Skip to content

Commit 6aaa1ce

Browse files
upodroidupodroid
committed
connect the s390x cluster to argocd
1 parent cdb4c87 commit 6aaa1ce

File tree

16 files changed

+713
-0
lines changed

16 files changed

+713
-0
lines changed

‎infra/gcp/terraform/k8s-infra-prow/iam.tf

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -173,3 +173,31 @@ resource "google_iam_workload_identity_pool_provider" "ppc64le" {
173173
jwks_json = data.http.ppc64le_jwks.response_body
174174
}
175175
}
176+
177+
data "http" "s390x_issuer" {
178+
url = "https://d7b2a019-eu-de.lb.appdomain.cloud:6443/.well-known/openid-configuration"
179+
insecure = true
180+
}
181+
182+
data "http" "s390x_jwks" {
183+
url = "https://d7b2a019-eu-de.lb.appdomain.cloud:6443/openid/v1/jwks"
184+
insecure = true
185+
}
186+
187+
resource "google_iam_workload_identity_pool_provider" "s390x" {
188+
workload_identity_pool_id = google_iam_workload_identity_pool.ibm_clusters.workload_identity_pool_id
189+
project = module.project.project_id
190+
workload_identity_pool_provider_id = "s390x"
191+
192+
attribute_mapping = {
193+
"google.subject" = "\"ns/\" + assertion['kubernetes.io']['namespace'] + \"/sa/\" + assertion['kubernetes.io']['serviceaccount']['name']"
194+
"attribute.namespace" = "assertion['kubernetes.io']['namespace']"
195+
"attribute.service_account_name" = "assertion['kubernetes.io']['serviceaccount']['name']"
196+
"attribute.pod" = "assertion['kubernetes.io']['pod']['name']"
197+
}
198+
oidc {
199+
allowed_audiences = ["sts.googleapis.com"]
200+
issuer_uri = jsondecode(data.http.s390xx_issuer.response_body)["issuer"]
201+
jwks_json = data.http.s390x_jwks.response_body
202+
}
203+
}

‎kubernetes/gke-utility/argocd/clusters.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,32 @@ spec:
9696
kind: ClusterSecretStore
9797
name: k8s-infra-prow
9898
---
99+
apiVersion: external-secrets.io/v1beta1
100+
kind: ExternalSecret
101+
metadata:
102+
name: ibm-s390x
103+
spec:
104+
target:
105+
template:
106+
engineVersion: v2
107+
data:
108+
name: ibm-s90x
109+
server: https://d7b2a019-eu-de.lb.appdomain.cloud:6443
110+
config: "{{ .config }}"
111+
metadata:
112+
labels:
113+
clusterType: prow
114+
environment: prod
115+
prowNamespace: test-pods
116+
cloud: ibm
117+
data:
118+
- remoteRef:
119+
key: ibm-s390x-argo-secret
120+
secretKey: config
121+
secretStoreRef:
122+
kind: ClusterSecretStore
123+
name: k8s-infra-prow
124+
---
99125
apiVersion: v1
100126
kind: Secret
101127
metadata:

‎kubernetes/ibm-s390x/OWNERS

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# See the OWNERS docs at https://go.k8s.io/owners
2+
3+
approvers:
4+
- mkumatag
5+
- Prajyot-Parab
6+
- Rajalakshmi-Girish
7+
8+
reviewers:
9+
- mkumatag
10+
- Prajyot-Parab
11+
- Rajalakshmi-Girish
12+
13+
labels:
14+
- sig/k8s-infra
15+
- area/infra
16+
- area/infra/ibmcloud

‎kubernetes/ibm-s390x/helm/external-secrets.yaml

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
extraObjects:
2+
- apiVersion: external-secrets.io/v1beta1
3+
kind: ClusterSecretStore
4+
metadata:
5+
name: k8s-infra-prow-build
6+
spec:
7+
provider:
8+
gcpsm:
9+
projectID: k8s-infra-prow-build
10+
# - apiVersion: external-secrets.io/v1beta1
11+
# kind: ClusterSecretStore
12+
# metadata:
13+
# name: secretstore-ibm-k8s
14+
# spec:
15+
# provider:
16+
# ibm:
17+
# serviceUrl: "https://3297fd32-6322-45e2-af3f-00b1a5af3565.us-south.secrets-manager.appdomain.cloud"
18+
# auth:
19+
# secretRef:
20+
# secretApiKeySecretRef:
21+
# name: ibm-sm-apikey
22+
# key: API_KEY
23+
# namespace: external-secrets
24+
# - apiVersion: external-secrets.io/v1beta1
25+
# kind: ExternalSecret
26+
# metadata:
27+
# name: ibm-sm-apikey
28+
# spec:
29+
# data:
30+
# - remoteRef:
31+
# key: ibm-sm-apikey
32+
# secretKey: API_KEY
33+
# secretStoreRef:
34+
# kind: ClusterSecretStore
35+
# name: k8s-infra-prow-build
36+
- apiVersion: v1
37+
kind: ConfigMap
38+
metadata:
39+
name: google-adc
40+
data:
41+
adc.json: |
42+
{
43+
"universe_domain": "googleapis.com",
44+
"type": "external_account",
45+
"audience": "//iam.googleapis.com/projects/16065310909/locations/global/workloadIdentityPools/ibm-clusters/providers/s390x",
46+
"subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
47+
"token_url": "https://sts.googleapis.com/v1/token",
48+
"credential_source": {
49+
"file": "/var/run/secrets/google-iam-token/serviceaccount/token",
50+
"format": {
51+
"type": "text"
52+
}
53+
}
54+
}
55+
# - apiVersion: external-secrets.io/v1beta1
56+
# kind: ExternalSecret
57+
# metadata:
58+
# name: secret-rotator-api-key
59+
# spec:
60+
# refreshInterval: 60m
61+
# secretStoreRef:
62+
# name: secretstore-ibm-k8s
63+
# kind: ClusterSecretStore
64+
# target:
65+
# name: secret-rotator-api-key
66+
# creationPolicy: Owner
67+
# data:
68+
# - secretKey: api-key
69+
# remoteRef:
70+
# key: iam_credentials/2067d245-e61c-11b2-2c5a-b2be281ea4b8
71+
# - apiVersion: batch/v1
72+
# kind: CronJob
73+
# metadata:
74+
# name: ibmcloud-secret-rotator
75+
# labels:
76+
# app: ibmcloud-secret-rotator
77+
# spec:
78+
# schedule: "0 */2 * * *"
79+
# jobTemplate:
80+
# spec:
81+
# template:
82+
# spec:
83+
# containers:
84+
# - name: rotator-container
85+
# image: public.ecr.aws/docker/library/golang:1.24
86+
# imagePullPolicy: Always
87+
# command:
88+
# - /bin/bash
89+
# args:
90+
# - -c
91+
# - |
92+
# set -o errexit
93+
# set -o nounset
94+
# set -o pipefail
95+
96+
# go install sigs.k8s.io/provider-ibmcloud-test-infra/secret-manager@71ef4d8
97+
# secret-manager rotate --instance-id 3297fd32-6322-45e2-af3f-00b1a5af3565 --labels rotate:true --confirm
98+
# env:
99+
# - name: IBMCLOUD_ENV_FILE
100+
# value: "/home/.ibmcloud/api-key"
101+
# volumeMounts:
102+
# - name: credentials
103+
# mountPath: /home/.ibmcloud
104+
# restartPolicy: OnFailure
105+
# volumes:
106+
# - name: credentials
107+
# secret:
108+
# secretName: secret-rotator-api-key
109+
110+
extraVolumes:
111+
- name: google-iam-token
112+
projected:
113+
defaultMode: 420
114+
sources:
115+
- serviceAccountToken:
116+
audience: sts.googleapis.com
117+
expirationSeconds: 86400
118+
path: token
119+
- name: google-adc
120+
configMap:
121+
name: google-adc
122+
123+
extraEnv:
124+
- name: GOOGLE_APPLICATION_CREDENTIALS
125+
value: /etc/google/adc.json
126+
127+
extraVolumeMounts:
128+
- mountPath: /var/run/secrets/google-iam-token/serviceaccount
129+
name: google-iam-token
130+
readOnly: true
131+
- mountPath: /etc/google
132+
name: google-adc
133+
readOnly: true

‎kubernetes/ibm-s390x/helm/kyverno.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
webhooksCleanup:
3+
image:
4+
repository: registry.k8s.io/kubectl
5+
tag: v1.32.3
6+
7+
policyReportsCleanup:
8+
image:
9+
repository: registry.k8s.io/kubectl
10+
tag: v1.32.3

‎kubernetes/ibm-s390x/prow/boskos-janitor.yaml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: boskos-ibmcloud-janitor
5+
labels:
6+
app: boskos-ibmcloud-janitor
7+
spec:
8+
replicas: 2 # 2 distributed janitor instances
9+
selector:
10+
matchLabels:
11+
app: boskos-ibmcloud-janitor
12+
template:
13+
metadata:
14+
labels:
15+
app: boskos-ibmcloud-janitor
16+
spec:
17+
terminationGracePeriodSeconds: 300
18+
containers:
19+
- name: boskos-ibmcloud-janitor
20+
image: gcr.io/k8s-staging-boskos/ibmcloud-janitor-boskos:v20250612-e9e5322
21+
args:
22+
- --boskos-url=http://boskos.test-pods.svc.cluster.local.
23+
- --resource-type=powervs
24+
- --ignore-api-key=true
25+
- --account-id=efa47ec6fd45473a9e1fd6b7b8363f5c
26+
env:
27+
- name: IBMCLOUD_ENV_FILE # TODO: explore on how to read key from the file instead of env var
28+
value: "/home/.ibmcloud/api-key"
29+
volumeMounts:
30+
- name: credentials
31+
mountPath: /home/.ibmcloud
32+
volumes:
33+
- name: credentials
34+
secret:
35+
secretName: boskos-janitor-api-key

‎kubernetes/ibm-s390x/prow/boskos-reaper.yaml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: boskos-reaper
5+
labels:
6+
app: boskos-reaper
7+
spec:
8+
selector:
9+
matchLabels:
10+
app: boskos-reaper
11+
replicas: 1 # one canonical source of resources
12+
template:
13+
metadata:
14+
labels:
15+
app: boskos-reaper
16+
spec:
17+
terminationGracePeriodSeconds: 30
18+
containers:
19+
- name: boskos-reaper
20+
image: gcr.io/k8s-staging-boskos/reaper:v20250612-e9e5322
21+
args:
22+
- --boskos-url=http://boskos.test-pods.svc.cluster.local.
23+
- --resource-type=powervs

‎kubernetes/ibm-s390x/prow/boskos-resources-configmap.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: v1
2+
data:
3+
config: |
4+
resources:
5+
- names:
6+
- k8s-s390x-test-vpc
7+
state: dirty
8+
type: vpc-service
9+
kind: ConfigMap
10+
metadata:
11+
name: resources

‎kubernetes/ibm-s390x/prow/boskos.yaml

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
# Copyright 2017 The Kubernetes Authors.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
kind: ClusterRole
15+
apiVersion: rbac.authorization.k8s.io/v1
16+
metadata:
17+
name: boskos
18+
rules:
19+
- apiGroups: ["boskos.k8s.io"]
20+
verbs: ["*"]
21+
resources: ["*"]
22+
---
23+
kind: ServiceAccount
24+
apiVersion: v1
25+
metadata:
26+
name: boskos
27+
namespace: test-pods
28+
---
29+
kind: ClusterRoleBinding
30+
apiVersion: rbac.authorization.k8s.io/v1
31+
metadata:
32+
name: boskos
33+
subjects:
34+
- kind: ServiceAccount
35+
name: boskos
36+
namespace: test-pods
37+
roleRef:
38+
kind: ClusterRole
39+
name: boskos
40+
apiGroup: rbac.authorization.k8s.io
41+
---
42+
apiVersion: apps/v1
43+
kind: Deployment
44+
metadata:
45+
name: boskos
46+
namespace: test-pods
47+
spec:
48+
replicas: 1 # one canonical source of resources
49+
selector:
50+
matchLabels:
51+
app: boskos
52+
template:
53+
metadata:
54+
labels:
55+
app: boskos
56+
namespace: test-pods
57+
spec:
58+
serviceAccountName: boskos
59+
terminationGracePeriodSeconds: 30
60+
containers:
61+
- name: boskos
62+
image: gcr.io/k8s-staging-boskos/boskos:v20250612-e9e5322
63+
args:
64+
- --config=/etc/config/config
65+
- --namespace=test-pods
66+
ports:
67+
- containerPort: 8080
68+
protocol: TCP
69+
volumeMounts:
70+
- name: boskos-config
71+
mountPath: /etc/config
72+
readOnly: true
73+
volumes:
74+
- name: boskos-config
75+
configMap:
76+
name: resources
77+
---
78+
apiVersion: v1
79+
kind: Service
80+
metadata:
81+
name: boskos
82+
namespace: test-pods
83+
spec:
84+
selector:
85+
app: boskos
86+
ports:
87+
- name: default
88+
protocol: TCP
89+
port: 80
90+
targetPort: 8080

0 commit comments

Comments
 (0)