Aleksandr Bogomiakov
0348329829
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 15s
116 lines
3.1 KiB
YAML
116 lines
3.1 KiB
YAML
# Argo CD Helm Chart Values (k8s-ng cluster)
|
|
|
|
global:
|
|
domain: ag.btwiusearch.net
|
|
logging:
|
|
format: text
|
|
level: info
|
|
|
|
crds:
|
|
install: true
|
|
keep: true # Recommended to keep true so CRDs are not deleted on uninstall
|
|
|
|
configs:
|
|
params:
|
|
server.insecure: "true" # TLS is terminated by the ingress
|
|
cm:
|
|
create: true
|
|
exec.enabled: true
|
|
kustomize.buildOptions: --enable-helm
|
|
application.instanceLabelKey: argocd.argoproj.io/instance
|
|
# Local admin account, kept as a break-glass login next to SSO; the initial
|
|
# password is generated by Argo CD into the argocd-initial-admin-secret secret.
|
|
# Set to false once SSO is trusted.
|
|
admin.enabled: true
|
|
statusbadge.enabled: true
|
|
timeout.reconciliation: 60s
|
|
# Lets sync waves in an app of apps wait for child Applications to be Healthy.
|
|
resource.customizations.health.argoproj.io_Application: |
|
|
hs = {}
|
|
hs.status = "Progressing"
|
|
hs.message = ""
|
|
if obj.status ~= nil then
|
|
if obj.status.health ~= nil then
|
|
hs.status = obj.status.health.status
|
|
if obj.status.health.message ~= nil then
|
|
hs.message = obj.status.health.message
|
|
end
|
|
end
|
|
end
|
|
return hs
|
|
# SSO through Dex -> Keycloak. The client id/secret come from the oidc-creds
|
|
# Secret (labelled app.kubernetes.io/part-of=argocd), created by hand until
|
|
# Vaultwarden + External Secrets are the source.
|
|
dex.config: |
|
|
connectors:
|
|
- type: oidc
|
|
id: keycloak
|
|
name: Keycloak
|
|
config:
|
|
issuer: https://auth.hexor.cy/auth/realms/hexor
|
|
clientID: $oidc-creds:id
|
|
clientSecret: $oidc-creds:secret
|
|
insecureEnableGroups: true
|
|
scopes:
|
|
- openid
|
|
- profile
|
|
- email
|
|
- offline_access
|
|
getUserInfo: true
|
|
rbac:
|
|
create: true
|
|
policy.default: ""
|
|
policy.csv: |
|
|
g, game-servers-managers, GameServersManagersRole
|
|
# Role permissions
|
|
p, GameServersManagersRole, applications, get, games/*, allow
|
|
p, GameServersManagersRole, applications, update, games/*, allow
|
|
p, GameServersManagersRole, applications, sync, games/*, allow
|
|
p, GameServersManagersRole, applications, override, games/*, allow
|
|
p, GameServersManagersRole, applications, action/*, games/*, allow
|
|
p, GameServersManagersRole, exec, create, games/*, allow
|
|
p, GameServersManagersRole, logs, get, games/*, allow
|
|
p, GameServersManagersRole, applications, delete, games/*, deny
|
|
|
|
# Admin policy
|
|
g, argocd-admins, role:admin
|
|
secret:
|
|
createSecret: true
|
|
|
|
controller:
|
|
replicas: 1
|
|
|
|
# Dex OIDC provider (Keycloak connector configured in configs.cm.dex.config)
|
|
dex:
|
|
replicas: 1
|
|
enabled: true
|
|
|
|
redis:
|
|
enabled: true
|
|
|
|
redis-ha:
|
|
enabled: false
|
|
|
|
server:
|
|
replicas: 1
|
|
ingress:
|
|
enabled: false
|
|
certificate:
|
|
enabled: false
|
|
certificateSecret:
|
|
enabled: false
|
|
|
|
repoServer:
|
|
replicas: 1
|
|
livenessProbe:
|
|
timeoutSeconds: 10
|
|
periodSeconds: 60
|
|
|
|
applicationSet:
|
|
enabled: true
|
|
replicas: 1
|
|
|
|
notifications:
|
|
enabled: true
|
|
replicas: 1
|