git.k-space.ee:k-space/kube.git'
+    path: external-dns
+    targetRevision: HEAD
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: external-dns
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true

argocd/applications/harbor.yml

@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: harbor
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: 'git@git.k-space.ee:k-space/kube.git'
+    path: harbor
+    targetRevision: HEAD
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: harbor
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true

argocd/applications/keel.yml

@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: keel
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: 'git@git.k-space.ee:k-space/kube.git'
+    path: keel
+    targetRevision: HEAD
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: keel
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true

argocd/applications/kubernetes-dashboard.yml

@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: kubernetes-dashboard
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: 'git@git.k-space.ee:k-space/kube.git'
+    path: kubernetes-dashboard
+    targetRevision: HEAD
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: kubernetes-dashboard
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true

argocd/applications/logging.yml

@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: logging
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: 'git@git.k-space.ee:k-space/kube.git'
+    path: logging
+    targetRevision: HEAD
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: logging
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true

argocd/applications/metallb-system.yml

@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: metallb-system
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: 'git@git.k-space.ee:k-space/kube.git'
+    path: metallb-system
+    targetRevision: HEAD
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: metallb-system
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true

argocd/applications/monitoring.yml

@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: monitoring
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: 'git@git.k-space.ee:k-space/kube.git'
+    path: monitoring
+    targetRevision: HEAD
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: monitoring
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true

argocd/applications/mysql-operator.yml

@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: mysql-operator
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: 'git@git.k-space.ee:k-space/kube.git'
+    path: mysql-operator
+    targetRevision: HEAD
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: mysql-operator
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true

argocd/applications/phpmyadmin.yml

@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: phpmyadmin
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: 'git@git.k-space.ee:k-space/kube.git'
+    path: phpmyadmin
+    targetRevision: HEAD
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: phpmyadmin
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true

argocd/applications/reloader.yml

@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: reloader
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: 'git@git.k-space.ee:k-space/kube.git'
+    path: reloader
+    targetRevision: HEAD
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: reloader
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true

argocd/applications/rosdump.yml

@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: rosdump
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: 'git@git.k-space.ee:k-space/kube.git'
+    path: rosdump
+    targetRevision: HEAD
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: rosdump
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true

argocd/applications/wildduck.yml

@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: wildduck
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: 'git@git.k-space.ee:k-space/kube.git'
+    path: wildduck
+    targetRevision: HEAD
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: wildduck
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true

argocd/update.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+path=$(dirname $(dirname $(realpath $0)))
+for j in $path/*/application.yml; do
+    app=$(dirname $j)
+    test -f "$app/values.yml" && continue
+    test -f "$app/values.yaml" && continue
+    appname=$(basename $app)
+    cat application.tpl | sed -e "s/foobar/$appname/g" > applications/$appname.yml
+done

argocd/values.yaml

@@ -0,0 +1,122 @@
+global:
+  logLevel: warn
+
+# We use Authelia OIDC instead of Dex
+dex:
+  enabled: false
+
+# Maybe one day switch to Redis HA?
+redis-ha:
+  enabled: false
+
+server:
+  # HTTPS is implemented by Traefik
+  extraArgs:
+    - --insecure
+  ingress:
+    enabled: true
+    annotations:
+      cert-manager.io/cluster-issuer: default
+      external-dns.alpha.kubernetes.io/target: traefik.k-space.ee
+      traefik.ingress.kubernetes.io/router.entrypoints: websecure
+      traefik.ingress.kubernetes.io/router.tls: "true"
+    hosts:
+    - argocd.k-space.ee
+    tls:
+     - hosts:
+       - argocd.k-space.ee
+       secretName: argocd-server-tls
+  configEnabled: true
+  config:
+    admin.enabled: "false"
+    url: https://argocd.k-space.ee
+    application.instanceLabelKey: argocd.argoproj.io/instance
+    oidc.config: |
+       name: Authelia
+       issuer: https://auth.k-space.ee
+       clientID: argocd
+       cliClientID: argocd
+       clientSecret: $oidc.config.clientSecret
+       requestedIDTokenClaims:
+         groups:
+           essential: true
+       requestedScopes:
+         - openid
+         - profile
+         - email
+         - groups
+    resource.customizations: |
+      # https://github.com/argoproj/argo-cd/issues/1704
+      networking.k8s.io/Ingress:
+          health.lua: |
+            hs = {}
+            hs.status = "Healthy"
+            return hs
+
+  # Members of ArgoCD Admins group in AD/Samba are allowed to administer Argo
+  rbacConfig:
+    policy.default: role:readonly
+    policy.csv: |
+      # Map AD groups to ArgoCD roles
+      g, Developers, role:developers
+      g, ArgoCD Admins, role:admin
+      # Allow developers to read objects
+      p, role:developers, applications, get, */*, allow
+      p, role:developers, certificates, get, *, allow
+      p, role:developers, clusters, get, *, allow
+      p, role:developers, repositories, get, *, allow
+      p, role:developers, projects, get, *, allow
+      p, role:developers, accounts, get, *, allow
+      p, role:developers, gpgkeys, get, *, allow
+      p, role:developers, logs, get, */*, allow
+      p, role:developers, applications, restart, default/camtiler, allow
+      p, role:developers, applications, override, default/camtiler, allow
+      p, role:developers, applications, action/apps/Deployment/restart, default/camtiler, allow
+      p, role:developers, applications, sync, default/camtiler, allow
+      p, role:developers, applications, update, default/camtiler, allow
+
+  metrics:
+    enabled: true
+    service:
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "8083"
+
+# We don't use ApplicationSet CRD-s (yet)
+applicationSet:
+  enabled: false
+
+repoServer:
+  metrics:
+    enabled: true
+    service:
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "8084"
+
+notifications:
+  metrics:
+    enabled: true
+    service:
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "9001"
+
+controller:
+  metrics:
+    enabled: true
+    service:
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "8082"
+
+configs:
+  secret:
+    createSecret: false
+  knownHosts:
+    data:
+      ssh_known_hosts: |
+        # Copy-pasted from `ssh-keyscan git.k-space.ee`
+        git.k-space.ee ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCF1+/TDRXuGwsu4SZQQwQuJusb7W1OciGAQp/ZbTTvKD+0p7fV6dXyUlWjdFmITrFNYDreDnMiOS+FvE62d2Z0=
+        git.k-space.ee ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDsLyRuubdIUnTKEqOipu+9x+FforrC8+oxulVrl0ECgdIRBQnLQXIspTNwuC3MKJ4z+DPbndSt8zdN33xWys8UNEs3V5/W6zsaW20tKiaX75WK5eOL4lIDJi/+E97+c0aZBXamhxTrgkRVJ5fcAkY6C5cKEmVM5tlke3v3ihLq78/LpJYv+P947NdnthYE2oc+XGp/elZ0LNfWRPnd///+ykbwWirvQm+iiDz7PMVKkb+Q7l3vw4+zneKJWAyFNrm+aewyJV9lFZZJuHliwlHGTriSf6zhMAWyJzvYqDAN6iT5yi9KGKw60J6vj2GLuK4ULVblTyP9k9+3iELKSWW5
+        git.k-space.ee ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL1jaIn/5dZcqN+cwcs/c2xMVJH/ReA84v8Mm73jqDAG