Skip to content

Commit 0c399b6

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #8332 from upodroid/s390x-cluster
connect the s390x cluster to argocd
2 parents a13ecaf + 2e87c0e commit 0c399b6

21 files changed

+721
-8
lines changed

‎infra/gcp/terraform/k8s-infra-prow/buckets.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ limitations under the License.
1616

1717
module "gcb_bucket" {
1818
source = "terraform-google-modules/cloud-storage/google//modules/simple_bucket"
19-
version = "~> 5"
19+
version = "~> 11.0"
2020

2121
name = "k8s-infra-prow-gcb"
2222
project_id = module.project.project_id

‎infra/gcp/terraform/k8s-infra-prow/gke.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ limitations under the License.
1717
// WARNING, MAKE SURE YOU DON"T DESTROY THESE CLUSTERS ACCIDENTALLY
1818
module "prow" {
1919
source = "terraform-google-modules/kubernetes-engine/google//modules/beta-private-cluster"
20-
version = "~> 30.2"
20+
version = "~> 37.1"
2121
project_id = module.project.project_id
2222
name = "prow"
2323
region = "us-central1"
@@ -73,7 +73,7 @@ module "prow" {
7373

7474
module "utility_cluster" {
7575
source = "terraform-google-modules/kubernetes-engine/google//modules/beta-private-cluster"
76-
version = "~> 30.2"
76+
version = "~> 37.1"
7777
project_id = module.project.project_id
7878
name = "utility"
7979
region = "us-central1"

‎infra/gcp/terraform/k8s-infra-prow/iam.tf

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -173,3 +173,31 @@ resource "google_iam_workload_identity_pool_provider" "ppc64le" {
173173
jwks_json = data.http.ppc64le_jwks.response_body
174174
}
175175
}
176+
177+
data "http" "s390x_issuer" {
178+
url = "https://d7b2a019-eu-de.lb.appdomain.cloud:6443/.well-known/openid-configuration"
179+
insecure = true
180+
}
181+
182+
data "http" "s390x_jwks" {
183+
url = "https://d7b2a019-eu-de.lb.appdomain.cloud:6443/openid/v1/jwks"
184+
insecure = true
185+
}
186+
187+
resource "google_iam_workload_identity_pool_provider" "s390x" {
188+
workload_identity_pool_id = google_iam_workload_identity_pool.ibm_clusters.workload_identity_pool_id
189+
project = module.project.project_id
190+
workload_identity_pool_provider_id = "s390x"
191+
192+
attribute_mapping = {
193+
"google.subject" = "\"ns/\" + assertion['kubernetes.io']['namespace'] + \"/sa/\" + assertion['kubernetes.io']['serviceaccount']['name']"
194+
"attribute.namespace" = "assertion['kubernetes.io']['namespace']"
195+
"attribute.service_account_name" = "assertion['kubernetes.io']['serviceaccount']['name']"
196+
"attribute.pod" = "assertion['kubernetes.io']['pod']['name']"
197+
}
198+
oidc {
199+
allowed_audiences = ["sts.googleapis.com"]
200+
issuer_uri = jsondecode(data.http.s390x_issuer.response_body)["issuer"]
201+
jwks_json = data.http.s390x_jwks.response_body
202+
}
203+
}

‎infra/gcp/terraform/k8s-infra-prow/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ limitations under the License.
1616

1717
module "project" {
1818
source = "terraform-google-modules/project-factory/google"
19-
version = "~> 14.5"
19+
version = "~> 18.0"
2020

2121
name = "k8s-infra-prow"
2222
project_id = "k8s-infra-prow"

‎infra/gcp/terraform/k8s-infra-prow/provider.tf

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ limitations under the License.
1515
*/
1616

1717
terraform {
18-
required_version = "1.6.5"
18+
required_version = "1.10.5"
1919

2020
backend "gcs" {
2121
bucket = "k8s-infra-tf-prow-clusters"
@@ -25,11 +25,11 @@ terraform {
2525
required_providers {
2626
google = {
2727
source = "hashicorp/google"
28-
version = "~> 5.45.2"
28+
version = "~> 6.45.0"
2929
}
3030
google-beta = {
3131
source = "hashicorp/google-beta"
32-
version = "~> 5.45.2"
32+
version = "~> 6.45.0"
3333
}
3434
}
3535
}

‎infra/gcp/terraform/k8s-infra-prow/vpc.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ limitations under the License.
1616

1717
module "vpc" {
1818
source = "terraform-google-modules/network/google"
19-
version = "~> 9.3"
19+
version = "~> 11.1"
2020

2121
project_id = module.project.project_id
2222
network_name = "prow"

‎kubernetes/gke-utility/argocd/clusters.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,32 @@ spec:
9696
kind: ClusterSecretStore
9797
name: k8s-infra-prow
9898
---
99+
apiVersion: external-secrets.io/v1beta1
100+
kind: ExternalSecret
101+
metadata:
102+
name: ibm-s390x
103+
spec:
104+
target:
105+
template:
106+
engineVersion: v2
107+
data:
108+
name: ibm-s90x
109+
server: https://d7b2a019-eu-de.lb.appdomain.cloud:6443
110+
config: "{{ .config }}"
111+
metadata:
112+
labels:
113+
clusterType: prow
114+
environment: prod
115+
prowNamespace: test-pods
116+
cloud: ibm
117+
data:
118+
- remoteRef:
119+
key: ibm-s390x-argo-secret
120+
secretKey: config
121+
secretStoreRef:
122+
kind: ClusterSecretStore
123+
name: k8s-infra-prow
124+
---
99125
apiVersion: v1
100126
kind: Secret
101127
metadata:

‎kubernetes/ibm-s390x/OWNERS

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# See the OWNERS docs at https://go.k8s.io/owners
2+
3+
approvers:
4+
- mkumatag
5+
- Prajyot-Parab
6+
- Rajalakshmi-Girish
7+
8+
reviewers:
9+
- mkumatag
10+
- Prajyot-Parab
11+
- Rajalakshmi-Girish
12+
13+
labels:
14+
- sig/k8s-infra
15+
- area/infra
16+
- area/infra/ibmcloud

‎kubernetes/ibm-s390x/helm/external-secrets.yaml

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
extraObjects:
2+
- apiVersion: external-secrets.io/v1beta1
3+
kind: ClusterSecretStore
4+
metadata:
5+
name: k8s-infra-prow-build
6+
spec:
7+
provider:
8+
gcpsm:
9+
projectID: k8s-infra-prow-build
10+
# - apiVersion: external-secrets.io/v1beta1
11+
# kind: ClusterSecretStore
12+
# metadata:
13+
# name: secretstore-ibm-k8s
14+
# spec:
15+
# provider:
16+
# ibm:
17+
# serviceUrl: "https://3297fd32-6322-45e2-af3f-00b1a5af3565.us-south.secrets-manager.appdomain.cloud"
18+
# auth:
19+
# secretRef:
20+
# secretApiKeySecretRef:
21+
# name: ibm-sm-apikey
22+
# key: API_KEY
23+
# namespace: external-secrets
24+
# - apiVersion: external-secrets.io/v1beta1
25+
# kind: ExternalSecret
26+
# metadata:
27+
# name: ibm-sm-apikey
28+
# spec:
29+
# data:
30+
# - remoteRef:
31+
# key: ibm-sm-apikey
32+
# secretKey: API_KEY
33+
# secretStoreRef:
34+
# kind: ClusterSecretStore
35+
# name: k8s-infra-prow-build
36+
- apiVersion: v1
37+
kind: ConfigMap
38+
metadata:
39+
name: google-adc
40+
data:
41+
adc.json: |
42+
{
43+
"universe_domain": "googleapis.com",
44+
"type": "external_account",
45+
"audience": "//iam.googleapis.com/projects/16065310909/locations/global/workloadIdentityPools/ibm-clusters/providers/s390x",
46+
"subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
47+
"token_url": "https://sts.googleapis.com/v1/token",
48+
"credential_source": {
49+
"file": "/var/run/secrets/google-iam-token/serviceaccount/token",
50+
"format": {
51+
"type": "text"
52+
}
53+
}
54+
}
55+
# - apiVersion: external-secrets.io/v1beta1
56+
# kind: ExternalSecret
57+
# metadata:
58+
# name: secret-rotator-api-key
59+
# spec:
60+
# refreshInterval: 60m
61+
# secretStoreRef:
62+
# name: secretstore-ibm-k8s
63+
# kind: ClusterSecretStore
64+
# target:
65+
# name: secret-rotator-api-key
66+
# creationPolicy: Owner
67+
# data:
68+
# - secretKey: api-key
69+
# remoteRef:
70+
# key: iam_credentials/2067d245-e61c-11b2-2c5a-b2be281ea4b8
71+
# - apiVersion: batch/v1
72+
# kind: CronJob
73+
# metadata:
74+
# name: ibmcloud-secret-rotator
75+
# labels:
76+
# app: ibmcloud-secret-rotator
77+
# spec:
78+
# schedule: "0 */2 * * *"
79+
# jobTemplate:
80+
# spec:
81+
# template:
82+
# spec:
83+
# containers:
84+
# - name: rotator-container
85+
# image: public.ecr.aws/docker/library/golang:1.24
86+
# imagePullPolicy: Always
87+
# command:
88+
# - /bin/bash
89+
# args:
90+
# - -c
91+
# - |
92+
# set -o errexit
93+
# set -o nounset
94+
# set -o pipefail
95+
96+
# go install sigs.k8s.io/provider-ibmcloud-test-infra/secret-manager@71ef4d8
97+
# secret-manager rotate --instance-id 3297fd32-6322-45e2-af3f-00b1a5af3565 --labels rotate:true --confirm
98+
# env:
99+
# - name: IBMCLOUD_ENV_FILE
100+
# value: "/home/.ibmcloud/api-key"
101+
# volumeMounts:
102+
# - name: credentials
103+
# mountPath: /home/.ibmcloud
104+
# restartPolicy: OnFailure
105+
# volumes:
106+
# - name: credentials
107+
# secret:
108+
# secretName: secret-rotator-api-key
109+
110+
extraVolumes:
111+
- name: google-iam-token
112+
projected:
113+
defaultMode: 420
114+
sources:
115+
- serviceAccountToken:
116+
audience: sts.googleapis.com
117+
expirationSeconds: 86400
118+
path: token
119+
- name: google-adc
120+
configMap:
121+
name: google-adc
122+
123+
extraEnv:
124+
- name: GOOGLE_APPLICATION_CREDENTIALS
125+
value: /etc/google/adc.json
126+
127+
extraVolumeMounts:
128+
- mountPath: /var/run/secrets/google-iam-token/serviceaccount
129+
name: google-iam-token
130+
readOnly: true
131+
- mountPath: /etc/google
132+
name: google-adc
133+
readOnly: true

‎kubernetes/ibm-s390x/helm/kyverno.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
webhooksCleanup:
3+
image:
4+
repository: registry.k8s.io/kubectl
5+
tag: v1.32.3
6+
7+
policyReportsCleanup:
8+
image:
9+
repository: registry.k8s.io/kubectl
10+
tag: v1.32.3

0 commit comments

Comments
 (0)