NG: app-of-apps CORE

k8s-ng/argocd/app.yaml

@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: argocd
-  namespace: argocd
-spec:
-  project: core
-  destination:
-    namespace: argocd
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: https://gt.hexor.cy/ab/homelab.git
-    targetRevision: main
-    path: k8s-ng/argocd
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

k8s-ng/bootstrap/bootstrap.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Brings the whole core state up on an empty cluster:
+#   k8s-ng/bootstrap/bootstrap.sh <kube-context>
+# Installs Argo CD (the only thing that cannot install itself) and applies the
+# root application; Argo CD then pulls every core application in wave order.
+set -euo pipefail
+
+ctx=${1:?usage: bootstrap.sh <kube-context>}
+here=$(cd "$(dirname "$0")" && pwd)
+k="kubectl --context $ctx"
+
+# Render in a scratch copy so kustomize does not leave downloaded charts in the repo.
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+cp -r "$here/../core/argocd" "$tmp/argocd"
+kubectl kustomize --enable-helm "$tmp/argocd" > "$tmp/argocd.yaml"
+
+$k create namespace argocd --dry-run=client -o yaml | $k apply -f -
+# CRDs must exist before the Argo CD objects that use them: apply twice.
+$k apply --server-side --force-conflicts -f "$tmp/argocd.yaml" >/dev/null 2>&1 || true
+sleep 8
+$k apply --server-side --force-conflicts -f "$tmp/argocd.yaml"
+$k -n argocd rollout status deploy --timeout=300s
+$k -n argocd rollout status statefulset --timeout=300s
+
+$k apply --server-side --force-conflicts -f "$here/root.yaml"
+echo "Core state requested. Watch it with: $k -n argocd get app"

k8s-ng/bootstrap/root.yaml

@@ -0,0 +1,29 @@
+# Root of the core state. Applying this one object makes Argo CD pull every core
+# application in wave order (see k8s-ng/core-state/values.yaml).
+# Note: there are deliberately no finalizers; deleting this Application keeps all
+# deployed services and data.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: core-state
+  namespace: argocd
+spec:
+  project: core
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  source:
+    repoURL: https://gt.hexor.cy/ab/homelab.git
+    targetRevision: main
+    path: k8s-ng/core-state
+    helm:
+      # Per-cluster overrides of core-state/values.yaml, for example:
+      # valuesObject:
+      #   targetRevision: some-branch
+      valuesObject: {}
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - ServerSideApply=true

k8s-ng/cnpg/app.yaml

@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: cnpg
-  namespace: argocd
-spec:
-  project: core
-  destination:
-    namespace: cnpg-system
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: https://gt.hexor.cy/ab/homelab.git
-    targetRevision: main
-    path: k8s-ng/cnpg
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

k8s-ng/core-state/Chart.yaml

@@ -0,0 +1,4 @@
+apiVersion: v2
+name: core-state
+description: App of apps for the core services of the cluster
+version: 0.1.0

k8s-ng/core-state/templates/applications.yaml

@@ -0,0 +1,29 @@
+{{- range .Values.apps }}
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: {{ .name }}
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: {{ .wave | quote }}
+spec:
+  project: {{ .project | default $.Values.project }}
+  destination:
+    server: {{ $.Values.destinationServer }}
+    namespace: {{ .namespace }}
+  source:
+    repoURL: {{ $.Values.repoURL }}
+    targetRevision: {{ $.Values.targetRevision }}
+    path: {{ .path }}
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: {{ if hasKey . "prune" }}{{ .prune }}{{ else }}true{{ end }}
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+      {{- if .skipDryRunOnMissingResource }}
+      - SkipDryRunOnMissingResource=true
+      {{- end }}
+{{- end }}

k8s-ng/core-state/values.yaml

@@ -0,0 +1,42 @@
+# Per-cluster variables. Override them in k8s-ng/bootstrap/root.yaml
+# (spec.source.helm.valuesObject) when the state is deployed to another cluster.
+repoURL: https://gt.hexor.cy/ab/homelab.git
+targetRevision: main
+destinationServer: https://kubernetes.default.svc
+project: core
+
+# Core applications. Lower waves are synced first and must be Healthy before the
+# next wave starts. Every path is a kustomize (or plain manifest) directory.
+#   wave 0: Argo CD itself and its projects
+#   wave 1: operators (their CRDs are used by the later waves)
+#   wave 2: the database cluster and its databases/users
+#   wave 3: services that need the database and secrets
+apps:
+  - name: argocd
+    path: k8s-ng/core/argocd
+    namespace: argocd
+    wave: 0
+  - name: cnpg
+    path: k8s-ng/core/cnpg
+    namespace: cnpg-system
+    wave: 1
+  - name: cert-manager
+    path: k8s-ng/core/cert-manager
+    namespace: cert-manager
+    wave: 1
+    skipDryRunOnMissingResource: true # ClusterIssuers need the cert-manager CRDs
+  - name: external-secrets
+    path: k8s-ng/core/external-secrets
+    namespace: external-secrets
+    wave: 1
+  - name: postgresql
+    path: k8s-ng/core/postgresql
+    namespace: psql
+    wave: 2
+    prune: false # never delete databases because of a manifest change
+    skipDryRunOnMissingResource: true # CRDs come from the cnpg and external-secrets apps
+  - name: vaultwarden
+    path: k8s-ng/core/vaultwarden
+    namespace: vaultwarden
+    wave: 3
+    skipDryRunOnMissingResource: true

k8s-ng/core/argocd/ingress.yaml

@@ -9,10 +9,10 @@ metadata:
 spec:
   tls:
     - hosts:
-        - ag.hexor.cy
+        - ag.btwiusearch.net
       secretName: argocd-server-tls
   rules:
-    - host: ag.hexor.cy
+    - host: ag.btwiusearch.net
       http:
         paths:
           - path: /

k8s-ng/core/argocd/kustomization.yaml

@@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - app.yaml
   - ingress.yaml
   - appprojects.yaml
 

k8s-ng/core/argocd/values.yaml

@@ -1,7 +1,7 @@
 # Argo CD Helm Chart Values (k8s-ng cluster)
 
 global:
-  domain: ag.hexor.cy
+  domain: ag.btwiusearch.net
   logging:
     format: text
     level: info
@@ -23,6 +23,20 @@ configs:
     admin.enabled: true
     statusbadge.enabled: true
     timeout.reconciliation: 60s
+    # Lets sync waves in an app of apps wait for child Applications to be Healthy.
+    resource.customizations.health.argoproj.io_Application: |
+      hs = {}
+      hs.status = "Progressing"
+      hs.message = ""
+      if obj.status ~= nil then
+        if obj.status.health ~= nil then
+          hs.status = obj.status.health.status
+          if obj.status.health.message ~= nil then
+            hs.message = obj.status.health.message
+          end
+        end
+      end
+      return hs
   rbac:
     create: true
     policy.default: ""

k8s-ng/core/cert-manager/issuer.yaml

@@ -0,0 +1,23 @@
+# Public certificates through DNS-01. The Cloudflare token Secret is created by hand
+# (it will move to Vaultwarden + External Secrets):
+#   kubectl -n cert-manager create secret generic cloudflare-api-token --from-literal=apiToken=<token>
+# The token needs Zone:DNS:Edit on the btwiusearch.net zone.
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: k8s-master@hexor.cy
+    privateKeySecretRef:
+      name: letsencrypt-account-key
+    solvers:
+      - selector:
+          dnsZones:
+            - btwiusearch.net
+        dns01:
+          cloudflare:
+            apiTokenSecretRef:
+              name: cloudflare-api-token
+              key: apiToken

k8s-ng/core/cert-manager/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - issuer.yaml
+  - self-signed.yaml
+
+helmCharts:
+  - name: cert-manager
+    repo: https://charts.jetstack.io
+    version: 1.21.1
+    releaseName: cert-manager
+    namespace: cert-manager
+    valuesFile: values.yaml
+    includeCRDs: true

k8s-ng/core/cert-manager/self-signed.yaml

@@ -0,0 +1,29 @@
+# Private CA for internal services: issuer "hexor-lab".
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: selfsigned
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: hexor-ca-root
+  namespace: cert-manager
+spec:
+  isCA: true
+  duration: 87600h # 10y
+  commonName: hexor-ca
+  secretName: hexor-ca-root-secret
+  issuerRef:
+    name: selfsigned
+    kind: ClusterIssuer
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: hexor-lab
+spec:
+  ca:
+    secretName: hexor-ca-root-secret

k8s-ng/core/cert-manager/values.yaml

@@ -0,0 +1,2 @@
+crds:
+  enabled: true

k8s-ng/core/cnpg/kustomization.yaml

@@ -1,9 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
-resources:
-  - app.yaml
-
 helmCharts:
   - name: cloudnative-pg
     repo: https://cloudnative-pg.github.io/charts

k8s-ng/core/external-secrets/kustomization.yaml

@@ -1,11 +1,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
-resources:
-  - app.yaml
-  # Enable after the Vaultwarden bot account exists and the bitwarden-cli
-  # secret is created (see the header of bitwarden-store.yaml):
-  # - bitwarden-store.yaml
+# Enable after the Vaultwarden bot account exists and the bitwarden-cli
+# secret is created (see the header of bitwarden-store.yaml):
+# resources:
+#   - bitwarden-store.yaml
 
 helmCharts:
   - name: external-secrets

k8s-ng/core/postgresql/kustomization.yaml

@@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - app.yaml
   - cluster.yaml
   - password-generator.yaml
   - databases/vaultwarden.yaml

k8s-ng/core/vaultwarden/deployment.yaml

@@ -27,7 +27,7 @@ spec:
               memory: 512Mi
           env:
             - name: DOMAIN
-              value: https://vw.hexor.cy
+              value: https://vw.btwiusearch.net
             - name: ORG_GROUPS_ENABLED
               value: "true"
             - name: DATABASE_URL

k8s-ng/core/vaultwarden/ingress.yaml

@@ -7,7 +7,7 @@ metadata:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
 spec:
   rules:
-    - host: vw.hexor.cy
+    - host: vw.btwiusearch.net
       http:
         paths:
           - path: /
@@ -20,4 +20,4 @@ spec:
   tls:
     - secretName: vaultwarden-tls
       hosts:
-        - vw.hexor.cy
+        - vw.btwiusearch.net

k8s-ng/core/vaultwarden/kustomization.yaml

@@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - app.yaml
   - secrets.yaml
   - pvc.yaml
   - deployment.yaml

k8s-ng/external-secrets/app.yaml

@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: external-secrets
-  namespace: argocd
-spec:
-  project: core
-  destination:
-    namespace: external-secrets
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: https://gt.hexor.cy/ab/homelab.git
-    targetRevision: main
-    path: k8s-ng/external-secrets
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

k8s-ng/postgresql/app.yaml

@@ -1,22 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: postgresql
-  namespace: argocd
-spec:
-  project: core
-  destination:
-    namespace: psql
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: https://gt.hexor.cy/ab/homelab.git
-    targetRevision: main
-    path: k8s-ng/postgresql
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: false # never delete databases because of a manifest change
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true
-      - SkipDryRunOnMissingResource=true # the cnpg Application installs the CRDs

k8s-ng/vaultwarden/app.yaml

@@ -1,22 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: vaultwarden
-  namespace: argocd
-spec:
-  project: apps
-  destination:
-    namespace: vaultwarden
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: https://gt.hexor.cy/ab/homelab.git
-    targetRevision: main
-    path: k8s-ng/vaultwarden
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true
-      - SkipDryRunOnMissingResource=true # the external-secrets Application installs the CRDs