Skip to content

Commit 5c2381f

Browse files
mbaldessarimbaldessari
authored
Merge pull request #119 from mbaldessari/common-automatic-update
common automatic update
2 parents 7290cc2 + 28d9b49 commit 5c2381f

67 files changed

Lines changed: 1754 additions & 672 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎common/acm/templates/policies/acm-hub-ca-policy.yaml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# This pushes out the HUB's Certificate Authorities on to the imported clusters
2-
{{ if .Values.clusterGroup.isHubCluster }}
2+
{{- if .Values.clusterGroup.isHubCluster }}
3+
{{- if (eq (((.Values.global).secretStore).backend) "vault") }}
34
---
45
apiVersion: policy.open-cluster-management.io/v1
56
kind: Policy
@@ -31,7 +32,7 @@ spec:
3132
type: Opaque
3233
metadata:
3334
name: hub-ca
34-
namespace: imperative
35+
namespace: golang-external-secrets
3536
data:
3637
hub-kube-root-ca.crt: '{{ `{{hub fromConfigMap "" "kube-root-ca.crt" "ca.crt" | base64enc hub}}` }}'
3738
hub-openshift-service-ca.crt: '{{ `{{hub fromConfigMap "" "openshift-service-ca.crt" "service-ca.crt" | base64enc hub}}` }}'
@@ -67,5 +68,5 @@ spec:
6768
operator: NotIn
6869
values:
6970
- 'true'
70-
{{ end }}
71-
71+
{{- end }}
72+
{{- end }}

‎common/acm/templates/policies/application-policies.yaml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,14 @@ spec:
4343
path: {{ default "common/clustergroup" .path }}
4444
helm:
4545
ignoreMissingValueFiles: true
46+
values: |
47+
extraParametersNested:
48+
{{- range $k, $v := $.Values.extraParametersNested }}
49+
{{ $k }}: {{ printf "%s" $v | quote }}
50+
{{- end }}
4651
valueFiles:
4752
{{- include "acm.app.policies.valuefiles" . | nindent 22 }}
48-
{{- range $valueFile := $.Values.global.extraValueFiles }}
53+
{{- range $valueFile := .extraValueFiles }}
4954
- {{ $valueFile | quote }}
5055
{{- end }}
5156
parameters:
@@ -73,6 +78,10 @@ spec:
7378
value: {{ $group.name }}
7479
- name: global.experimentalCapabilities
7580
value: {{ $.Values.global.experimentalCapabilities }}
81+
{{- range $k, $v := $.Values.extraParametersNested }}
82+
- name: {{ $k }}
83+
value: {{ printf "%s" $v | quote }}
84+
{{- end }}
7685
{{- range .helmOverrides }}
7786
- name: {{ .name }}
7887
value: {{ .value | quote }}

‎common/acm/templates/policies/ocp-gitops-policy.yaml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -140,7 +140,7 @@ spec:
140140
- -c
141141
- cat /var/run/kube-root-ca/ca.crt /var/run/trusted-ca/ca-bundle.crt > /tmp/ca-bundles/ca-bundle.crt
142142
|| true
143-
image: registry.access.redhat.com/ubi9/ubi-minimal:latest
143+
image: registry.redhat.io/ubi9/ubi-minimal:latest
144144
name: fetch-ca
145145
resources: {}
146146
volumeMounts:
@@ -195,6 +195,11 @@ spec:
195195
memory: 128Mi
196196
route:
197197
enabled: true
198+
{{- if and (.Values.global.argocdServer) (.Values.global.argocdServer.route) (.Values.global.argocdServer.route.tls) }}
199+
tls:
200+
insecureEdgeTerminationPolicy: {{ default "Redirect" .Values.global.argocdServer.route.tls.insecureEdgeTerminationPolicy }}
201+
termination: {{ default "reencrypt" .Values.global.argocdServer.route.tls.termination }}
202+
{{- end }}
198203
service:
199204
type: ""
200205
sso:

‎common/acm/values.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ global:
99
targetRevision: main
1010
options:
1111
applicationRetryLimit: 20
12+
secretStore:
13+
backend: "vault"
1214

1315
clusterGroup:
1416
subscriptions:

‎common/ansible/roles/iib_ci/README.md‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -52,12 +52,17 @@ make EXTRA_HELM_OPTS="--set main.gitops.operatorSource=iib-${IIB} --set main.git
5252
The advanced-cluster-management operator is a little bit more complex than the others because it
5353
also installes another operator called MCE multicluster-engine. So to install ACM you typically
5454
need two IIBs (one for acm and one for mce). With those two at hand, do the following (the ordering must be
55-
consistent: the first IIB corresponds to the first OPERATOR, etc).
55+
consistent: the first IIB corresponds to the first OPERATOR, etc). The following operation needs to be done
56+
on both hub *and* spokes:
5657

5758
```sh
58-
export OPERATOR=advanced-cluster-management,multicluster-engine
59-
export INDEX_IMAGES=registry-proxy.engineering.redhat.com/rh-osbs/iib:713808,registry-proxy.engineering.redhat.com/rh-osbs/iib:718034
60-
make load-iib
59+
for i in hub-kubeconfig-file spoke-kubeconfig-file; do
60+
export KUBECONFIG="${i}"
61+
export KUBEADMINPASS="11111-22222-33333-44444"
62+
export OPERATOR=advanced-cluster-management,multicluster-engine
63+
export INDEX_IMAGES=registry-proxy.engineering.redhat.com/rh-osbs/iib:713808,registry-proxy.engineering.redhat.com/rh-osbs/iib:718034
64+
make load-iib
65+
done
6166
```
6267

6368
Once the IIBs are loaded into the cluster we need to run the following steps:

‎common/ansible/roles/iib_ci/tasks/main.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@
1717
ansible.builtin.shell: |
1818
oc get openshiftcontrollermanager/cluster -o yaml -o jsonpath='{.status.version}'
1919
register: oc_version_raw
20+
retries: 10
21+
delay: 10
22+
until: oc_version_raw is not failed
2023
changed_when: false
2124

2225
- name: Is OCP pre OCP 4.13? (aka registry supports v2 manifests)

‎common/clustergroup/templates/imperative/clusterrole.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
{{- if not (eq .Values.enabled "plumbing") }}
22
{{/* This is always defined as we always unseal the cluster with an imperative job */}}
3+
{{- if $.Values.clusterGroup.imperative.serviceAccountCreate }}
34
---
45
apiVersion: rbac.authorization.k8s.io/v1
56
kind: ClusterRole
@@ -18,4 +19,19 @@ rules:
1819
- list
1920
- watch
2021
{{- end }}
22+
{{- end }} {{/* if $.Values.clusterGroup.imperative.serviceAccountCreate */}}
23+
{{- if $.Values.clusterGroup.imperative.adminServiceAccountCreate }}
24+
---
25+
apiVersion: rbac.authorization.k8s.io/v1
26+
kind: ClusterRole
27+
metadata:
28+
name: {{ $.Values.clusterGroup.imperative.adminClusterRoleName }}
29+
rules:
30+
- apiGroups:
31+
- '*'
32+
resources:
33+
- '*'
34+
verbs:
35+
- '*'
36+
{{- end }} {{/* if $.Values.clusterGroup.imperative.adminServiceAccountCreate */}}
2137
{{- end }}

‎common/clustergroup/templates/imperative/rbac.yaml‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,11 @@
11
{{- if not (eq .Values.enabled "plumbing") }}
22
{{/* This is always defined as we always unseal the cluster with an imperative job */}}
3+
{{- if $.Values.clusterGroup.imperative.serviceAccountCreate -}}
34
---
45
apiVersion: rbac.authorization.k8s.io/v1
56
kind: ClusterRoleBinding
67
metadata:
7-
name: {{ $.Values.clusterGroup.imperative.namespace }}-cluster-admin-rolebinding
8+
name: {{ $.Values.clusterGroup.imperative.namespace }}-cluster-rolebinding
89
roleRef:
910
apiGroup: rbac.authorization.k8s.io
1011
kind: ClusterRole
@@ -17,7 +18,7 @@ subjects:
1718
apiVersion: rbac.authorization.k8s.io/v1
1819
kind: RoleBinding
1920
metadata:
20-
name: {{ $.Values.clusterGroup.imperative.namespace }}-admin-rolebinding
21+
name: {{ $.Values.clusterGroup.imperative.namespace }}-rolebinding
2122
namespace: {{ $.Values.clusterGroup.imperative.namespace }}
2223
roleRef:
2324
apiGroup: rbac.authorization.k8s.io
@@ -28,3 +29,19 @@ subjects:
2829
name: {{ $.Values.clusterGroup.imperative.serviceAccountName }}
2930
namespace: {{ $.Values.clusterGroup.imperative.namespace }}
3031
{{- end }}
32+
{{- if $.Values.clusterGroup.imperative.adminServiceAccountCreate }}
33+
---
34+
apiVersion: rbac.authorization.k8s.io/v1
35+
kind: ClusterRoleBinding
36+
metadata:
37+
name: {{ $.Values.clusterGroup.imperative.namespace }}-admin-clusterrolebinding
38+
roleRef:
39+
apiGroup: rbac.authorization.k8s.io
40+
kind: ClusterRole
41+
name: {{ $.Values.clusterGroup.imperative.adminClusterRoleName }}
42+
subjects:
43+
- kind: ServiceAccount
44+
name: {{ $.Values.clusterGroup.imperative.adminServiceAccountName }}
45+
namespace: {{ $.Values.clusterGroup.imperative.namespace }}
46+
{{- end }}
47+
{{- end }}

‎common/clustergroup/templates/imperative/serviceaccount.yaml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,18 @@
11
{{- if not (eq .Values.enabled "plumbing") }}
22
{{/* This is always defined as we always unseal the cluster with an imperative job */}}
3-
{{- if $.Values.clusterGroup.imperative.serviceAccountCreate -}}
3+
{{- if $.Values.clusterGroup.imperative.serviceAccountCreate }}
44
apiVersion: v1
55
kind: ServiceAccount
66
metadata:
77
name: {{ $.Values.clusterGroup.imperative.serviceAccountName }}
88
namespace: {{ $.Values.clusterGroup.imperative.namespace }}
99
{{- end }}
10+
{{- if $.Values.clusterGroup.imperative.adminServiceAccountCreate }}
11+
---
12+
apiVersion: v1
13+
kind: ServiceAccount
14+
metadata:
15+
name: {{ $.Values.clusterGroup.imperative.adminServiceAccountName }}
16+
namespace: {{ $.Values.clusterGroup.imperative.namespace }}
17+
{{- end }}
1018
{{- end }}

‎common/clustergroup/templates/plumbing/applications.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,11 @@ spec:
149149
{{- else }}
150150
helm:
151151
ignoreMissingValueFiles: true
152+
values: |
153+
extraParametersNested:
154+
{{- range $k, $v := $.Values.extraParametersNested }}
155+
{{ $k }}: {{ printf "%s" $v | quote }}
156+
{{- end }}
152157
valueFiles:
153158
{{- include "clustergroup.app.globalvalues.prefixedvaluefiles" $ | nindent 8 }}
154159
{{- range $valueFile := $.Values.clusterGroup.sharedValueFiles }}
@@ -216,6 +221,11 @@ spec:
216221
{{- else if not .kustomize }}
217222
helm:
218223
ignoreMissingValueFiles: true
224+
values: |
225+
extraParametersNested:
226+
{{- range $k, $v := $.Values.extraParametersNested }}
227+
{{ $k }}: {{ printf "%s" $v | quote }}
228+
{{- end }}
219229
valueFiles:
220230
{{- include "clustergroup.app.globalvalues.valuefiles" $ | nindent 6 }}
221231
{{- range $valueFile := $.Values.clusterGroup.sharedValueFiles }}

0 commit comments

Comments
 (0)