Dev

chartmuseum-config/chartmuseum-secret.yaml

@@ -0,0 +1,11 @@
+#secret for basic auth
+apiVersion: v1
+kind: Secret
+metadata:
+  name: chartmuseum-secret
+  namespace: chartmuseum
+type: Opaque
+stringData:
+  CHARTMUSEUM_USERNAME: "chartmuseum_username"
+  CHARTMUSEUM_PASSWORD: "chartmuseum_password"
+

chartmuseum/Chart.yaml

@@ -0,0 +1,17 @@
+apiVersion: v2
+name: chartmuseum
+description: Install chartmuseum on Openshift clusters
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0

chartmuseum/templates/chartmuseum.yaml

@@ -0,0 +1,37 @@
+{{- $relname := .Release.Name -}}
+{{- $targetNamespace := .Values.argocdConfig.targetNamespace -}}
+{{- $project := .Values.argocdConfig.project.name -}}
+{{- $repourl := .Values.chartmuseum.repository.url -}}
+{{- $repoversion := .Values.chartmuseum.repository.version -}}
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: "{{ $relname }}-chartmuseum"
+
+spec:
+  generators: 
+{{ toYaml .Values.argocdConfig.generators | nindent 4 }}
+
+  template:
+    metadata:
+      name: 'chartmuseum-{{ "{{" }}name{{ "}}" }}'
+    spec:
+      destination:
+        namespace: 'chartmuseum'
+        server: '{{ "{{" }}server{{ "}}" }}'
+      project: '{{ $project }}'
+      source:
+        repoURL: 'https://chartmuseum.github.io/charts' #'{{ $repourl }}'
+        targetRevision: '{{ $repoversion }}'
+        chart: chartmuseum
+
+        helm:
+          releaseName: 'chartmuseum'
+          values: |
+{{ toYaml .Values.chartmuseum.config | indent 12 }}
+
+      syncPolicy:
+        automated:
+          prune: true
+        syncOptions:
+          - CreateNamespace=true

chartmuseum/values.yaml

@@ -0,0 +1,43 @@
+chartmuseum:
+  repository:
+    version: 3.1.0
+  config:
+    env:
+      open:
+        # storage backend, can be one of: local, alibaba, amazon, google, microsoft, oracle
+        STORAGE: local
+        DISABLE_API: false
+        # allow anonymous GET operations when auth is used
+        AUTH_ANONYMOUS_GET: false
+        # enable bearer auth
+        BEARER_AUTH: false
+        # auth realm used for bearer auth
+        AUTH_REALM:
+        # auth service used for bearer auth
+        AUTH_SERVICE:
+      existingSecret: chartmuseum-secret
+      existingSecretMappings:
+        # username for basic http authentication
+        BASIC_AUTH_USER: CHARTMUSEUM_USERNAME
+        # password for basic http authentication
+        BASIC_AUTH_PASS: CHARTMUSEUM_PASSWORD
+    bearerAuth:
+      secret:
+        enabled: false
+        publicKeySecret: chartmuseum-public-key
+    securityContext:
+      enabled: true
+      fsGroup: null
+      runAsNonRoot: true
+    persistence:
+      enabled: true
+      accessMode: ReadWriteOnce
+      size: 8Gi
+      storageClass: "gp2"
+
+
+argocdConfig:
+  generators: []
+  project:
+    create: false
+    name: default

helm-pipelines/Chart.yaml

@@ -0,0 +1,17 @@
+apiVersion: v2
+name: helm-pipelines
+description: Install all the necessary ressources to automate helm charts pipeline on Openshift clusters
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0

README.md → helm-pipelines/README.md

@@ -1,4 +1,4 @@
-# helm-pipelines
+# helm-pipelines  
 
 ## ARGO helm package registry
 

helm-pipelines/templates/event-source/github-route.yaml

@@ -0,0 +1,20 @@
+ {{- if eq .Values.github.webhook.route "true" }}
+kind: Route
+apiVersion: route.openshift.io/v1
+metadata:
+  name: {{ .Release.Name }}-github-event
+  labels:
+    app.kubernetes.io/instance: helm-pipeline
+    controller: eventsource-controller
+    eventsource-name: {{ .Release.Name }}-github-events
+
+spec:
+  host: {{ .Values.github.webhook.url }}
+  to:
+    kind: Service
+    name: {{ .Release.Name }}-github-events-eventsource-svc
+    weight: 100
+  port:
+    targetPort: 12000
+  wildcardPolicy: None
+ {{- end }}

helm-pipelines/templates/event-source/github.yaml

@@ -0,0 +1,105 @@
+# Info on GitHub Webhook: https://developer.github.com/v3/repos/hooks/#create-a-hook
+apiVersion: argoproj.io/v1alpha1
+kind: EventSource
+metadata:
+  name: {{ .Release.Name }}-github-events
+spec:
+  eventBusName: {{ if eq .Values.eventbus.enabled "true" }}{{ .Release.Name }}-default{{ else }}{{ .Values.eventbus.eventbusName }}{{ end }}
+  service:
+    ports:
+      - port: 12000
+        targetPort: 12000
+  github:
+    push:
+      repositories:
+        - owner: {{ .Values.github.repository.owner }}
+          names: 
+          - {{ .Values.github.repository.name }}
+      # Github will send events to following port and endpoint
+      webhook:
+        # endpoint to listen to events on
+        endpoint: /push
+        # port to run internal HTTP server on
+        port: "12000"
+        # HTTP request method to allow. In this case, only POST requests are accepted
+        method: POST
+        # url the event-source will use to register at Github.
+        # This url must be reachable from outside the cluster.
+        # The name for the service is in `<event-source-name>-eventsource-svc` format.
+        # You will need to create an Ingress or Openshift Route for the event-source service so that it can be reached from GitHub.
+        url: http://{{ .Values.github.webhook.url }}
+      # type of events to listen to.
+      # following listens to everything, hence *
+      # You can find more info on https://developer.github.com/v3/activity/events/types/
+      events:
+        - "push"
+        - "pull_request"
+      # apiToken refers to K8s secret that stores the github api token
+      # if apiToken is provided controller will create webhook on GitHub repo
+      # +optional
+      apiToken:
+        # Name of the K8s secret that contains the access token
+        name: git-secret
+        # Key within the K8s secret whose corresponding value (must be base64 encoded) is access token
+        key: GIT_TOKEN
+
+#      # webhookSecret refers to K8s secret that stores the github hook secret
+#      # +optional
+#      webhookSecret:
+#        # Name of the K8s secret that contains the hook secret
+#        name: github-access
+#        # Key within the K8s secret whose corresponding value (must be base64 encoded) is hook secret
+#        key: secret
+
+      # type of the connection between event-source and Github.
+      # You should set it to false to avoid man-in-the-middle and other attacks.
+      insecure: true
+      # Determines if notifications are sent when the webhook is triggered
+      active: true
+      # The media type used to serialize the payloads
+      contentType: json
+
+#    example-without-api-credentials:
+#      owner: "argoproj"
+#      repository: "argo"
+#      webhook:
+#        endpoint: "/push"
+#        port: "13000"
+#        method: "POST"
+#      events:
+#        - "*"
+#      webhookSecret:
+#        name: github-access
+#        key: secret
+#      insecure: true
+#      active: true
+#      contentType: "json"
+
+#    example-with-secure-connection:
+#      owner: "argoproj"
+#      repository: "argo"
+#      webhook:
+#        endpoint: "/push"
+#        port: "13000"
+#        method: "POST"
+#        url: "http://myargofakeurl.fake"
+#        # k8s secret that contains the cert
+#        serverCertSecret:
+#          name: my-secret
+#          key: cert-key
+#        # k8s secret that contains the private key
+#        serverKeySecret:
+#          name: my-secret
+#          key: pk-key
+#      events:
+#        - "push"
+#        - "delete"
+#      apiToken:
+#        name: github-access
+#        key: token
+#      webhookSecret:
+#        name: github-access
+#        key: secret
+#      insecure: true
+#      active: true
+#      contentType: "json"

helm-pipelines/templates/eventbus/eventBus.yaml

@@ -0,0 +1,23 @@
+ {{- if eq .Values.eventbus.enabled "true" }}
+apiVersion: argoproj.io/v1alpha1
+kind: EventBus
+metadata:
+  name: {{ .Release.Name }}-default
+spec:
+  nats:
+    native:
+      # Optional, defaults to 3. If it is < 3, set it to 3, that is the minimal requirement.
+      replicas: {{ .Values.eventbus.replicas }}
+      # Optional, authen strategy, "none" or "token", defaults to "none"
+      auth: token
+      containerTemplate:
+{{ toYaml .Values.eventbus.containerTemplate | indent 8 }}
+
+#      metricsContainerTemplate:
+#        resources:
+#          requests:
+#            cpu: "10m"
+#      antiAffinity: false
+      persistence:
+{{ toYaml .Values.eventbus.persistence | indent 8 }}
+ {{- end }}

helm-pipelines/templates/rbac/RBAC-default.yaml

@@ -0,0 +1,39 @@
+ {{- if eq .Values.rbac.default "true" }}
+# Similarly you can use a Role and RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-workflow-cluster-role
+rules:
+  # pod get/watch is used to identify the container IDs of the current pod
+  # pod patch is used to annotate the step's outputs back to controller (e.g. artifact location)
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+      - watch
+      - patch
+  # logs get/watch are used to get the pods logs for script outputs, and for log archival
+  - apiGroups:
+      - ""
+    resources:
+      - pods/log
+    verbs:
+      - get
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-workflow-role-cluster-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Release.Name }}-workflow-cluster-role
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: {{ .Release.Namespace }}
+ {{- end }}

helm-pipelines/templates/rbac/sa-sensor.yaml

@@ -0,0 +1,65 @@
+ {{- if eq .Values.rbac.operateWorkflow "true" }}
+#sa used by the sensor to create workflows
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Release.Name }}-operate-workflow-sa
+---
+# Similarly you can use a Role and RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-operate-workflow-cluster-role
+rules:
+  - apiGroups:
+      - argoproj.io
+    verbs:
+      - "*"
+    resources:
+      - workflows
+      - workflowtemplates
+      - cronworkflows
+      - clusterworkflowtemplates
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+    verbs:
+      - create
+      - get
+      - watch
+  - apiGroups:
+      - "rbac.authorization.k8s.io"
+    resources:
+      - rolebindings
+    verbs:
+      - create
+      - get
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - create
+      - get
+      - watch  
+  - apiGroups: ["rbac.authorization.k8s.io"]
+    resources: ["clusterroles"]
+    verbs: ["bind"]
+    # omit resourceNames to allow binding any ClusterRole
+    resourceNames: ["{{ .Release.Name }}-workflow-cluster-role"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ .Release.Name }}-operate-workflow-cluster-role-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Release.Name }}-operate-workflow-cluster-role
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Release.Name }}-operate-workflow-sa
+    namespace: {{ .Release.Namespace }}
+ {{- end }}