Skip to content

Commit 50ac61c

Browse files
rh-hemartinrh-hemartin
authored
KubeArchive: install kflux-rhel-p01 (#7380)
Signed-off-by: Hector Martinez <[email protected]>
1 parent 7d8607c commit 50ac61c

File tree

4 files changed

+202
-1
lines changed

4 files changed

+202
-1
lines changed

‎argo-cd-apps/base/member/infra-deployments/kubearchive/kubearchive.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,10 @@ spec:
3232
# values.clusterDir: stone-prd-rh01
3333
# - nameNormalized: kflux-prd-rh02
3434
# values.clusterDir: kflux-prd-rh02
35-
# database is not created here yet
3635
- nameNormalized: kflux-prd-rh03
3736
values.clusterDir: kflux-prd-rh03
37+
- nameNormalized: kflux-rhel-p01
38+
values.clusterDir: kflux-rhel-p01
3839
template:
3940
metadata:
4041
name: kubearchive-{{nameNormalized}}

‎components/konflux-ui/production/kflux-rhel-p01/kustomization.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ configMapGenerator:
1212
literals:
1313
- IMPERSONATE=true
1414
- TEKTON_RESULTS_URL=https://tekton-results-api-service.tekton-results.svc.cluster.local:8080
15+
- KUBEARCHIVE_URL=https://kubearchive-api-server.product-kubearchive.svc.cluster.local:8081
1516

1617
patches:
1718
- path: add-service-certs-patch.yaml

‎components/kubearchive/production/kflux-rhel-p01/kustomization.yaml

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
---
2+
apiVersion: kustomize.config.k8s.io/v1beta1
3+
kind: Kustomization
4+
resources:
5+
- ../../base
6+
- ../base
7+
- https://github.com/kubearchive/kubearchive/releases/download/v1.3.0/kubearchive.yaml?timeout=90
8+
9+
namespace: product-kubearchive
10+
11+
patches:
12+
- patch: |-
13+
apiVersion: batch/v1
14+
kind: Job
15+
metadata:
16+
name: kubearchive-schema-migration
17+
spec:
18+
template:
19+
spec:
20+
containers:
21+
- name: migration
22+
env:
23+
- name: KUBEARCHIVE_VERSION
24+
value: v1.3.0
25+
# We don't need the Secret as it will be created by the ExternalSecrets Operator
26+
- patch: |-
27+
$patch: delete
28+
apiVersion: v1
29+
kind: Secret
30+
metadata:
31+
name: kubearchive-database-credentials
32+
namespace: kubearchive
33+
- patch: |-
34+
apiVersion: external-secrets.io/v1beta1
35+
kind: ExternalSecret
36+
metadata:
37+
name: database-secret
38+
spec:
39+
secretStoreRef:
40+
name: appsre-stonesoup-vault
41+
dataFrom:
42+
- extract:
43+
key: production/platform/terraform/generated/kflux-rhel-p01/kubearchive-database
44+
# These patches add an annotation so an OpenShift service
45+
# creates the TLS secrets instead of Cert Manager
46+
- patch: |-
47+
apiVersion: v1
48+
kind: Service
49+
metadata:
50+
name: kubearchive-api-server
51+
namespace: kubearchive
52+
annotations:
53+
service.beta.openshift.io/serving-cert-secret-name: kubearchive-api-server-tls
54+
- patch: |-
55+
apiVersion: v1
56+
kind: Service
57+
metadata:
58+
name: kubearchive-operator-webhooks
59+
namespace: kubearchive
60+
annotations:
61+
service.beta.openshift.io/serving-cert-secret-name: kubearchive-operator-tls
62+
- patch: |-
63+
apiVersion: admissionregistration.k8s.io/v1
64+
kind: MutatingWebhookConfiguration
65+
metadata:
66+
name: kubearchive-mutating-webhook-configuration
67+
annotations:
68+
service.beta.openshift.io/inject-cabundle: "true"
69+
- patch: |-
70+
apiVersion: admissionregistration.k8s.io/v1
71+
kind: ValidatingWebhookConfiguration
72+
metadata:
73+
name: kubearchive-validating-webhook-configuration
74+
annotations:
75+
service.beta.openshift.io/inject-cabundle: "true"
76+
# These patches solve Kube Linter problems
77+
- patch: |-
78+
apiVersion: apps/v1
79+
kind: Deployment
80+
metadata:
81+
name: kubearchive-api-server
82+
namespace: kubearchive
83+
spec:
84+
template:
85+
spec:
86+
containers:
87+
- name: kubearchive-api-server
88+
env:
89+
- name: KUBEARCHIVE_OTEL_MODE
90+
value: enabled
91+
- name: OTEL_EXPORTER_OTLP_ENDPOINT
92+
value: http://otel-collector:4318
93+
- name: AUTH_IMPERSONATE
94+
value: "true"
95+
securityContext:
96+
readOnlyRootFilesystem: true
97+
runAsNonRoot: true
98+
- patch: |-
99+
apiVersion: apps/v1
100+
kind: Deployment
101+
metadata:
102+
name: kubearchive-operator
103+
namespace: kubearchive
104+
spec:
105+
template:
106+
spec:
107+
containers:
108+
- name: manager
109+
args: [--health-probe-bind-address=:8081]
110+
env:
111+
- name: KUBEARCHIVE_OTEL_MODE
112+
value: enabled
113+
- name: OTEL_EXPORTER_OTLP_ENDPOINT
114+
value: http://otel-collector:4318
115+
securityContext:
116+
readOnlyRootFilesystem: true
117+
runAsNonRoot: true
118+
ports:
119+
- containerPort: 8081
120+
resources:
121+
limits:
122+
cpu: 100m
123+
memory: 512Mi
124+
requests:
125+
cpu: 100m
126+
memory: 512Mi
127+
128+
- patch: |-
129+
apiVersion: apps/v1
130+
kind: Deployment
131+
metadata:
132+
name: kubearchive-sink
133+
namespace: kubearchive
134+
spec:
135+
template:
136+
spec:
137+
containers:
138+
- name: kubearchive-sink
139+
env:
140+
- name: KUBEARCHIVE_OTEL_MODE
141+
value: enabled
142+
- name: OTEL_EXPORTER_OTLP_ENDPOINT
143+
value: http://otel-collector:4318
144+
securityContext:
145+
readOnlyRootFilesystem: true
146+
runAsNonRoot: true
147+
resources:
148+
limits:
149+
cpu: 200m
150+
memory: 128Mi
151+
requests:
152+
cpu: 200m
153+
memory: 128Mi
154+
155+
# We don't need this CronJob as it is suspended, we can enable it later
156+
- patch: |-
157+
$patch: delete
158+
apiVersion: batch/v1
159+
kind: CronJob
160+
metadata:
161+
name: cluster-vacuum
162+
namespace: kubearchive
163+
# These patches remove Certificates and Issuer from Cert-Manager
164+
- patch: |-
165+
$patch: delete
166+
apiVersion: cert-manager.io/v1
167+
kind: Certificate
168+
metadata:
169+
name: "kubearchive-api-server-certificate"
170+
namespace: kubearchive
171+
- patch: |-
172+
$patch: delete
173+
apiVersion: cert-manager.io/v1
174+
kind: Certificate
175+
metadata:
176+
name: "kubearchive-ca"
177+
namespace: kubearchive
178+
- patch: |-
179+
$patch: delete
180+
apiVersion: cert-manager.io/v1
181+
kind: Issuer
182+
metadata:
183+
name: "kubearchive-ca"
184+
namespace: kubearchive
185+
- patch: |-
186+
$patch: delete
187+
apiVersion: cert-manager.io/v1
188+
kind: Issuer
189+
metadata:
190+
name: "kubearchive"
191+
namespace: kubearchive
192+
- patch: |-
193+
$patch: delete
194+
apiVersion: cert-manager.io/v1
195+
kind: Certificate
196+
metadata:
197+
name: "kubearchive-operator-certificate"
198+
namespace: kubearchive

‎components/policies/production/kflux-rhel-p01/kustomization.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
22
kind: Kustomization
33
resources:
44
- ../base
5+
- ../policies/kubearchive/

0 commit comments

Comments
 (0)