Skip to content

Commit 58d762f

Browse files
ivan-degtiarenkoivan-degtiarenko
authored
sync: stage to production (#1495)
2 parents 9234dcf + 3c181d5 commit 58d762f

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+354
-2907
lines changed

‎cmd/acsfleetctl/main.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77
"github.com/spf13/cobra"
88
"github.com/stackrox/acs-fleet-manager/internal/dinosaur/pkg/cmd/admin"
99
"github.com/stackrox/acs-fleet-manager/internal/dinosaur/pkg/cmd/centrals"
10+
gitopsCmd "github.com/stackrox/acs-fleet-manager/internal/dinosaur/pkg/gitops/cmd"
1011
)
1112

1213
func main() {
@@ -26,4 +27,5 @@ func main() {
2627
func setupSubCommands(rootCmd *cobra.Command) {
2728
rootCmd.AddCommand(centrals.NewCentralsCommand())
2829
rootCmd.AddCommand(admin.NewAdminCommand())
30+
rootCmd.AddCommand(gitopsCmd.NewGitOpsCommand())
2931
}

‎dp-terraform/helm/Dockerfile‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,32 @@
1+
FROM registry.access.redhat.com/ubi8/ubi-minimal:8.8 as build
2+
ENV HOME=/opt/helm
3+
COPY rhacs-terraform ${HOME}/rhacs-terraform
4+
WORKDIR ${HOME}
5+
6+
RUN curl -L --retry 10 --silent --show-error --fail -o /usr/local/bin/helm \
7+
"https://mirror.openshift.com/pub/openshift-v4/clients/helm/latest/helm-linux-amd64" && \
8+
chmod +x /usr/local/bin/helm && \
9+
helm version
10+
11+
RUN helm repo add external-secrets "https://charts.external-secrets.io/" && \
12+
helm dependencies build ${HOME}/rhacs-terraform
13+
14+
# Workaround for deleting securityContext.runAsUser from the dependent chart
15+
# see: https://github.com/operator-framework/operator-sdk/issues/6635
16+
RUN microdnf install gzip tar && \
17+
curl -L --retry 10 --silent --show-error --fail -o /tmp/yq_linux_amd64.tar.gz \
18+
"https://github.com/mikefarah/yq/releases/download/v4.35.2/yq_linux_amd64.tar.gz" && \
19+
tar -xzf /tmp/yq_linux_amd64.tar.gz ./yq_linux_amd64 && \
20+
mv yq_linux_amd64 /usr/local/bin/yq && \
21+
chmod +x /usr/local/bin/yq && \
22+
rm /tmp/yq_linux_amd64.tar.gz && \
23+
cd rhacs-terraform/charts && for filename in *.tgz; do tar -xf "$filename" && rm -f "$filename"; done && \
24+
yq -i 'del(.securityContext.runAsUser) | del(.webhook.securityContext.runAsUser) | del(.certController.securityContext.runAsUser)' external-secrets/values.yaml
25+
26+
127
FROM quay.io/operator-framework/helm-operator:v1.32.0
228

329
ENV HOME=/opt/helm
430
COPY watches.yaml ${HOME}/watches.yaml
5-
COPY rhacs-terraform ${HOME}/rhacs-terraform
31+
COPY --from=build ${HOME}/rhacs-terraform ${HOME}/rhacs-terraform
632
WORKDIR ${HOME}

‎dp-terraform/helm/rhacs-terraform/charts/cloudwatch/templates/01-operator-02-secret-dead-mans-switch.yaml‎

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,21 @@
1-
apiVersion: v1
2-
kind: Secret
1+
apiVersion: external-secrets.io/v1beta1
2+
kind: ExternalSecret
33
metadata:
44
name: rhacs-cloudwatch-exporter
55
namespace: {{ include "cloudwatch.namespace" . }}
6-
stringData:
7-
AWS_ACCESS_KEY_ID: {{ .Values.aws.accessKeyId | quote }}
8-
AWS_SECRET_ACCESS_KEY: {{ .Values.aws.secretAccessKey | quote }}
9-
type: Opaque
6+
spec:
7+
secretStoreRef:
8+
name: {{ .Values.global.secretStore.aws.secretsManagerSecretStoreName }}
9+
kind: ClusterSecretStore
10+
target:
11+
name: rhacs-cloudwatch-exporter
12+
creationPolicy: Owner
13+
data:
14+
- secretKey: AWS_ACCESS_KEY_ID # pragma: allowlist secret
15+
remoteRef:
16+
key: "cloudwatch-exporter"
17+
property: aws_access_key_id
18+
- secretKey: AWS_SECRET_ACCESS_KEY # pragma: allowlist secret
19+
remoteRef:
20+
key: "cloudwatch-exporter"
21+
property: "aws_secret_access_key"

‎dp-terraform/helm/rhacs-terraform/charts/cloudwatch/values.yaml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,3 @@
1-
# AWS credentials
2-
aws:
3-
accessKeyId: ""
4-
secretAccessKey: ""
5-
61
clusterName: ""
72
environment: ""
83
image: "ghcr.io/nerdswords/yet-another-cloudwatch-exporter:v0.55.0"

‎dp-terraform/helm/rhacs-terraform/charts/logging/templates/01-logging-02-secret-cloudwatch.yaml‎

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,21 @@
1-
apiVersion: v1
2-
kind: Secret
1+
apiVersion: external-secrets.io/v1beta1
2+
kind: ExternalSecret
33
metadata:
44
name: cloudwatch
55
namespace: openshift-logging
6-
data:
7-
aws_access_key_id: {{ .Values.aws.accessKeyId | b64enc | quote }}
8-
aws_secret_access_key: {{ .Values.aws.secretAccessKey | b64enc | quote }}
6+
spec:
7+
secretStoreRef:
8+
name: {{ .Values.global.secretStore.aws.secretsManagerSecretStoreName }}
9+
kind: ClusterSecretStore
10+
target:
11+
name: cloudwatch
12+
creationPolicy: Owner
13+
data:
14+
- secretKey: aws_access_key_id # pragma: allowlist secret
15+
remoteRef:
16+
key: "logging"
17+
property: "aws_access_key_id"
18+
- secretKey: aws_secret_access_key # pragma: allowlist secret
19+
remoteRef:
20+
key: "logging"
21+
property: "aws_secret_access_key"

‎dp-terraform/helm/rhacs-terraform/charts/logging/values.yaml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,6 @@
55
groupPrefix: ""
66
aws:
77
region: "us-east-1"
8-
accessKeyId: ""
9-
secretAccessKey: ""
108

119
nodeSelector: {}
1210

‎dp-terraform/helm/rhacs-terraform/charts/observability/templates/01-operator-03-secret-alertmanager.yaml‎

Lines changed: 71 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,52 +1,75 @@
1-
apiVersion: v1
2-
kind: Secret
1+
apiVersion: external-secrets.io/v1beta1
2+
kind: ExternalSecret
33
metadata:
44
name: rhacs-alertmanager-configuration
55
namespace: {{ include "observability.namespace" . }}
6-
stringData:
7-
alertmanager.yaml: |
8-
global:
9-
resolve_timeout: 5m
10-
route:
11-
receiver: managed-rhacs-pagerduty
12-
repeat_interval: 12h
13-
group_by:
14-
- cluster_id
15-
- severity
16-
routes:
17-
- receiver: managed-rhacs-deadmanssnitch
18-
repeat_interval: 5m
19-
continue: false
20-
match:
21-
alertname: DeadMansSwitch
22-
observability: managed-rhacs
23-
- receiver: managed-rhacs-pagerduty
24-
group_by:
25-
- namespace
26-
- severity
27-
matchers:
28-
- "namespace =~ \"rhacs-.*\""
29-
receivers:
30-
- name: managed-rhacs-pagerduty
31-
pagerduty_configs:
32-
- routing_key: {{ .Values.pagerduty.key | quote }}
33-
{{- /*
34-
We want the severity to be based on the severity label coming from the
35-
alert itself. If there is no severity label common to the group of
36-
alerts, then default to info. That looks like:
37-
`or .GroupLabels.severity "info"`
38-
in Go templating. To properly escape for Helm templating, the Helm
39-
templating engine needs to output the literal string `{{`, since
40-
Alertmanager templating syntax is the same as Helm. To do that,
41-
the expression `{{` is used inside the double bracket syntax for
42-
evaluating Go template expressions. Thus: `{{ "{{" }}`.
6+
spec:
7+
secretStoreRef:
8+
name: {{ .Values.global.secretStore.aws.secretsManagerSecretStoreName }}
9+
kind: ClusterSecretStore
10+
target:
11+
name: rhacs-alertmanager-configuration
12+
creationPolicy: Owner
13+
template:
14+
type: Opaque
15+
engineVersion: v2
16+
data:
17+
alertmanager.yaml: |
18+
global:
19+
resolve_timeout: 5m
20+
route:
21+
receiver: managed-rhacs-pagerduty
22+
repeat_interval: 12h
23+
group_by:
24+
- cluster_id
25+
- severity
26+
routes:
27+
- receiver: managed-rhacs-deadmanssnitch
28+
repeat_interval: 5m
29+
continue: false
30+
match:
31+
alertname: DeadMansSwitch
32+
observability: managed-rhacs
33+
- receiver: managed-rhacs-pagerduty
34+
group_by:
35+
- namespace
36+
- severity
37+
matchers:
38+
- "namespace =~ \"rhacs-.*\""
39+
receivers:
40+
- name: managed-rhacs-pagerduty
41+
pagerduty_configs:
42+
- routing_key: {{ printf "{{ .pagerduty_key }}" | quote }}
43+
{{- /*
44+
We want the severity to be based on the severity label coming from the
45+
alert itself. If there is no severity label common to the group of
46+
alerts, then default to info. That looks like:
47+
`or .GroupLabels.severity "info"`
48+
in Go templating.
4349
44-
The inner double quotes work because Helm evaluates the expression
45-
that includes the inner double quotes before the document is parsed
46-
as yaml.
47-
*/}}
48-
severity: "{{ "{{" }} or .GroupLabels.severity \"info\" }}"
49-
- name: managed-rhacs-deadmanssnitch
50-
webhook_configs:
51-
- url: {{ .Values.deadMansSwitch.url | quote }}
52-
type: Opaque
50+
To properly escape for External Secrets Operator (ESO) templating,
51+
the ESO templating engine needs to output the literal string "{{", since
52+
Alertmanager templating syntax is the same as ESO. To do that,
53+
the expression "{{" is used inside the double bracket syntax for
54+
evaluating Go template expressions. Thus: `{{ "{{" }}`.
55+
56+
The inner double quotes work because ESO evaluates the expression
57+
that includes the inner double quotes before the document is parsed
58+
as yaml.
59+
60+
`printf` is used to escape curly braces when rendering the Helm template and leave them for ESO template.
61+
*/}}
62+
severity: "{{ printf `{{ "{{" }} or .GroupLabels.severity \"info\" }}` }}"
63+
- name: managed-rhacs-deadmanssnitch
64+
webhook_configs:
65+
- url: {{ printf "{{ .dead_mans_switch_url }}" | quote }}
66+
data:
67+
- secretKey: dead_mans_switch_url # pragma: allowlist secret
68+
remoteRef:
69+
key: "observability"
70+
property: "dead_mans_switch_url"
71+
# PagerDuty's integration key, which is generated within a Ruleset.
72+
- secretKey: pagerduty_key # pragma: allowlist secret
73+
remoteRef:
74+
key: "observability"
75+
property: "pagerduty_routing_key"

‎dp-terraform/helm/rhacs-terraform/charts/observability/templates/01-operator-03-secret-github.yaml‎

Lines changed: 25 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,28 @@
1-
apiVersion: v1
2-
kind: Secret
1+
apiVersion: external-secrets.io/v1beta1
2+
kind: ExternalSecret
33
metadata:
44
name: rhacs-observability-configuration
55
namespace: {{ include "observability.namespace" . }}
6-
labels:
7-
configures: observability-operator
8-
stringData:
9-
access_token: {{ .Values.github.accessToken | quote }}
10-
repository: {{ .Values.github.repository | quote }}
11-
tag: {{ .Values.github.tag | quote }}
12-
channel: 'resources'
13-
type: Opaque
6+
spec:
7+
secretStoreRef:
8+
name: {{ .Values.global.secretStore.aws.secretsManagerSecretStoreName }}
9+
kind: ClusterSecretStore
10+
target:
11+
name: rhacs-observability-configuration
12+
creationPolicy: Owner
13+
template:
14+
type: Opaque
15+
engineVersion: v2
16+
metadata:
17+
labels:
18+
configures: observability-operator
19+
data:
20+
access_token: {{ printf "'{{ .access_token }}'" }}
21+
repository: {{ .Values.github.repository | quote }}
22+
tag: {{ .Values.github.tag | quote }}
23+
channel: 'resources'
24+
data:
25+
- secretKey: access_token # pragma: allowlist secret
26+
remoteRef:
27+
key: "observability"
28+
property: "github_access_token"

‎dp-terraform/helm/rhacs-terraform/charts/observability/templates/01-operator-03-secret-observatorium.yaml‎

Lines changed: 29 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,32 @@
1-
kind: Secret
2-
apiVersion: v1
1+
apiVersion: external-secrets.io/v1beta1
2+
kind: ExternalSecret
33
metadata:
44
name: rhacs-observatorium
55
namespace: {{ include "observability.namespace" . }}
6-
stringData:
7-
tenant: {{ .Values.observatorium.tenant | quote }}
8-
authType: {{ .Values.observatorium.authType | quote }}
9-
redHatSsoAuthServerUrl: {{ .Values.observatorium.redHatSsoAuthServerUrl | quote }}
10-
redHatSsoRealm: {{ .Values.observatorium.redHatSsoRealm | quote }}
11-
gateway: {{ .Values.observatorium.gateway | quote }}
12-
metricsClientId: {{ .Values.observatorium.metricsClientId | quote }}
13-
metricsSecret: {{ .Values.observatorium.metricsSecret | quote }}
14-
type: Opaque
6+
spec:
7+
secretStoreRef:
8+
name: {{ .Values.global.secretStore.aws.secretsManagerSecretStoreName }}
9+
kind: ClusterSecretStore
10+
target:
11+
name: rhacs-observatorium
12+
creationPolicy: Owner
13+
template:
14+
type: Opaque
15+
engineVersion: v2
16+
data:
17+
tenant: {{ .Values.observatorium.tenant | quote }}
18+
authType: {{ .Values.observatorium.authType | quote }}
19+
redHatSsoAuthServerUrl: {{ .Values.observatorium.redHatSsoAuthServerUrl | quote }}
20+
redHatSsoRealm: {{ .Values.observatorium.redHatSsoRealm | quote }}
21+
gateway: {{ .Values.observatorium.gateway | quote }}
22+
metricsClientId: {{ printf "'{{ .metrics_client_id }}'" }}
23+
metricsSecret: {{ printf "'{{ .metrics_secret }}'" }}
24+
data:
25+
- secretKey: metrics_client_id # pragma: allowlist secret
26+
remoteRef:
27+
key: "observability"
28+
property: "observatorium_metrics_client_id"
29+
- secretKey: metrics_secret # pragma: allowlist secret
30+
remoteRef:
31+
key: "observability"
32+
property: "observatorium_metrics_secret"

‎dp-terraform/helm/rhacs-terraform/charts/observability/values.yaml‎

Lines changed: 1 addition & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,7 @@
77
observabilityOperatorVersion: "v4.2.1"
88

99
github:
10-
# You can generate a new one at https://github.com/settings/tokens/new, for a user
11-
# with access to the repository specified at `github.repository`, and with "repo" scope.
12-
# Be mindful of the token expiration.
13-
accessToken: ""
14-
repository: ""
10+
repository: "https://api.github.com/repos/stackrox/rhacs-observability-resources/contents"
1511
tag: "master"
1612

1713
clusterName: ""
@@ -25,12 +21,6 @@ observatorium:
2521
redHatSsoAuthServerUrl: "https://sso.redhat.com/auth/"
2622
redHatSsoRealm: "redhat-external"
2723
gateway: ""
28-
metricsClientId: ""
29-
metricsSecret: ""
30-
31-
pagerduty:
32-
# PagerDuty integration key, which is generated within a Ruleset.
33-
key: ""
3424

3525
deadMansSwitch:
3626
# Webhook URL of the dead man's switch provider.

0 commit comments

Comments
 (0)