Skip to content

Commit d114b89

Browse files
author
sungil
committed
policy: add a decapod app for policies
1 parent 18d35d8 commit d114b89

5 files changed

+127
-40
lines changed

Diff for: ‎deploy_apps/tks-lma-federation-wftpl.yaml

+7-35
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,6 @@ spec:
4646
value: ""
4747

4848
volumes:
49-
- name: tks-proto-vol
50-
configMap:
51-
name: tks-proto
5249
- name: kubeconfig-adm
5350
secret:
5451
secretName: tks-admin-kubeconfig-secret
@@ -169,12 +166,16 @@ spec:
169166
- name: base_repo_branch
170167
value: "{{ workflow.parameters.base_repo_branch }}"
171168

172-
- - name: argocd-sync-wait
173-
template: argocd-sync-wait
169+
- - name: garafana-sync-wait
170+
templateRef:
171+
name: create-application
172+
template: argocd-sync-wait
174173
arguments:
175174
parameters:
176175
- name: cluster_id
177176
value: '{{workflow.parameters.cluster_id}}'
177+
- name: appname
178+
value: 'grafana'
178179

179180
- - name: grafana-restart
180181
template: grafana-restart
@@ -316,7 +317,7 @@ spec:
316317
sleep 5
317318
done
318319
319-
grafana_ep_secret=${kubectl --kubeconfig=kubeconfig get secret -n taco-system tks-endpoint-secret -o jsonpath='{.data.grafana}'| base64 -d }
320+
grafana_ep_secret=${kubectl get secret -n ${cluster_id} tks-endpoint-secret -o jsonpath='{.data.grafana}'| base64 -d }
320321
if [ grafana_ep_secret == "" ]; then
321322
while [ -z $(kubectl --kubeconfig=kubeconfig get svc -n lma grafana -o jsonpath="{.status.loadBalancer.ingress[*].hostname}") ]; do
322323
if [ "$(kubectl --kubeconfig=kubeconfig get svc -n lma grafana -o jsonpath='{.spec.type}')" != "LoadBalancer" ]; then
@@ -435,35 +436,6 @@ spec:
435436
- secretRef:
436437
name: "tks-api-secret"
437438

438-
- name: argocd-sync-wait
439-
inputs:
440-
parameters:
441-
- name: cluster_id
442-
container:
443-
name: argocd-sync-wait
444-
image: harbor.taco-cat.xyz/tks/argocd-cli:v2.2.5
445-
command:
446-
- /bin/bash
447-
- '-c'
448-
- |
449-
# log into Argo CD server
450-
./argocd login $ARGO_SERVER --plaintext --insecure --username $ARGO_USERNAME \
451-
--password $ARGO_PASSWORD
452-
453-
app_name={{inputs.parameters.cluster_id}}-grafana
454-
455-
# sync app
456-
echo "sync app $app_name"
457-
./argocd app sync $app_name
458-
459-
# wait for sync
460-
./argocd app wait $app_name --sync
461-
462-
envFrom:
463-
- secretRef:
464-
name: "decapod-argocd-config"
465-
activeDeadlineSeconds: 900
466-
467439
- name: grafana-restart
468440
inputs:
469441
parameters:

Diff for: ‎deploy_apps/tks-policy-wftpl.yaml

+103
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: WorkflowTemplate
3+
metadata:
4+
name: tks-policy
5+
namespace: argo
6+
spec:
7+
entrypoint: deploy
8+
arguments:
9+
parameters:
10+
- name: site_name
11+
value: "coyar0qx1"
12+
- name: revision
13+
value: "main"
14+
- name: app_prefix
15+
value: "{{workflow.parameters.site_name}}"
16+
- name: cluster_id
17+
value: "{{workflow.parameters.site_name}}"
18+
19+
templates:
20+
- name: deploy
21+
inputs:
22+
parameters:
23+
- name: cluster_id
24+
value: '{{inputs.parameters.cluster_id}}'
25+
- name: appname
26+
value: 'policy-resources'
27+
steps:
28+
- - name: createNamespace
29+
template: createNamespace
30+
arguments:
31+
parameters:
32+
- name: target_namespace
33+
value: gatekeeper-system
34+
- - name: deploy-policy-operator
35+
templateRef:
36+
name: create-application
37+
template: installApps
38+
arguments:
39+
parameters:
40+
- name: list
41+
value: |
42+
[
43+
{ "app_group": "policy", "path": "opa-gatekeeper", "namespace": "gatekeeper-system", "target_cluster": "" }
44+
]
45+
46+
- - name: deploy-default-policy-resources
47+
templateRef:
48+
name: create-application
49+
template: installApps
50+
arguments:
51+
parameters:
52+
- name: list
53+
value: |
54+
[
55+
{ "app_group": "policy", "path": "policy-resources", "namespace": "gatekeeper-system", "target_cluster": "" }
56+
]
57+
58+
- - name: argocd-sync-wait
59+
templateRef:
60+
name: create-application
61+
template: argocd-sync-wait
62+
arguments:
63+
parameters:
64+
- name: cluster_id
65+
value: '{{inputs.parameters.cluster_id}}'
66+
- name: appname
67+
value: 'policy-resources'
68+
69+
- name: createNamespace
70+
inputs:
71+
parameters:
72+
- name: target_namespace
73+
container:
74+
name: create-namespace
75+
image: harbor.taco-cat.xyz/tks/hyperkube:v1.18.6
76+
command:
77+
- /bin/bash
78+
- '-c'
79+
- |
80+
function log() {
81+
level=$1
82+
msg=$2
83+
date=$(date '+%F %H:%M:%S')
84+
echo "[$date] $level $msg"
85+
}
86+
87+
kube_secret=$(kubectl get secret -n {{workflow.parameters.cluster_id}} {{workflow.parameters.cluster_id}}-tks-kubeconfig -o jsonpath="{.data.value}" | base64 -d)
88+
echo -e "kube_secret:\n$kube_secret" | head -n 5
89+
cat <<< "$kube_secret" > /etc/kubeconfig
90+
91+
kubectl --kubeconfig=/etc/kubeconfig get ns ${TARGET_NAMESPACE}
92+
if [[ $? =~ 1 ]]; then
93+
kubectl --kubeconfig=/etc/kubeconfig create ns ${TARGET_NAMESPACE}
94+
kubectl --kubeconfig=/etc/kubeconfig label ns ${TARGET_NAMESPACE} name=${TARGET_NAMESPACE}
95+
kubectl --kubeconfig=/etc/kubeconfig label ns ${TARGET_NAMESPACE} taco-tls=enabled
96+
log "INFO" "${TARGET_NAMESPACE} successfully created."
97+
fi
98+
env:
99+
- name: TARGET_NAMESPACE
100+
value: '{{inputs.parameters.target_namespace}}'
101+
activeDeadlineSeconds: 900
102+
retryStrategy:
103+
limit: 2

Diff for: ‎deploy_apps/tks-primary-cluster.yaml

+4-4
Original file line numberDiff line numberDiff line change
@@ -445,7 +445,7 @@ spec:
445445
primary_kube_secret=$(kubectl get secret -n ${primary_cluster} ${primary_cluster}-tks-kubeconfig -o jsonpath="{.data.value}" | base64 -d)
446446
# echo -e "primary_kube_secret:\n$primary_kube_secret" | head -n 5
447447
cat <<< "$primary_kube_secret" > kubeconfig
448-
LOKI_SERVICE=$(kubectl --kubeconfig=kubeconfig get secret -n taco-system tks-endpoint-secret -o jsonpath='{.data.loki}'| base64 -d )
448+
LOKI_SERVICE=$(kubectl get secret -n ${primary_cluster} tks-endpoint-secret -o jsonpath='{.data.loki}'| base64 -d )
449449
450450
if [ "$LOKI_SERVICE" == "" ]; then
451451
while [ -z $(kubectl --kubeconfig=kubeconfig get svc -n lma loki-loki-distributed-gateway -o jsonpath="{.status.loadBalancer.ingress[*].hostname}") ]
@@ -470,7 +470,7 @@ spec:
470470
fi
471471
472472
if [ "$OBJECT_SOTRE" == "minio" ]; then
473-
S3_SERVICE=$(kubectl --kubeconfig=kubeconfig get secret -n taco-system tks-endpoint-secret -o jsonpath='{.data.minio}'| base64 -d )
473+
S3_SERVICE=$(kubectl get secret -n ${primary_cluster} tks-endpoint-secret -o jsonpath='{.data.minio}'| base64 -d )
474474
if [ "$S3_SERVICE" == "" ]; then
475475
S3_HOST=$(kubectl --kubeconfig=kubeconfig get svc -n lma minio -o jsonpath="{.status.loadBalancer.ingress[0].hostname}")
476476
S3_PORT=$(kubectl --kubeconfig=kubeconfig get svc -n lma minio -o jsonpath="{.spec.ports[0].port}")
@@ -595,7 +595,7 @@ spec:
595595
primary_kube_secret=$(kubectl get secret -n ${primary_cluster} ${primary_cluster}-tks-kubeconfig -o jsonpath="{.data.value}" | base64 -d)
596596
# echo -e "primary_kube_secret:\n$primary_kube_secret" | head -n 5
597597
cat <<< "$primary_kube_secret" > kubeconfig
598-
S3_SERVICE=$(kubectl --kubeconfig=kubeconfig get secret -n taco-system tks-endpoint-secret -o jsonpath='{.data.minio}'| base64 -d )
598+
S3_SERVICE=$(kubectl get secret -n ${primary_cluster} tks-endpoint-secret -o jsonpath='{.data.minio}'| base64 -d )
599599
if [ "$S3_SERVICE" == "" ]; then
600600
echo "This site uses the predefined loki and static object stores."
601601
exit 0
@@ -709,7 +709,7 @@ spec:
709709
# Thanos Endpoints
710710
kube_secret=$(kubectl get secret -n ${member} ${member}-tks-kubeconfig -o jsonpath="{.data.value}" | base64 -d)
711711
cat <<< "$kube_secret" > kubeconfig
712-
PROMETHEUS_URL=$(kubectl --kubeconfig=kubeconfig get secret -n taco-system tks-endpoint-secret -o jsonpath='{.data.prometheus}'| base64 -d )
712+
PROMETHEUS_URL=$(kubectl get secret -n ${member} tks-endpoint-secret -o jsonpath='{.data.prometheus}'| base64 -d )
713713
if [ "$PROMETHEUS_URL" != "" ]; then
714714
eplist="${eplist}, \"$(PROMETHEUS_URL)\""
715715
elif [ `kubectl --kubeconfig=kubeconfig get svc -n lma lma-thanos-external --ignore-not-found=true | grep -v NAME | wc -l ` -eq 1 ]; then

Diff for: ‎deploy_apps/tks-remove-lma-federation-wftpl.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -335,7 +335,7 @@ spec:
335335
sleep 5
336336
done
337337
338-
grafana_ep_secret=${kubectl --kubeconfig=kubeconfig get secret -n taco-system tks-endpoint-secret -o jsonpath='{.data.grafana}'| base64 -d }
338+
grafana_ep_secret=${kubectl get secret -n ${cluster_id} tks-endpoint-secret -o jsonpath='{.data.grafana}'| base64 -d }
339339
if [ grafana_ep_secret == "" ]; then
340340
while [ -z $(kubectl --kubeconfig=kubeconfig get svc -n lma grafana -o jsonpath="{.status.loadBalancer.ingress[*].hostname}") ]; do
341341
if [ "$(kubectl --kubeconfig=kubeconfig get svc -n lma grafana -o jsonpath='{.spec.type}')" != "LoadBalancer" ]; then

Diff for: ‎tks-cluster/create-usercluster-wftpl.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -337,6 +337,18 @@ spec:
337337
]
338338
when: "{{steps.tks-create-cluster-repo.outputs.parameters.infra_provider}} == byoh"
339339

340+
- - name: install-policy-management
341+
templateRef:
342+
name: tks-policy
343+
template: deploy
344+
arguments:
345+
parameters:
346+
- name: cluster_id
347+
value: '{{workflow.parameters.cluster_id}}'
348+
- name: appname
349+
value: 'policy-resources'
350+
# when: "{{steps.get-clusters-in-contract.outputs.parameters.primary_cluster}} != '' && {{workflow.parameters.cluster_id}} != {{steps.get-clusters-in-contract.outputs.parameters.primary_cluster}}"
351+
340352
#######################
341353
# Template Definition #
342354
#######################

0 commit comments

Comments
 (0)