Skip to content

Commit bbbafb3

Browse files
onelrianonelrian
authored
Merge pull request #26 from ADORSYS-GIS/22-automate-argocd-multi-tenant-cluster-configuration
feat: ArgoCD Agent Multi-Tenant Cluster Infrastructure with Terraform
2 parents 542a8c2 + 5d95060 commit bbbafb3

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

54 files changed

+10455
-121
lines changed

‎.github/workflows/checks.yaml‎

Lines changed: 0 additions & 65 deletions
This file was deleted.

‎.github/workflows/terraform-ci.yaml‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
name: Terraform CI
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- '**/terraform/**'
7+
- '.github/workflows/terraform-ci.yaml'
8+
push:
9+
branches:
10+
- main
11+
paths:
12+
- '**/terraform/**'
13+
workflow_dispatch:
14+
15+
permissions:
16+
contents: read
17+
pull-requests: write
18+
19+
jobs:
20+
terraform-fmt:
21+
name: Format Check
22+
runs-on: ubuntu-latest
23+
strategy:
24+
fail-fast: false
25+
matrix:
26+
component:
27+
- argocd-agent
28+
- argocd
29+
- cert-manager
30+
- ingress-controller
31+
- lgtm-stack
32+
33+
steps:
34+
- name: Checkout
35+
uses: actions/checkout@v4
36+
37+
- name: Setup Terraform
38+
uses: hashicorp/setup-terraform@v3
39+
with:
40+
terraform_version: "~> 1.0"
41+
42+
- name: Terraform Format Check
43+
id: fmt
44+
working-directory: ${{ matrix.component }}/terraform
45+
run: terraform fmt -check -recursive
46+
continue-on-error: false
47+
48+
terraform-validate:
49+
name: Validate
50+
runs-on: ubuntu-latest
51+
strategy:
52+
fail-fast: false
53+
matrix:
54+
component:
55+
- argocd-agent
56+
- argocd
57+
- cert-manager
58+
- ingress-controller
59+
- lgtm-stack
60+
61+
steps:
62+
- name: Checkout
63+
uses: actions/checkout@v4
64+
65+
- name: Setup Terraform
66+
uses: hashicorp/setup-terraform@v3
67+
with:
68+
terraform_version: "~> 1.0"
69+
70+
- name: Terraform Init
71+
id: init
72+
working-directory: ${{ matrix.component }}/terraform
73+
run: terraform init -backend=false
74+
75+
- name: Terraform Validate
76+
id: validate
77+
working-directory: ${{ matrix.component }}/terraform
78+
run: terraform validate -no-color
79+
80+
tfsec:
81+
name: Security Scan
82+
runs-on: ubuntu-latest
83+
strategy:
84+
fail-fast: false
85+
matrix:
86+
component:
87+
- argocd-agent
88+
- argocd
89+
- cert-manager
90+
- ingress-controller
91+
- lgtm-stack
92+
93+
steps:
94+
- name: Checkout
95+
uses: actions/checkout@v4
96+
97+
- name: Run tfsec
98+
uses: aquasecurity/tfsec-action@v1.0.3
99+
with:
100+
working_directory: ${{ matrix.component }}/terraform
101+
soft_fail: true
102+
103+

‎.gitignore‎

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -97,10 +97,9 @@ yarn.lock
9797
*.tfstate.*
9898
*.tfstate.backup
9999
*.backup
100-
*.tfvars
101-
!*.tfvars.template
102100
.terraform/
103101
.terraform.lock.hcl
102+
terraform.tfplan
104103

105104
# Crash logs
106105
crash.log
@@ -109,3 +108,33 @@ crash.*.log
109108
# Ignore CLI configuration files
110109
.terraformrc
111110
terraform.rc
111+
112+
# Terraform sensitive variable files
113+
*.tfvars
114+
*.auto.tfvars
115+
*.auto.tfvars.json
116+
!*.tfvars.template
117+
!*.tfvars.example
118+
119+
# Terraform override files (for personal configs)
120+
override.tf
121+
override.tf.json
122+
*_override.tf
123+
*_override.tf.json
124+
125+
# Environment variables with secrets
126+
.env.local
127+
*.env
128+
129+
# PKI backups (contain sensitive keys)
130+
pki-ca-backup-*.yaml
131+
pki-ca-backup*.yaml
132+
pki-ca-backup*.yaml.gpg
133+
134+
# Terraform temp files
135+
.principal_ip.json
136+
*LOG_FILE
137+
138+
# Zencoder files
139+
.zencoder
140+
.zenflow

‎README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ Comprehensive monitoring, logging, and distributed tracing platform built on Gra
2121
### [ArgoCD GitOps Engine](argocd/README.md)
2222
Declarative continuous delivery system for managing Kubernetes applications and configurations through Git-based workflows.
2323

24+
### [ArgoCD Agent (Hub-and-Spoke)](argocd-agent/README.md)
25+
Production-grade multi-cluster GitOps with Argo CD Agent Managed Mode for centralized control plane with distributed spoke clusters.
26+
2427
### [cert-manager Certificate Authority](cert-manager/README.md)
2528
Automated X.509 certificate lifecycle management with native support for ACME providers including Let's Encrypt.
2629

‎argocd-agent/README.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# ArgoCD Agent (Hub-and-Spoke)
2+
3+
Multi-cluster GitOps with centralized control plane and distributed agents. Single ArgoCD UI manages applications across unlimited Kubernetes clusters.
4+
5+
**Official Documentation**: [argocd-agent.readthedocs.io](https://argocd-agent.readthedocs.io/)
6+
**GitHub Repository**: [argoproj-labs/argocd-agent](https://github.com/argoproj-labs/argocd-agent)
7+
8+
## Architecture
9+
10+
Hub-and-spoke pattern where hub cluster runs ArgoCD control plane (UI + Principal), spoke clusters run lightweight agents that connect via gRPC to deploy applications.
11+
12+
**Use ArgoCD Agent when**:
13+
- Managing 5+ clusters across networks/clouds
14+
- Clusters behind NAT/firewalls need centralized GitOps
15+
- Need local repo servers per cluster for compliance
16+
17+
**Use Standard ArgoCD when**:
18+
- < 5 clusters in same VPC with full mesh connectivity
19+
- Need full UI features (terminal, pod logs, tree view)
20+
21+
See [Architecture guide](../docs/argocd-agent-architecture.md) for detailed comparison.
22+
23+
## Deployment
24+
25+
### Automated (Terraform)
26+
Recommended for production with infrastructure-as-code.
27+
28+
See [Terraform deployment guide](../docs/argocd-agent-terraform-deployment.md)
29+
30+
### Manual (Shell Scripts)
31+
Step-by-step deployment using `scripts/01-hub-setup.sh` through `05-verify.sh`.
32+
33+
See [Terraform deployment guide](../docs/argocd-agent-terraform-deployment.md#manual-deployment-scripts) for script usage.
34+
35+
## Configuration & Operations
36+
37+
- **Configuration Reference**: [All Terraform variables](../docs/argocd-agent-configuration.md)
38+
- **Operations Guide**: [Day-2 ops, scaling, upgrades, certificates, teardown](../docs/argocd-agent-operations.md)
39+
- **RBAC & SSO**: [Keycloak integration](../docs/argocd-agent-rbac.md)
40+
- **Troubleshooting**: [Common issues and solutions](../docs/argocd-agent-troubleshooting.md)
41+
42+
## Version Compatibility
43+
44+
- ArgoCD Agent: v0.5.3
45+
- Kubernetes: 1.24-1.28
46+
- Terraform: >= 1.0

‎argocd-agent/scripts/01-hub-setup.sh‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
#!/bin/bash
2+
# Step 1: Control Plane Setup (Official Guide)
3+
# 1.1 Create Namespace
4+
# 1.2 Install Argo CD (Principal Profile)
5+
# 1.3 Enable Apps-in-Any-Namespace
6+
# 1.4 Expose UI
7+
8+
set -e
9+
10+
# Configuration
11+
HUB_CTX="${HUB_CTX:-}"
12+
VERSION="${VERSION:-v0.5.3}"
13+
14+
# Usage
15+
if [ -z "$HUB_CTX" ]; then
16+
echo "Usage: HUB_CTX=<context> [VERSION=v0.5.3] $0"
17+
echo ""
18+
echo "Example:"
19+
echo " HUB_CTX=gke_project_region_cluster VERSION=v0.5.3 $0"
20+
echo ""
21+
echo "Available contexts:"
22+
kubectl config get-contexts -o name
23+
exit 1
24+
fi
25+
26+
echo "════════════════════════════════════════════════"
27+
echo " Step 1: Control Plane Setup"
28+
echo "════════════════════════════════════════════════"
29+
echo ""
30+
31+
# 1.1 Create Namespace
32+
echo "→ Creating namespace 'argocd'..."
33+
kubectl create namespace argocd --context $HUB_CTX --dry-run=client -o yaml | kubectl apply --context $HUB_CTX -f -
34+
35+
# 1.2 Install Argo CD (Principal Profile)
36+
echo "→ Installing Argo CD (Principal Profile) ref=${VERSION}..."
37+
kubectl apply -n argocd \
38+
-k "https://github.com/argoproj-labs/argocd-agent/install/kubernetes/argo-cd/principal?ref=${VERSION}" \
39+
--context $HUB_CTX
40+
41+
echo "→ Waiting for argocd-server..."
42+
kubectl wait --for=condition=available --timeout=300s \
43+
deployment/argocd-server -n argocd --context $HUB_CTX
44+
45+
# 1.3 Enable Apps-in-Any-Namespace
46+
echo "→ Enabling apps-in-any-namespace..."
47+
kubectl patch configmap argocd-cmd-params-cm -n argocd --context $HUB_CTX \
48+
--type='merge' \
49+
--patch '{"data":{"application.namespaces":"*"}}'
50+
51+
echo "→ Restarting argocd-server..."
52+
kubectl rollout restart deployment argocd-server -n argocd --context $HUB_CTX
53+
kubectl rollout status deployment/argocd-server -n argocd --context $HUB_CTX
54+
55+
# 1.4 Expose Argo CD UI (LoadBalancer)
56+
echo "→ Exposing Argo CD UI via LoadBalancer..."
57+
kubectl patch svc argocd-server -n argocd --context $HUB_CTX \
58+
--patch '{"spec":{"type":"LoadBalancer"}}'
59+
60+
echo "→ Waiting for External IP..."
61+
EXTERNAL_IP=""
62+
while [ -z "$EXTERNAL_IP" ]; do
63+
echo " Waiting for IP..."
64+
sleep 5
65+
EXTERNAL_IP=$(kubectl get svc argocd-server -n argocd --context $HUB_CTX -o jsonpath='{.status.loadBalancer.ingress[0].ip}' 2>/dev/null)
66+
done
67+
echo "✓ Argo CD UI available at https://$EXTERNAL_IP"
68+
echo ""
69+
echo "Step 1 Complete."

0 commit comments

Comments
 (0)