promote(infra/prod): freight 5156c91d9d5d70decc8f78ca021bb04178f65daf
This commit is contained in:
Kargo
29
.sops.yaml
29
.sops.yaml
@@ -1,29 +0,0 @@
|
|||||||
# SOPS configuration for deploy-app-kargo-private
|
|
||||||
# Three age keys: admin (all access), dev (dev/test cluster), prod (prod cluster)
|
|
||||||
#
|
|
||||||
# admin: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7
|
|
||||||
# dev: age1ame2tp44sq9rmkqzqvxy77eu7qd2035kmlgcsfjfxj2jughv3clqlku03g
|
|
||||||
# prod: age16p0gwk8vt90vy2gm8jjca8rcyd2drv5526e997ukdelnv5ek8unqm0smuk
|
|
||||||
|
|
||||||
creation_rules:
|
|
||||||
# Prod-specific secrets — admin + prod only
|
|
||||||
- path_regex: \.prod\.enc\.yaml$
|
|
||||||
encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$
|
|
||||||
age: >-
|
|
||||||
age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7,
|
|
||||||
age16p0gwk8vt90vy2gm8jjca8rcyd2drv5526e997ukdelnv5ek8unqm0smuk
|
|
||||||
|
|
||||||
# Dev-specific secrets — admin + dev only
|
|
||||||
- path_regex: \.dev\.enc\.yaml$
|
|
||||||
encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$
|
|
||||||
age: >-
|
|
||||||
age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7,
|
|
||||||
age1ame2tp44sq9rmkqzqvxy77eu7qd2035kmlgcsfjfxj2jughv3clqlku03g
|
|
||||||
|
|
||||||
# Shared secrets (e.g. kargo credentials) — all three keys
|
|
||||||
- path_regex: \.shared\.enc\.yaml$
|
|
||||||
encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|repoURL|username)$
|
|
||||||
age: >-
|
|
||||||
age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7,
|
|
||||||
age1ame2tp44sq9rmkqzqvxy77eu7qd2035kmlgcsfjfxj2jughv3clqlku03g,
|
|
||||||
age16p0gwk8vt90vy2gm8jjca8rcyd2drv5526e997ukdelnv5ek8unqm0smuk
|
|
||||||
24
README.md
24
README.md
@@ -1,24 +0,0 @@
|
|||||||
# deploy-app-kargo-private
|
|
||||||
|
|
||||||
Private ArgoCD ApplicationSet repository with SOPS-encrypted secrets.
|
|
||||||
|
|
||||||
## Structure
|
|
||||||
|
|
||||||
- `infra/` — Infrastructure apps (cert-manager, gitea, kargo, etc.)
|
|
||||||
- `ci/` — CI apps (gitea-runner, etc.)
|
|
||||||
- `kargo/` — Kargo pipeline definitions + encrypted credentials
|
|
||||||
- `.sops.yaml` — SOPS encryption rules (3 age keys: admin, dev, prod)
|
|
||||||
|
|
||||||
## Encryption
|
|
||||||
|
|
||||||
Secrets in `*.enc.yaml` files are encrypted with SOPS + age:
|
|
||||||
- `*.dev.enc.yaml` — decryptable by admin + dev keys
|
|
||||||
- `*.prod.enc.yaml` — decryptable by admin + prod keys
|
|
||||||
- `*.shared.enc.yaml` — decryptable by all three keys
|
|
||||||
|
|
||||||
## Branches
|
|
||||||
|
|
||||||
- `main` — source of truth
|
|
||||||
- `infra/stage/dev` — dev cluster (Kargo promotion)
|
|
||||||
- `infra/stage/test` — test stage (Kargo verification)
|
|
||||||
- `infra/stage/prod` — prod cluster (Kargo promotion via PR)
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: gitea-runner
|
|
||||||
labels:
|
|
||||||
name: gitea-runner
|
|
||||||
@@ -1,79 +0,0 @@
|
|||||||
# Gitea Actions runner (act_runner)
|
|
||||||
# Requires registration token in gitea-runner-token secret
|
|
||||||
# Token is generated in Gitea admin → Actions → Runners → Create new runner
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: gitea-runner-config
|
|
||||||
namespace: gitea-runner
|
|
||||||
data:
|
|
||||||
config.yaml: |
|
|
||||||
log:
|
|
||||||
level: info
|
|
||||||
runner:
|
|
||||||
file: .runner
|
|
||||||
capacity: 1
|
|
||||||
timeout: 3h
|
|
||||||
labels:
|
|
||||||
- "ubuntu-latest:docker://node:20-bullseye"
|
|
||||||
- "ubuntu-22.04:docker://node:20-bullseye"
|
|
||||||
cache:
|
|
||||||
enabled: true
|
|
||||||
dir: ""
|
|
||||||
container:
|
|
||||||
network: ""
|
|
||||||
privileged: false
|
|
||||||
options:
|
|
||||||
workdir_parent:
|
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: gitea-runner
|
|
||||||
namespace: gitea-runner
|
|
||||||
labels:
|
|
||||||
app: gitea-runner
|
|
||||||
spec:
|
|
||||||
replicas: 0 # Set to 1 after creating registration token
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: gitea-runner
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: gitea-runner
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- name: runner
|
|
||||||
image: gitea/act_runner:0.2.11
|
|
||||||
env:
|
|
||||||
- name: GITEA_INSTANCE_URL
|
|
||||||
value: "http://gitea-http.gitea.svc.cluster.local:3000"
|
|
||||||
- name: GITEA_RUNNER_REGISTRATION_TOKEN
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: gitea-runner-token
|
|
||||||
key: token
|
|
||||||
optional: true
|
|
||||||
volumeMounts:
|
|
||||||
- name: config
|
|
||||||
mountPath: /config
|
|
||||||
readOnly: true
|
|
||||||
- name: data
|
|
||||||
mountPath: /data
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
cpu: 100m
|
|
||||||
memory: 128Mi
|
|
||||||
limits:
|
|
||||||
cpu: "2"
|
|
||||||
memory: 2Gi
|
|
||||||
volumes:
|
|
||||||
- name: config
|
|
||||||
configMap:
|
|
||||||
name: gitea-runner-config
|
|
||||||
- name: data
|
|
||||||
emptyDir: {}
|
|
||||||
nodeSelector:
|
|
||||||
node-role.kubernetes.io/worker: ""
|
|
||||||
13
infra/argo-rollouts/config.yaml
Normal file
13
infra/argo-rollouts/config.yaml
Normal file
@@ -0,0 +1,13 @@
|
|||||||
|
{
|
||||||
|
"name": "argo-rollouts",
|
||||||
|
"namespace": "argo-rollouts",
|
||||||
|
"step": "2",
|
||||||
|
"source": {
|
||||||
|
"repoURL": "https://argoproj.github.io/argo-helm",
|
||||||
|
"chart": "argo-rollouts",
|
||||||
|
"targetRevision": 2.40.6
|
||||||
|
},
|
||||||
|
"helm": {
|
||||||
|
"values": "dashboard:\n enabled: true\n"
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -5,7 +5,7 @@
|
|||||||
"source": {
|
"source": {
|
||||||
"repoURL": "https://charts.jetstack.io",
|
"repoURL": "https://charts.jetstack.io",
|
||||||
"chart": "cert-manager",
|
"chart": "cert-manager",
|
||||||
"targetRevision": v1.19.4
|
"targetRevision": v1.20.0
|
||||||
},
|
},
|
||||||
"helm": {
|
"helm": {
|
||||||
"values": "crds:\n enabled: true\n"
|
"values": "crds:\n enabled: true\n"
|
||||||
|
|||||||
@@ -1,10 +1,10 @@
|
|||||||
{
|
{
|
||||||
"name": "gitea-runner",
|
"name": "gitea-custom",
|
||||||
"namespace": "gitea-runner",
|
"namespace": "gitea",
|
||||||
"step": "5",
|
"step": "6",
|
||||||
"source": {
|
"source": {
|
||||||
"repoURL": "https://github.com/Kargones/deploy-app-kargo-private.git",
|
"repoURL": "https://github.com/Kargones/deploy-app-kargo-private.git",
|
||||||
"path": "ci/gitea-runner/manifests",
|
"path": "infra/gitea-custom/manifests",
|
||||||
"targetRevision": "main"
|
"targetRevision": "main"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
16
infra/gitea-custom/manifests/disable-cache.yaml
Normal file
16
infra/gitea-custom/manifests/disable-cache.yaml
Normal file
@@ -0,0 +1,16 @@
|
|||||||
|
# Override Gitea cache/session to use memory (no redis/valkey)
|
||||||
|
# Mount this ConfigMap as /data/gitea/conf/app.ini override
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: gitea-disable-cache
|
||||||
|
namespace: gitea
|
||||||
|
data:
|
||||||
|
_10-cache.ini: |
|
||||||
|
[cache]
|
||||||
|
ENABLED = false
|
||||||
|
ADAPTER = memory
|
||||||
|
INTERVAL = 0
|
||||||
|
|
||||||
|
[session]
|
||||||
|
PROVIDER = memory
|
||||||
13
infra/gitea/config.yaml
Normal file
13
infra/gitea/config.yaml
Normal file
@@ -0,0 +1,13 @@
|
|||||||
|
{
|
||||||
|
"name": "gitea",
|
||||||
|
"namespace": "gitea",
|
||||||
|
"step": "4",
|
||||||
|
"source": {
|
||||||
|
"repoURL": "https://dl.gitea.com/charts",
|
||||||
|
"chart": "gitea",
|
||||||
|
"targetRevision": 12.5.0
|
||||||
|
},
|
||||||
|
"helm": {
|
||||||
|
"values": "gitea:\n admin:\n existingSecret: gitea-admin\n config:\n server:\n ROOT_URL: \"https://gitea.k3s.e2e.local\"\n DOMAIN: \"k3s.e2e.local\"\n SSH_DOMAIN: \"gitea.k3s.e2e.local\"\n SSH_PORT: 2222\n service:\n DISABLE_REGISTRATION: false\n actions:\n ENABLED: \"true\"\n cache:\n ENABLED: false\n ADAPTER: memory\n session:\n PROVIDER: memory\n\ningress:\n enabled: false\n\npostgresql:\n enabled: true\n image:\n repository: bitnamilegacy/postgresql\n tag: \"17\"\n\npostgresql-ha:\n enabled: false\n\nmemcached:\n enabled: false\n\nredis-cluster:\n enabled: false\n\nredis:\n enabled: false\n\nvalkey-cluster:\n enabled: false\n\nimage:\n rootless: false\n"
|
||||||
|
}
|
||||||
|
}
|
||||||
27
infra/gitea/values/secret-values.dev.enc.yaml
Normal file
27
infra/gitea/values/secret-values.dev.enc.yaml
Normal file
@@ -0,0 +1,27 @@
|
|||||||
|
# Gitea secrets for dev/test cluster
|
||||||
|
admin-password: ENC[AES256_GCM,data:Nh7IDhZbJxOYjat8JhRoWtQ=,iv:mDtUOdjiKxvTTKaWNQ6bUQ2rCbV9Ule25IN5AVBTrp0=,tag:FxMWUvu82HusjtPBmEtwcA==,type:str]
|
||||||
|
db-password: ENC[AES256_GCM,data:qRZjNRGr/oJVzYTz6Kv0sZ7Sbns=,iv:V03c8IrsLZzJck5ZqrXS46LydbGPtLBwkjjGQI0zkv4=,tag:pxDpAbekwwOw9yiqMwl2QA==,type:str]
|
||||||
|
sops:
|
||||||
|
age:
|
||||||
|
- recipient: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7
|
||||||
|
enc: |
|
||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqdWFvNXF3QXpnbjFsbHhn
|
||||||
|
dmdnRmRwWnpkUVlRSHlEZXdXT2FoeVVVejFNCkZ0UGp5YWZ2TThEUnZPOVNqVjJR
|
||||||
|
S0lXSGxSSFF3ZWhUM2NMWW9MZUszZnMKLS0tIEowWHo5SUFMMDFNY1lWY3NuNnJN
|
||||||
|
OERJZklLT1RnSDc4VjdaQ0F3cVRTaGsKYIfYSv4In5YiGs2/KWX1oPqOoiUxwVUl
|
||||||
|
jROG2UecsSjhKq6XdX+KVYmcSKhy1ljPjHaL+t3MmSNE6+jJpMpDvQ==
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
|
- recipient: age1ame2tp44sq9rmkqzqvxy77eu7qd2035kmlgcsfjfxj2jughv3clqlku03g
|
||||||
|
enc: |
|
||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUNzZSWE1NcTR1blQ5TWxH
|
||||||
|
N0k2YWNOdTA4WHZXQ3VlTHpWNVNuRm53S3dzCnZOR0gyWTVzams4SjdCZVpSMjdL
|
||||||
|
S2dqZTcvb3VtVE9JUWVlVU1QL1NaZ3MKLS0tIHdUZldWZWdIZ01VUWxLeEJDNmY0
|
||||||
|
aEV2U1JMaTFYRldjc1kwNHczd3gvM1kKEytPjCdNTG+8SFnQxh50XKfjAxa1xn0t
|
||||||
|
D3dj6yMfIfkgnp84pI9PY5hBweHrEcdeUwhPrkNY8dRuiShv4o4xTQ==
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
|
lastmodified: "2026-03-11T06:57:04Z"
|
||||||
|
mac: ENC[AES256_GCM,data:LKIihGyIcUImsmRWgPhWQRBeaFiXdWgaMwlif+FPNdmy/LSRlwIqIN8KzwuMu1zAlNvl1SVOVZL7SgRe9rZHax5pIn+Qrb5B+cuFPZTyvl24VBlJ+l29x182CKhRnT1RDDA9D7do+y8bG+rjyJ6u5d/yYcMAYIH9+I4fS4uERQw=,iv:23M4i1uCpQzfWZIp2c4gGThOCGotS3eajdjItlAwh2Y=,tag:MoD7LbWCu5EGxPeliRDinQ==,type:str]
|
||||||
|
encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$
|
||||||
|
version: 3.12.1
|
||||||
27
infra/gitea/values/secret-values.prod.enc.yaml
Normal file
27
infra/gitea/values/secret-values.prod.enc.yaml
Normal file
@@ -0,0 +1,27 @@
|
|||||||
|
# Gitea secrets for prod cluster
|
||||||
|
admin-password: ENC[AES256_GCM,data:4pXdFHPAXo9fnyEmAqDygucpGrOy,iv:Qa/fQvRoU8TXMlkSjlomwzOn0v1M/PJ606HZI+inRcQ=,tag:/fKGATm+rUSCUH+os12qlQ==,type:str]
|
||||||
|
db-password: ENC[AES256_GCM,data:lw3I+smG/1DaMFd2V98D7ENu6MB0g+e81A==,iv:DZmS4R2buArXMkO/Cjtp9gN9AqpTaVHs7NfqQFqciWY=,tag:OA9kzug/Mel6+GDlnYU/jA==,type:str]
|
||||||
|
sops:
|
||||||
|
age:
|
||||||
|
- recipient: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7
|
||||||
|
enc: |
|
||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCd2VUaHhQc0h4bmYwdmFy
|
||||||
|
WVJLS2dURWZnOUtCKzRoajB2RVI5U1ROOEVvCnV2VmxFTkhPNlErOE5SZzUyT0c1
|
||||||
|
VitrWFlJVUt5N2plMitWVjZPUHBmYU0KLS0tIFJVUnBBZjl6cWlRYUNiZSs1V0Q2
|
||||||
|
b1NBVnZydDVlY09LeHNpbkdsTzRNNmcKO9GFvLHIWTh/Aseuo3Z8FE47dE92MxJ6
|
||||||
|
p5OCsZRw+bpQfURStiyckaoMW8Of716uDIS3v1JaW8u4xm3e+lZXGg==
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
|
- recipient: age16p0gwk8vt90vy2gm8jjca8rcyd2drv5526e997ukdelnv5ek8unqm0smuk
|
||||||
|
enc: |
|
||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoOUZjdlk4MU4yWGNPOEs4
|
||||||
|
ZkplUzlyV1lmQUxidHk3aDFhU1NOeElxeVU4CngxWS8vOTdUbEVNM2thMWgxNGRo
|
||||||
|
ZUlYdjVPTXFJWGtNWEJEa2V1dGhqSTgKLS0tIEI2V1hrWUVnRnovblhVQ2ROSENE
|
||||||
|
dXhwWXJJbnVBaFpraXJURERMR1lkUjQKFzaekfQFqg2cVT5gks4fXX26GtZu+M1F
|
||||||
|
g+pzNxpFVlzdrXiWrzjePshTVblVsxV8fKpUVoLYwwLOSILRzF3uwg==
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
|
lastmodified: "2026-03-11T06:57:04Z"
|
||||||
|
mac: ENC[AES256_GCM,data:qWDAgi9DeHnc4TfH2la54mKtkNRkO3ArfXJBxZ6D6yEk5nylMA+Fw3FBmsKuU+F1/JN7CQVHbez37jjOXDmoFUfGXunionqkaf4wYz/3duRjdm/ApTLLMAYaq1YHzp6XNF4x+1LBtp0RadK//wwhxXQHoYdui9IH2Ts5ALLjOzo=,iv:B86+ovgnit5oKxY1wgxvYBEhRmnjJiQ7GdveJAGytfA=,tag:QgVjYIvIgwXvfbTxiti1OA==,type:str]
|
||||||
|
encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$
|
||||||
|
version: 3.12.1
|
||||||
10
infra/traefik-routes/config.yaml
Normal file
10
infra/traefik-routes/config.yaml
Normal file
@@ -0,0 +1,10 @@
|
|||||||
|
{
|
||||||
|
"name": "traefik-routes",
|
||||||
|
"namespace": "kube-system",
|
||||||
|
"step": "3",
|
||||||
|
"source": {
|
||||||
|
"repoURL": "https://github.com/Kargones/deploy-app-kargo-private.git",
|
||||||
|
"path": "infra/traefik-routes/manifests",
|
||||||
|
"targetRevision": "main"
|
||||||
|
}
|
||||||
|
}
|
||||||
41
infra/traefik-routes/manifests/gitea-ingress.yaml
Normal file
41
infra/traefik-routes/manifests/gitea-ingress.yaml
Normal file
@@ -0,0 +1,41 @@
|
|||||||
|
# Gitea HTTPS IngressRoute via Traefik
|
||||||
|
# Uses default TLS store (wildcard-tls from kube-system via TLSStore)
|
||||||
|
apiVersion: traefik.io/v1alpha1
|
||||||
|
kind: IngressRoute
|
||||||
|
metadata:
|
||||||
|
name: gitea-https
|
||||||
|
namespace: gitea
|
||||||
|
spec:
|
||||||
|
entryPoints:
|
||||||
|
- websecure
|
||||||
|
routes:
|
||||||
|
- match: HostRegexp(`gitea.k3s\..+\.local`)
|
||||||
|
kind: Rule
|
||||||
|
middlewares:
|
||||||
|
- name: sslheader
|
||||||
|
namespace: kube-system
|
||||||
|
- name: gitea-buffer-timeout
|
||||||
|
namespace: gitea
|
||||||
|
services:
|
||||||
|
- name: gitea-http
|
||||||
|
port: 3000
|
||||||
|
tls: {}
|
||||||
|
---
|
||||||
|
# HTTP → HTTPS redirect for Gitea
|
||||||
|
apiVersion: traefik.io/v1alpha1
|
||||||
|
kind: IngressRoute
|
||||||
|
metadata:
|
||||||
|
name: gitea-http-redirect
|
||||||
|
namespace: gitea
|
||||||
|
spec:
|
||||||
|
entryPoints:
|
||||||
|
- web
|
||||||
|
routes:
|
||||||
|
- match: HostRegexp(`gitea.k3s\..+\.local`)
|
||||||
|
kind: Rule
|
||||||
|
middlewares:
|
||||||
|
- name: redirect-https
|
||||||
|
namespace: kube-system
|
||||||
|
services:
|
||||||
|
- name: gitea-http
|
||||||
|
port: 3000
|
||||||
14
infra/traefik-routes/manifests/gitea-ssh.yaml
Normal file
14
infra/traefik-routes/manifests/gitea-ssh.yaml
Normal file
@@ -0,0 +1,14 @@
|
|||||||
|
# Gitea SSH access via Traefik TCP routing (port 2222)
|
||||||
|
apiVersion: traefik.io/v1alpha1
|
||||||
|
kind: IngressRouteTCP
|
||||||
|
metadata:
|
||||||
|
name: gitea-ssh
|
||||||
|
namespace: gitea
|
||||||
|
spec:
|
||||||
|
entryPoints:
|
||||||
|
- ssh
|
||||||
|
routes:
|
||||||
|
- match: HostSNI(`*`)
|
||||||
|
services:
|
||||||
|
- name: gitea-ssh
|
||||||
|
port: 22
|
||||||
21
infra/traefik-routes/manifests/kargo-ingress.yaml
Normal file
21
infra/traefik-routes/manifests/kargo-ingress.yaml
Normal file
@@ -0,0 +1,21 @@
|
|||||||
|
# Kargo dashboard HTTPS IngressRoute
|
||||||
|
apiVersion: traefik.io/v1alpha1
|
||||||
|
kind: IngressRoute
|
||||||
|
metadata:
|
||||||
|
name: kargo-https
|
||||||
|
namespace: kargo
|
||||||
|
spec:
|
||||||
|
entryPoints:
|
||||||
|
- websecure
|
||||||
|
routes:
|
||||||
|
- match: HostRegexp(`kargo.k3s\..+\.local`)
|
||||||
|
kind: Rule
|
||||||
|
middlewares:
|
||||||
|
- name: kargo-tls-middleware
|
||||||
|
namespace: kargo
|
||||||
|
services:
|
||||||
|
- name: kargo-api
|
||||||
|
port: 443
|
||||||
|
scheme: https
|
||||||
|
serversTransport: kargo-skip-verify
|
||||||
|
tls: {}
|
||||||
8
infra/traefik-routes/manifests/kargo-transport.yaml
Normal file
8
infra/traefik-routes/manifests/kargo-transport.yaml
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
# ServersTransport to skip TLS verification for Kargo backend (self-signed cert)
|
||||||
|
apiVersion: traefik.io/v1alpha1
|
||||||
|
kind: ServersTransport
|
||||||
|
metadata:
|
||||||
|
name: kargo-skip-verify
|
||||||
|
namespace: kargo
|
||||||
|
spec:
|
||||||
|
insecureSkipVerify: true
|
||||||
57
infra/traefik-routes/manifests/middlewares.yaml
Normal file
57
infra/traefik-routes/manifests/middlewares.yaml
Normal file
@@ -0,0 +1,57 @@
|
|||||||
|
# HTTP → HTTPS redirect
|
||||||
|
apiVersion: traefik.io/v1alpha1
|
||||||
|
kind: Middleware
|
||||||
|
metadata:
|
||||||
|
name: redirect-https
|
||||||
|
namespace: kube-system
|
||||||
|
spec:
|
||||||
|
redirectScheme:
|
||||||
|
scheme: https
|
||||||
|
permanent: true
|
||||||
|
---
|
||||||
|
# Forward X-Forwarded-Proto header for backends behind TLS termination
|
||||||
|
apiVersion: traefik.io/v1alpha1
|
||||||
|
kind: Middleware
|
||||||
|
metadata:
|
||||||
|
name: sslheader
|
||||||
|
namespace: kube-system
|
||||||
|
spec:
|
||||||
|
headers:
|
||||||
|
customRequestHeaders:
|
||||||
|
X-Forwarded-Proto: "https"
|
||||||
|
---
|
||||||
|
# Gitea: buffer large requests (git push) + timeout for CI builds
|
||||||
|
apiVersion: traefik.io/v1alpha1
|
||||||
|
kind: Middleware
|
||||||
|
metadata:
|
||||||
|
name: gitea-buffer-timeout
|
||||||
|
namespace: gitea
|
||||||
|
spec:
|
||||||
|
buffering:
|
||||||
|
maxRequestBodyBytes: 0
|
||||||
|
maxResponseBodyBytes: 0
|
||||||
|
memRequestBodyBytes: 20971520
|
||||||
|
memResponseBodyBytes: 20971520
|
||||||
|
retryExpression: "IsNetworkError()"
|
||||||
|
---
|
||||||
|
# ArgoCD: X-Forwarded-Proto for TLS termination
|
||||||
|
apiVersion: traefik.io/v1alpha1
|
||||||
|
kind: Middleware
|
||||||
|
metadata:
|
||||||
|
name: argocd-tls-middleware
|
||||||
|
namespace: argocd
|
||||||
|
spec:
|
||||||
|
headers:
|
||||||
|
customRequestHeaders:
|
||||||
|
X-Forwarded-Proto: "https"
|
||||||
|
---
|
||||||
|
# Kargo: X-Forwarded-Proto for TLS termination
|
||||||
|
apiVersion: traefik.io/v1alpha1
|
||||||
|
kind: Middleware
|
||||||
|
metadata:
|
||||||
|
name: kargo-tls-middleware
|
||||||
|
namespace: kargo
|
||||||
|
spec:
|
||||||
|
headers:
|
||||||
|
customRequestHeaders:
|
||||||
|
X-Forwarded-Proto: "https"
|
||||||
14
infra/traefik-routes/manifests/namespaces.yaml
Normal file
14
infra/traefik-routes/manifests/namespaces.yaml
Normal file
@@ -0,0 +1,14 @@
|
|||||||
|
# Ensure namespaces exist for cross-namespace middleware references
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: gitea
|
||||||
|
labels:
|
||||||
|
name: gitea
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: kargo
|
||||||
|
labels:
|
||||||
|
name: kargo
|
||||||
10
infra/traefik-routes/manifests/tls-store.yaml
Normal file
10
infra/traefik-routes/manifests/tls-store.yaml
Normal file
@@ -0,0 +1,10 @@
|
|||||||
|
# Default TLS store — uses wildcard-tls from kube-system as default cert.
|
||||||
|
# All IngressRoutes with tls: {} will use this certificate.
|
||||||
|
apiVersion: traefik.io/v1alpha1
|
||||||
|
kind: TLSStore
|
||||||
|
metadata:
|
||||||
|
name: default
|
||||||
|
namespace: kube-system
|
||||||
|
spec:
|
||||||
|
defaultCertificate:
|
||||||
|
secretName: wildcard-tls
|
||||||
19
infra/traefik-routes/manifests/traefik-dashboard.yaml
Normal file
19
infra/traefik-routes/manifests/traefik-dashboard.yaml
Normal file
@@ -0,0 +1,19 @@
|
|||||||
|
# Traefik Dashboard IngressRoute
|
||||||
|
apiVersion: traefik.io/v1alpha1
|
||||||
|
kind: IngressRoute
|
||||||
|
metadata:
|
||||||
|
name: traefik-dashboard
|
||||||
|
namespace: kube-system
|
||||||
|
spec:
|
||||||
|
entryPoints:
|
||||||
|
- websecure
|
||||||
|
routes:
|
||||||
|
- match: HostRegexp(`traefik.k3s\..+\.local`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`))
|
||||||
|
kind: Rule
|
||||||
|
middlewares:
|
||||||
|
- name: sslheader
|
||||||
|
namespace: kube-system
|
||||||
|
services:
|
||||||
|
- name: api@internal
|
||||||
|
kind: TraefikService
|
||||||
|
tls: {}
|
||||||
@@ -1,9 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
resources:
|
|
||||||
- namespace.yaml
|
|
||||||
- project.yaml
|
|
||||||
- warehouse.yaml
|
|
||||||
- stages/dev.yaml
|
|
||||||
- stages/prod.yaml
|
|
||||||
- verification/runner-health.yaml
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: ci
|
|
||||||
labels:
|
|
||||||
kargo.akuity.io/project: "true"
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
apiVersion: kargo.akuity.io/v1alpha1
|
|
||||||
kind: Project
|
|
||||||
metadata:
|
|
||||||
name: ci
|
|
||||||
---
|
|
||||||
apiVersion: kargo.akuity.io/v1alpha1
|
|
||||||
kind: ProjectConfig
|
|
||||||
metadata:
|
|
||||||
name: ci
|
|
||||||
namespace: ci
|
|
||||||
spec:
|
|
||||||
promotionPolicies:
|
|
||||||
- stageSelector: { name: dev }
|
|
||||||
autoPromotionEnabled: true
|
|
||||||
- stageSelector: { name: prod }
|
|
||||||
autoPromotionEnabled: true
|
|
||||||
@@ -1,54 +0,0 @@
|
|||||||
apiVersion: kargo.akuity.io/v1alpha1
|
|
||||||
kind: Stage
|
|
||||||
metadata:
|
|
||||||
name: dev
|
|
||||||
namespace: ci
|
|
||||||
spec:
|
|
||||||
requestedFreight:
|
|
||||||
- origin:
|
|
||||||
kind: Warehouse
|
|
||||||
name: ci-images
|
|
||||||
sources:
|
|
||||||
direct: true
|
|
||||||
promotionTemplate:
|
|
||||||
spec:
|
|
||||||
vars:
|
|
||||||
- name: gitopsRepo
|
|
||||||
value: https://github.com/Kargones/deploy-app-kargo-private.git
|
|
||||||
- name: targetBranch
|
|
||||||
value: ci/stage/${{ ctx.stage }}
|
|
||||||
steps:
|
|
||||||
- uses: git-clone
|
|
||||||
config:
|
|
||||||
repoURL: ${{ vars.gitopsRepo }}
|
|
||||||
checkout:
|
|
||||||
- branch: main
|
|
||||||
path: ./src
|
|
||||||
- branch: ${{ vars.targetBranch }}
|
|
||||||
create: true
|
|
||||||
path: ./out
|
|
||||||
- uses: git-clear
|
|
||||||
config:
|
|
||||||
path: ./out
|
|
||||||
- uses: copy
|
|
||||||
config:
|
|
||||||
inPath: ./src/ci
|
|
||||||
outPath: ./out/ci
|
|
||||||
- uses: yaml-update
|
|
||||||
config:
|
|
||||||
path: ./out/ci/gitea-runner/manifests/runner.yaml
|
|
||||||
updates:
|
|
||||||
- key: spec.template.spec.containers.0.image
|
|
||||||
value: gitea/act_runner:${{ imageFrom("gitea/act_runner").Tag }}
|
|
||||||
- uses: git-commit
|
|
||||||
as: commit
|
|
||||||
config:
|
|
||||||
path: ./out
|
|
||||||
message: "promote(ci/${{ ctx.stage }}): act_runner ${{ imageFrom(\"gitea/act_runner\").Tag }}"
|
|
||||||
- uses: git-push
|
|
||||||
config:
|
|
||||||
path: ./out
|
|
||||||
targetBranch: ${{ vars.targetBranch }}
|
|
||||||
verification:
|
|
||||||
analysisTemplates:
|
|
||||||
- name: runner-health
|
|
||||||
@@ -1,64 +0,0 @@
|
|||||||
apiVersion: kargo.akuity.io/v1alpha1
|
|
||||||
kind: Stage
|
|
||||||
metadata:
|
|
||||||
name: prod
|
|
||||||
namespace: ci
|
|
||||||
spec:
|
|
||||||
requestedFreight:
|
|
||||||
- origin:
|
|
||||||
kind: Warehouse
|
|
||||||
name: ci-images
|
|
||||||
sources:
|
|
||||||
stages:
|
|
||||||
- dev
|
|
||||||
promotionTemplate:
|
|
||||||
spec:
|
|
||||||
vars:
|
|
||||||
- name: gitopsRepo
|
|
||||||
value: https://github.com/Kargones/deploy-app-kargo-private.git
|
|
||||||
- name: sourceBranch
|
|
||||||
value: ci/stage/dev
|
|
||||||
- name: targetBranch
|
|
||||||
value: ci/stage/prod
|
|
||||||
steps:
|
|
||||||
- uses: git-clone
|
|
||||||
config:
|
|
||||||
repoURL: ${{ vars.gitopsRepo }}
|
|
||||||
checkout:
|
|
||||||
- branch: ${{ vars.sourceBranch }}
|
|
||||||
path: ./src
|
|
||||||
- branch: ${{ vars.targetBranch }}
|
|
||||||
create: true
|
|
||||||
path: ./out
|
|
||||||
- uses: git-clear
|
|
||||||
config:
|
|
||||||
path: ./out
|
|
||||||
- uses: copy
|
|
||||||
config:
|
|
||||||
inPath: ./src/ci
|
|
||||||
outPath: ./out/ci
|
|
||||||
- uses: git-commit
|
|
||||||
as: commit
|
|
||||||
config:
|
|
||||||
path: ./out
|
|
||||||
message: "promote(ci/prod): act_runner ${{ imageFrom(\"gitea/act_runner\").Tag }}"
|
|
||||||
- uses: git-push
|
|
||||||
as: push
|
|
||||||
config:
|
|
||||||
path: ./out
|
|
||||||
generateTargetBranch: true
|
|
||||||
- uses: git-open-pr
|
|
||||||
as: open-pr
|
|
||||||
config:
|
|
||||||
repoURL: ${{ vars.gitopsRepo }}
|
|
||||||
sourceBranch: ${{ outputs.push.branch }}
|
|
||||||
targetBranch: ${{ vars.targetBranch }}
|
|
||||||
createTargetBranch: true
|
|
||||||
title: "promote(ci/prod): act_runner ${{ imageFrom(\"gitea/act_runner\").Tag }}"
|
|
||||||
description: |
|
|
||||||
## Kargo Promotion — CI
|
|
||||||
**Image:** gitea/act_runner:${{ imageFrom("gitea/act_runner").Tag }}
|
|
||||||
- uses: git-wait-for-pr
|
|
||||||
config:
|
|
||||||
repoURL: ${{ vars.gitopsRepo }}
|
|
||||||
prNumber: ${{ outputs['open-pr'].pr.id }}
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: AnalysisTemplate
|
|
||||||
metadata:
|
|
||||||
name: runner-health
|
|
||||||
namespace: ci
|
|
||||||
spec:
|
|
||||||
metrics:
|
|
||||||
- name: runner-deployment-exists
|
|
||||||
provider:
|
|
||||||
job:
|
|
||||||
spec:
|
|
||||||
backoffLimit: 0
|
|
||||||
template:
|
|
||||||
spec:
|
|
||||||
serviceAccountName: kargo-verifier
|
|
||||||
restartPolicy: Never
|
|
||||||
containers:
|
|
||||||
- name: check
|
|
||||||
image: alpine/k8s:1.35.1
|
|
||||||
command: ["/bin/sh", "-c"]
|
|
||||||
args:
|
|
||||||
- |
|
|
||||||
echo "Checking gitea-runner deployment..."
|
|
||||||
kubectl get deployment gitea-runner -n gitea-runner -o jsonpath='{.metadata.name}' && echo " exists" || exit 1
|
|
||||||
echo "Runner health check passed"
|
|
||||||
@@ -1,11 +0,0 @@
|
|||||||
apiVersion: kargo.akuity.io/v1alpha1
|
|
||||||
kind: Warehouse
|
|
||||||
metadata:
|
|
||||||
name: ci-images
|
|
||||||
namespace: ci
|
|
||||||
spec:
|
|
||||||
subscriptions:
|
|
||||||
- image:
|
|
||||||
repoURL: gitea/act_runner
|
|
||||||
semverConstraint: ">=0.2.0"
|
|
||||||
discoveryLimit: 5
|
|
||||||
@@ -1,36 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: github-creds
|
|
||||||
namespace: ci
|
|
||||||
labels:
|
|
||||||
kargo.akuity.io/cred-type: git
|
|
||||||
type: Opaque
|
|
||||||
stringData:
|
|
||||||
repoURL: https://github.com/Kargones/deploy-app-kargo-private.git
|
|
||||||
username: Kargones
|
|
||||||
password: ENC[AES256_GCM,data:m9CZFhTHwaX6TrpGtbAynbI7eiprSrhCVVtST6fWiduFP55/EWtx1Q==,iv:iAjeVVakD8SZWhaEBu7JVR1YL2UGzYNBoy1W13M+Jwg=,tag:ABSswqyDhJG8+zlu8dWrgg==,type:str]
|
|
||||||
sops:
|
|
||||||
age:
|
|
||||||
- recipient: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHOWI4eWZxOERjRHVhV1VI
|
|
||||||
MVE3WDErejZrNzBaRnVHK280dXI4WThxR2tvCmVzbE1HR1MzcEgybm8vUVVSOWJY
|
|
||||||
VlVvREl4NVRDRElHVHk5aWpnVkVhNW8KLS0tIG5FOXRwRy8xakFvaVlBTXF5OXJJ
|
|
||||||
aHFlbWh0Ym1NWEswbFM5N01JRGtGMUUKyjiN+bK0+6PLc/LG/dozgrAhB4PLcZmV
|
|
||||||
JVtxrSZWV6RQOuvc/HUw2yhO3dJldYqWauX+7ZOy2o1JACdPe9ixdQ==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
- recipient: age1ame2tp44sq9rmkqzqvxy77eu7qd2035kmlgcsfjfxj2jughv3clqlku03g
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHWU9JLzdwbDI1SDJ3MnlE
|
|
||||||
YnlRQkdzWExpa1FGNjArSHFCamc2bWJnbjBBCnlkQlVEQVNDTXMvZ3NWRzhyT2lM
|
|
||||||
R0FpVUdleUVUcVVrTnRxQjVnSFo3S2cKLS0tIG1MZ0hYdGJpdTJ3WWU3MU1WeWFr
|
|
||||||
cklvSldLdW5ERDF1aW95dDlxOUtGbDAK7uoTP8idcEM8rQ7rRashsbzc9f4S7qI9
|
|
||||||
Bl87wLgMAFYfFO41cwSqhMY+gr7HRkDQq65CWo8HpQjMMlneC72jVQ==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
lastmodified: "2026-03-11T06:58:02Z"
|
|
||||||
mac: ENC[AES256_GCM,data:OYJAnGhgB0sOC2KEgse7ZYMkrvrRNsMWqVQZM29VbhPbvp3s3GMmJPROPydsjvm6OE4EIi0C6ry2h9pGoRY5IApw6+tSXVmrlr3oQIjkGqimJVdJ0oBSwEYtZ6gNKpsn1I7ZthXCHBfZmmESkYiTJj8ogdXxNLIqydIuITengpI=,iv:IpBxWcDeGUD9ucIAVjY3Ojc0wd63nWDPDIcH8OtvJY8=,tag:yDZ8d9E9dufB/iGTk71t2Q==,type:str]
|
|
||||||
encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$
|
|
||||||
version: 3.12.1
|
|
||||||
@@ -1,36 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: github-creds
|
|
||||||
namespace: ci
|
|
||||||
labels:
|
|
||||||
kargo.akuity.io/cred-type: git
|
|
||||||
type: Opaque
|
|
||||||
stringData:
|
|
||||||
repoURL: https://github.com/Kargones/deploy-app-kargo-private.git
|
|
||||||
username: Kargones
|
|
||||||
password: ENC[AES256_GCM,data:OHHKJ82Bh3UtuWJwtIr4dNnMDxweZEs/bHQQ7buy+zQM99f1SC4zEA==,iv:kn2P/KO5QKYhNxWKcbphmEmeJayWz/xA3NbfSq3T8K4=,tag:EzwiJHrK36SqRgISnzYmmw==,type:str]
|
|
||||||
sops:
|
|
||||||
age:
|
|
||||||
- recipient: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnREI0NnE1Z0Z6ZE1HWG4x
|
|
||||||
aHhZeDBIYmNJNjZJbVNJR2Myb3Zyb092cW1NCkt0T3Rwamx0S1dudE1rM1ZCTDZv
|
|
||||||
ZDlJTmh5YjdUT3k1YlZlM2FOdzgrc3MKLS0tIFhNeFdrNkRBelZRUldqenhBVFAx
|
|
||||||
dHF0cUFmNXRHS3RkeTVVQzhIVTBXdm8K6c/K14oe/bPkaFCJi/OpoLj3q8RE20Hn
|
|
||||||
/1yeNCfRNkAPyOYQae6XgPI2xL5H+PfhMzRWYa6ebI/Pefl3n4WeSA==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
- recipient: age16p0gwk8vt90vy2gm8jjca8rcyd2drv5526e997ukdelnv5ek8unqm0smuk
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBdFhPTWRZUEllR01sQzBM
|
|
||||||
RTQvbzM5ZnoyaEtHS21hS1BCWjJFNkZDZml3ClBPZHgvU2lCTHRwL01JUFRpY3pI
|
|
||||||
RTcvNkNZNXkwYkRVQzBWNVRuSllPcTAKLS0tIDMwTlFkcXR1QmNBNDVwQXdPUzR0
|
|
||||||
UlBIbE83UXEzcmVNWXhyOWRXUit4REUKxJQwLz/w4BGMW6OggbaG0kDv0CWIUQi6
|
|
||||||
H1gWD4HKT1JM8rI9GrBJRijmQhJvfn+s3PcRnimVa8sFUXJwR8ffrA==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
lastmodified: "2026-03-11T06:58:02Z"
|
|
||||||
mac: ENC[AES256_GCM,data:0sm3v9oBiyy+3/es2piC9O3505QyaiylQSy7/7IkOYHcLQi5T0R6pXV+LlTMrJgxbvQg5PjyFxtGDF/MS9VM7iimDwJzAwC+Jv9Z9senKG6DwenUl8B/hHtXoWHGIxKrzR+0nnh756u+ftDTR5u7PDdd03UIn+n6fhpZ3tRB1q8=,iv:T3KPpdXz+8Bq0TBlIPR3+tFWHEBsE515rBWWDyM0VGM=,tag:+aBXzSUykrdazF6lXGNwHQ==,type:str]
|
|
||||||
encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$
|
|
||||||
version: 3.12.1
|
|
||||||
@@ -1,36 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: github-creds
|
|
||||||
namespace: infra
|
|
||||||
labels:
|
|
||||||
kargo.akuity.io/cred-type: git
|
|
||||||
type: Opaque
|
|
||||||
stringData:
|
|
||||||
repoURL: https://github.com/Kargones/deploy-app-kargo-private.git
|
|
||||||
username: Kargones
|
|
||||||
password: ENC[AES256_GCM,data:lzaZLTkmA68DadpquacJNc6CMxwv3wOlWh6Ze8e23F9lzFKw3oB5gg==,iv:9EZUg6DSUFnNddOaiB2oIfNYhaOKKkrP9Hkf+5OGcLk=,tag:rr6ej2x87mquQbXiBM7+Ow==,type:str]
|
|
||||||
sops:
|
|
||||||
age:
|
|
||||||
- recipient: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCeGdkaVJiNWE0Q0xWbTVT
|
|
||||||
dkZDN296VXJUMktMVUZ2U3FyeUwvVzBSaWc0CmRlWFpLdTlCNXl3eEtKcDRrUzhV
|
|
||||||
SG9KdkhlSTg0SnZwK3BvS0hkT3FjbjgKLS0tIDA2Y1lic053ejR0UWZUekZ1Y1JK
|
|
||||||
c2llUmhKNTRjaW1zQ3AyZzUvR1VRUG8KuFXq5pbpEEZd3P/E5bD0FCuSOIuGCsJL
|
|
||||||
bUx6VucI1zZF0DbXjzr28FsxqSJW4GiCpDscj1LGQIZa5jvj8aWMXA==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
- recipient: age1ame2tp44sq9rmkqzqvxy77eu7qd2035kmlgcsfjfxj2jughv3clqlku03g
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRRlh5SXdkTmZOVUdXc21N
|
|
||||||
aXNZaDhydXA3dUU4OHlidmViM2xUQU5rNDF3Ck9iditWSWcyaWoxNTVTRzN5Y0ZU
|
|
||||||
c21BT2R6U2lxNkh6cU9kdjFSRUVjUWsKLS0tIHBwWGI1R2p0TTg1amFRM2FlYVQx
|
|
||||||
Q2lIZDJ0ZkliWEtiVGd5eXIxMjB1OGMKeK2iTyPBrcIWByU9QXZ3Ora7gylwC66g
|
|
||||||
diGbcUF5ER7mUt0KEILTwuMkTUbhy1F5zLYB7p4e49YdY2O8mz51SA==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
lastmodified: "2026-03-11T06:58:02Z"
|
|
||||||
mac: ENC[AES256_GCM,data:dzyW+dAsjPDrZQ3EWNnhLWfd9DSmRVSp1Qrm+nx4qFfsRoS5y61jnkhVyupq2OUVsuUTuePIAqmZQI16HD0TTMJIN9UKPdW2sEj/DGwdBXqcJRs6mvJlv79Jh2VlzJdJSpZf/YhCBVIVThZqrWBI1T1jPdN1gaJ0ov6cSAqYjPU=,iv:MMhdUthu2nUFJOkxXz00xXMiH7tit7sNejU/aXuQOmY=,tag:+NSHR9T4wlpJaBH5ZdxhvA==,type:str]
|
|
||||||
encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$
|
|
||||||
version: 3.12.1
|
|
||||||
@@ -1,36 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: github-creds
|
|
||||||
namespace: infra
|
|
||||||
labels:
|
|
||||||
kargo.akuity.io/cred-type: git
|
|
||||||
type: Opaque
|
|
||||||
stringData:
|
|
||||||
repoURL: https://github.com/Kargones/deploy-app-kargo-private.git
|
|
||||||
username: Kargones
|
|
||||||
password: ENC[AES256_GCM,data:2ucqkKTdxBlW2GCRmr4ZqrZZS2KuIcUCkhyF6/dIy0jGiUTM1iQIiQ==,iv:gTnztDCoZX9rfK6cnnoOOs6WD8mmw6tWr2z9JUkj+sA=,tag:I5OgSmjtAbnXxyhCe7y3GA==,type:str]
|
|
||||||
sops:
|
|
||||||
age:
|
|
||||||
- recipient: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0RVRoa2ZTT2llSitDYlRn
|
|
||||||
RU1RRkVNdnFFZWpMU0ZoU2Q0bGRKVFViZEc4CkdaalppTll1Q0c4T29aYks2a3Nq
|
|
||||||
azBaMWtJL3hyQlFVMFpUTjcrQ3BkU0kKLS0tIC80azJYWnhGZHpwK0lWa1FrS1d4
|
|
||||||
WlFjQk9WZVdoSnhnT1lROFZzUWMxb00KJ6i6Vap1FCYYUcTiNh5dyHbSeyXthtdf
|
|
||||||
iQcMjvZlOgKuHVPmaiXv8Mh+AHNl0RgWN2nNEoa1NPhriGU36ZmVWA==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
- recipient: age16p0gwk8vt90vy2gm8jjca8rcyd2drv5526e997ukdelnv5ek8unqm0smuk
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzMUx5UkNBZHlZdVhlaXV3
|
|
||||||
OVNXTitPd2lQQXFoanNjb014ODB3ZUVLRHlvCmdBbkpmaXkzSXZxRFdPZEVubVJC
|
|
||||||
NHpyUDVkVjV5QXRPbnBHNkZhclMzc1UKLS0tIGtWcHZGMEorbFNEeStmSW80WE9N
|
|
||||||
RjRLYkhHMmd6UTNUSkxCUUFvMzVkdTAKJhUHz7PDrJca3OIdXyzXzD86/7tkCSm4
|
|
||||||
Q6q6WbscBBMtclrO5EfbHuzUUNuejFRLjeHjvPCBb5z/i6sp6Pxyuw==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
lastmodified: "2026-03-11T06:58:02Z"
|
|
||||||
mac: ENC[AES256_GCM,data:KetBMvqfuE4eSrQoKmFJ0fkHHAvxFjQJvm9b9haSODfXDUxZ7DOYlVAVrZzf7L9VYFj7iP+yQeW2cLuV0JRH9+CL6u2GuvtK5WPC82NhRK/I5dEF+x3VIFjc3amr62FEuOjPeLOiAqluPeJ3BscW/Gj6UXKrLgrPzmZZgzzBHb4=,iv:fNbOFcpkAmom0Tf7xeoDfyklWNxIhHANS3WguPtrDK4=,tag:lsbhvAgSWdp+XKPKpGU56Q==,type:str]
|
|
||||||
encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$
|
|
||||||
version: 3.12.1
|
|
||||||
@@ -1,36 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: github-creds
|
|
||||||
namespace: test-env
|
|
||||||
labels:
|
|
||||||
kargo.akuity.io/cred-type: git
|
|
||||||
type: Opaque
|
|
||||||
stringData:
|
|
||||||
repoURL: https://github.com/Kargones/deploy-app-kargo-private.git
|
|
||||||
username: Kargones
|
|
||||||
password: ENC[AES256_GCM,data:pGwKoR6eurha3ATmL0XP01DTK3qXCxAV3SdFYmNFokKMZI+VuzZ/GQ==,iv:DKVdeBRQS+HjPkHftJZZuXf7yB+I18Ae3iK+7L+hZQ0=,tag:/K6twgUKTNrn6s1rDTAeQA==,type:str]
|
|
||||||
sops:
|
|
||||||
age:
|
|
||||||
- recipient: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYTk5seDNiR2dRcXRRclJZ
|
|
||||||
UlNuRXZGd3ZMTDNsaHVrYUtnUmsyNk1IVkJFCmo0Y0pwdnlsay9qcy8rakk4ejBF
|
|
||||||
VHAzbmRObUFVVVpZN0JraHRlVmhhNW8KLS0tIHNXd01OUnVxclRXcE9iNFNzZS9S
|
|
||||||
UlQzRnlSb2F0Y0J0eVdZN1BSelRrSWcK8V99m3Hh2mOm9csGG42k4FIeFbQnkXIr
|
|
||||||
w3elSENAib0rFz7Uewpn1VD3yjFL7SVv33bVOEuM3KlHDtUnF6fuuQ==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
- recipient: age1ame2tp44sq9rmkqzqvxy77eu7qd2035kmlgcsfjfxj2jughv3clqlku03g
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOS05ZanNzMWRFRG5EUlNq
|
|
||||||
WmtLUHpHRE0rWXRuVXRLRDFiRDZSZmdEc2lnCmMrbHRxRUhIWDFkaTJlekxrckxj
|
|
||||||
V3ROU25aOVZGVzVUY3IwRlhwYWhBWEUKLS0tIHZCS1ZobFlqQ2NZSUt3N1VSV2l4
|
|
||||||
SmVWWDRhckRxek1jRFpPUnIxb0QxaDQKmkVXDqP0tjaWo/fkdqrIatV/bhyQt9vb
|
|
||||||
Rzz21KATjKow6VtekA3FVOVchlDsaYDLkhuLI69I1lIYqR99ovS+8w==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
lastmodified: "2026-03-11T06:58:02Z"
|
|
||||||
mac: ENC[AES256_GCM,data:CDESJXzhctA4WexUb2hP6ykWkRCWUsgIYHOSmRnHUlyf6Pd8uF43Bl/+ZHWhE6SLWf3LKGMOKSU60Qkh1aSH+Z9BqaiKa3dL0MIQx4yXRe9NzS/mEki4IsuQi27AZ6BKD93tznyVKbCAzxmyP1jRhbRNIKBA2dWoQAITX1w2vvA=,iv:l8JZK3a17DfIn3llapKnUZH7SRNCte5MNPZzjtPJbxA=,tag:rEcarIr7UhsV+THixTUiKw==,type:str]
|
|
||||||
encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$
|
|
||||||
version: 3.12.1
|
|
||||||
@@ -1,36 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: github-creds
|
|
||||||
namespace: test-env
|
|
||||||
labels:
|
|
||||||
kargo.akuity.io/cred-type: git
|
|
||||||
type: Opaque
|
|
||||||
stringData:
|
|
||||||
repoURL: https://github.com/Kargones/deploy-app-kargo-private.git
|
|
||||||
username: Kargones
|
|
||||||
password: ENC[AES256_GCM,data:YIFtzQT8BYFwj5SfRDGxd/ND6BzpFSbERF3u+TyFjCoFqQXqk4g9ew==,iv:gOwNFYoErJhEJglBP9Oed45/CFQXXHlPqid3RzScvdA=,tag:iTJfhSTKceOl5lv4YiGo4Q==,type:str]
|
|
||||||
sops:
|
|
||||||
age:
|
|
||||||
- recipient: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBza2JKZTlxSTZOZ1lzNllu
|
|
||||||
TWdoL0lKSDc0Ri9BMWs1aDhSU1VaQ1dod2dzCk5sRHdIa1B3a2RMbTViZ3lPc04y
|
|
||||||
OUQ4WVNRR3JrZ1lyZXJvd3lFVUYxdlEKLS0tIFRNM0dqR1RGMVZ2alprMmxRQndo
|
|
||||||
Y0h3RE5WaHprRDZWUnBCQURhS0tnbHMKz9/qP2w1KURlDAWVcjfUFz1kJy/ed53w
|
|
||||||
SpKMwvWTfYTvvZMNnz1XgxMfKXu4TKWAuP9mJ+rmcj5jIcPSGxetUA==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
- recipient: age16p0gwk8vt90vy2gm8jjca8rcyd2drv5526e997ukdelnv5ek8unqm0smuk
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYeTd6Uk5yN2o5MDhsa0V6
|
|
||||||
UTZGZ29rSmFYbm5uRkg2UGNNdW13UmJ0eWxFCnZCWU5RalJEdFQ1SCtxdGQxVDhV
|
|
||||||
R3FsbkppRHkwbEdmYTU0dE5leEUxN2cKLS0tIDZtc3orbkhKMVVmdnpQRDVRUm9P
|
|
||||||
ck5QYkczblV0YndpQ0hoN3lDWDhrbUEKG5nPWrnAHFvUCsf/Zwgo22oiP1nIvXc5
|
|
||||||
PSo+hPCzFAjVtg7y1jO8HcwUVOgtcH/LN4NwcMF/I7VZajHRZXEQXQ==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
lastmodified: "2026-03-11T06:58:02Z"
|
|
||||||
mac: ENC[AES256_GCM,data:3/YKxY5Ai543PDiUZi767xsmgJSI+bWyBQER+ICo9jQydbef1gJ2Rp3TitnuSiD2H+l41b2tIEFp4y3IaXSD6B+8cbf+bs7YdXznJzFd/V3FKjKncQJkJdTlLDijJRsjPczEFA/syhy/i8jMORoid1SNQrk2l0XmiWx7bujTOys=,iv:Wtdf3swbTJEXQu2+JNu8mqYHWvK9DIZRLuXLoKB5n9w=,tag:jMiSS9gzmZpWXNVq3liyTA==,type:str]
|
|
||||||
encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$
|
|
||||||
version: 3.12.1
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
# ksops generator for PROD cluster
|
|
||||||
# Replace ksops-generator.yaml on infra/stage/prod branch
|
|
||||||
apiVersion: viaduct.ai/v1
|
|
||||||
kind: ksops
|
|
||||||
metadata:
|
|
||||||
name: kargo-git-credentials
|
|
||||||
annotations:
|
|
||||||
config.kubernetes.io/function: |
|
|
||||||
exec:
|
|
||||||
path: ksops
|
|
||||||
files:
|
|
||||||
- git-creds-infra.prod.enc.yaml
|
|
||||||
- git-creds-ci.prod.enc.yaml
|
|
||||||
- git-creds-test-env.prod.enc.yaml
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
# ksops generator for PROD cluster
|
|
||||||
# Replace ksops-generator.yaml on infra/stage/prod branch
|
|
||||||
apiVersion: viaduct.ai/v1
|
|
||||||
kind: ksops
|
|
||||||
metadata:
|
|
||||||
name: kargo-git-credentials
|
|
||||||
annotations:
|
|
||||||
config.kubernetes.io/function: |
|
|
||||||
exec:
|
|
||||||
path: ksops
|
|
||||||
files:
|
|
||||||
- git-creds-infra.prod.enc.yaml
|
|
||||||
- git-creds-ci.prod.enc.yaml
|
|
||||||
- git-creds-test-env.prod.enc.yaml
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
|
|
||||||
generators:
|
|
||||||
- ksops-generator.yaml
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
resources:
|
|
||||||
- namespace.yaml
|
|
||||||
- project.yaml
|
|
||||||
- warehouse.yaml
|
|
||||||
- stages/dev.yaml
|
|
||||||
- stages/test.yaml
|
|
||||||
- stages/prod.yaml
|
|
||||||
- verification/rbac.yaml
|
|
||||||
- verification/dev-health-check.yaml
|
|
||||||
- verification/prod-health-check.yaml
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: infra
|
|
||||||
labels:
|
|
||||||
kargo.akuity.io/project: "true"
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
apiVersion: kargo.akuity.io/v1alpha1
|
|
||||||
kind: Project
|
|
||||||
metadata:
|
|
||||||
name: infra
|
|
||||||
---
|
|
||||||
apiVersion: kargo.akuity.io/v1alpha1
|
|
||||||
kind: ProjectConfig
|
|
||||||
metadata:
|
|
||||||
name: infra
|
|
||||||
namespace: infra
|
|
||||||
spec:
|
|
||||||
promotionPolicies:
|
|
||||||
- stageSelector: { name: dev }
|
|
||||||
autoPromotionEnabled: true
|
|
||||||
- stageSelector: { name: test }
|
|
||||||
autoPromotionEnabled: true
|
|
||||||
- stageSelector: { name: prod }
|
|
||||||
autoPromotionEnabled: true # creates PR, not direct push
|
|
||||||
@@ -1,69 +0,0 @@
|
|||||||
apiVersion: kargo.akuity.io/v1alpha1
|
|
||||||
kind: Stage
|
|
||||||
metadata:
|
|
||||||
name: dev
|
|
||||||
namespace: infra
|
|
||||||
spec:
|
|
||||||
requestedFreight:
|
|
||||||
- origin:
|
|
||||||
kind: Warehouse
|
|
||||||
name: infra-charts
|
|
||||||
sources:
|
|
||||||
direct: true
|
|
||||||
promotionTemplate:
|
|
||||||
spec:
|
|
||||||
vars:
|
|
||||||
- name: gitopsRepo
|
|
||||||
value: https://github.com/Kargones/deploy-app-kargo-private.git
|
|
||||||
- name: targetBranch
|
|
||||||
value: infra/stage/${{ ctx.stage }}
|
|
||||||
steps:
|
|
||||||
- uses: git-clone
|
|
||||||
config:
|
|
||||||
repoURL: ${{ vars.gitopsRepo }}
|
|
||||||
checkout:
|
|
||||||
- branch: main
|
|
||||||
path: ./src
|
|
||||||
- branch: ${{ vars.targetBranch }}
|
|
||||||
create: true
|
|
||||||
path: ./out
|
|
||||||
- uses: git-clear
|
|
||||||
config:
|
|
||||||
path: ./out
|
|
||||||
- uses: yaml-update
|
|
||||||
as: update-cert-manager
|
|
||||||
config:
|
|
||||||
path: ./src/infra/cert-manager/config.yaml
|
|
||||||
updates:
|
|
||||||
- key: source.targetRevision
|
|
||||||
value: ${{ chartFrom("https://charts.jetstack.io", "cert-manager").Version }}
|
|
||||||
- uses: yaml-update
|
|
||||||
as: update-argo-rollouts
|
|
||||||
config:
|
|
||||||
path: ./src/infra/argo-rollouts/config.yaml
|
|
||||||
updates:
|
|
||||||
- key: source.targetRevision
|
|
||||||
value: ${{ chartFrom("https://argoproj.github.io/argo-helm", "argo-rollouts").Version }}
|
|
||||||
- uses: yaml-update
|
|
||||||
as: update-gitea
|
|
||||||
config:
|
|
||||||
path: ./src/infra/gitea/config.yaml
|
|
||||||
updates:
|
|
||||||
- key: source.targetRevision
|
|
||||||
value: ${{ chartFrom("https://dl.gitea.com/charts", "gitea").Version }}
|
|
||||||
- uses: copy
|
|
||||||
config:
|
|
||||||
inPath: ./src/infra
|
|
||||||
outPath: ./out/infra
|
|
||||||
- uses: git-commit
|
|
||||||
as: commit
|
|
||||||
config:
|
|
||||||
path: ./out
|
|
||||||
message: "promote(infra/${{ ctx.stage }}): freight ${{ ctx.targetFreight.name }}"
|
|
||||||
- uses: git-push
|
|
||||||
config:
|
|
||||||
path: ./out
|
|
||||||
targetBranch: ${{ vars.targetBranch }}
|
|
||||||
verification:
|
|
||||||
analysisTemplates:
|
|
||||||
- name: dev-health-check
|
|
||||||
@@ -1,76 +0,0 @@
|
|||||||
apiVersion: kargo.akuity.io/v1alpha1
|
|
||||||
kind: Stage
|
|
||||||
metadata:
|
|
||||||
name: prod
|
|
||||||
namespace: infra
|
|
||||||
spec:
|
|
||||||
requestedFreight:
|
|
||||||
- origin:
|
|
||||||
kind: Warehouse
|
|
||||||
name: infra-charts
|
|
||||||
sources:
|
|
||||||
stages:
|
|
||||||
- test
|
|
||||||
promotionTemplate:
|
|
||||||
spec:
|
|
||||||
vars:
|
|
||||||
- name: gitopsRepo
|
|
||||||
value: https://github.com/Kargones/deploy-app-kargo-private.git
|
|
||||||
- name: sourceBranch
|
|
||||||
value: infra/stage/test
|
|
||||||
- name: targetBranch
|
|
||||||
value: infra/stage/prod
|
|
||||||
steps:
|
|
||||||
- uses: git-clone
|
|
||||||
config:
|
|
||||||
repoURL: ${{ vars.gitopsRepo }}
|
|
||||||
checkout:
|
|
||||||
- branch: ${{ vars.sourceBranch }}
|
|
||||||
path: ./src
|
|
||||||
- branch: ${{ vars.targetBranch }}
|
|
||||||
create: true
|
|
||||||
path: ./out
|
|
||||||
- uses: git-clear
|
|
||||||
config:
|
|
||||||
path: ./out
|
|
||||||
- uses: copy
|
|
||||||
config:
|
|
||||||
inPath: ./src/infra
|
|
||||||
outPath: ./out/infra
|
|
||||||
- uses: git-commit
|
|
||||||
as: commit
|
|
||||||
config:
|
|
||||||
path: ./out
|
|
||||||
message: "promote(infra/prod): freight ${{ ctx.targetFreight.name }}"
|
|
||||||
- uses: git-push
|
|
||||||
as: push
|
|
||||||
config:
|
|
||||||
path: ./out
|
|
||||||
generateTargetBranch: true
|
|
||||||
- uses: git-open-pr
|
|
||||||
as: open-pr
|
|
||||||
config:
|
|
||||||
repoURL: ${{ vars.gitopsRepo }}
|
|
||||||
sourceBranch: ${{ outputs.push.branch }}
|
|
||||||
targetBranch: ${{ vars.targetBranch }}
|
|
||||||
title: "promote(infra/prod): ${{ ctx.targetFreight.name }}"
|
|
||||||
description: |
|
|
||||||
## Kargo Promotion
|
|
||||||
**Freight:** ${{ ctx.targetFreight.name }}
|
|
||||||
**Project:** infra
|
|
||||||
**Stage:** prod
|
|
||||||
|
|
||||||
## Verified in
|
|
||||||
- ✅ dev (pod-health)
|
|
||||||
- ✅ test (pod-health)
|
|
||||||
|
|
||||||
## Review
|
|
||||||
Check the diff below for version changes.
|
|
||||||
Verify changelogs before merging.
|
|
||||||
- uses: git-wait-for-pr
|
|
||||||
config:
|
|
||||||
repoURL: ${{ vars.gitopsRepo }}
|
|
||||||
prNumber: ${{ outputs['open-pr'].pr.id }}
|
|
||||||
verification:
|
|
||||||
analysisTemplates:
|
|
||||||
- name: prod-health-check
|
|
||||||
@@ -1,51 +0,0 @@
|
|||||||
apiVersion: kargo.akuity.io/v1alpha1
|
|
||||||
kind: Stage
|
|
||||||
metadata:
|
|
||||||
name: test
|
|
||||||
namespace: infra
|
|
||||||
spec:
|
|
||||||
requestedFreight:
|
|
||||||
- origin:
|
|
||||||
kind: Warehouse
|
|
||||||
name: infra-charts
|
|
||||||
sources:
|
|
||||||
stages:
|
|
||||||
- dev
|
|
||||||
promotionTemplate:
|
|
||||||
spec:
|
|
||||||
vars:
|
|
||||||
- name: gitopsRepo
|
|
||||||
value: https://github.com/Kargones/deploy-app-kargo-private.git
|
|
||||||
- name: sourceBranch
|
|
||||||
value: infra/stage/dev
|
|
||||||
- name: targetBranch
|
|
||||||
value: infra/stage/${{ ctx.stage }}
|
|
||||||
steps:
|
|
||||||
- uses: git-clone
|
|
||||||
config:
|
|
||||||
repoURL: ${{ vars.gitopsRepo }}
|
|
||||||
checkout:
|
|
||||||
- branch: ${{ vars.sourceBranch }}
|
|
||||||
path: ./src
|
|
||||||
- branch: ${{ vars.targetBranch }}
|
|
||||||
create: true
|
|
||||||
path: ./out
|
|
||||||
- uses: git-clear
|
|
||||||
config:
|
|
||||||
path: ./out
|
|
||||||
- uses: copy
|
|
||||||
config:
|
|
||||||
inPath: ./src/infra
|
|
||||||
outPath: ./out/infra
|
|
||||||
- uses: git-commit
|
|
||||||
as: commit
|
|
||||||
config:
|
|
||||||
path: ./out
|
|
||||||
message: "promote(infra/${{ ctx.stage }}): freight ${{ ctx.targetFreight.name }}"
|
|
||||||
- uses: git-push
|
|
||||||
config:
|
|
||||||
path: ./out
|
|
||||||
targetBranch: ${{ vars.targetBranch }}
|
|
||||||
verification:
|
|
||||||
analysisTemplates:
|
|
||||||
- name: dev-health-check
|
|
||||||
@@ -1,37 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: AnalysisTemplate
|
|
||||||
metadata:
|
|
||||||
name: dev-health-check
|
|
||||||
namespace: infra
|
|
||||||
spec:
|
|
||||||
metrics:
|
|
||||||
- name: pod-health
|
|
||||||
successCondition: result == "healthy"
|
|
||||||
provider:
|
|
||||||
job:
|
|
||||||
spec:
|
|
||||||
template:
|
|
||||||
spec:
|
|
||||||
serviceAccountName: kargo-verifier
|
|
||||||
containers:
|
|
||||||
- name: check
|
|
||||||
image: alpine/k8s:1.35.1
|
|
||||||
command: [sh, -c]
|
|
||||||
args:
|
|
||||||
- |
|
|
||||||
set -e
|
|
||||||
echo "Checking pod health..."
|
|
||||||
cm=$(kubectl get pods -n cert-manager --no-headers 2>/dev/null | grep -c Running || echo 0)
|
|
||||||
echo "cert-manager running pods: $cm"
|
|
||||||
ar=$(kubectl get pods -n argo-rollouts --no-headers 2>/dev/null | grep -c Running || echo 0)
|
|
||||||
echo "argo-rollouts running pods: $ar"
|
|
||||||
gt=$(kubectl get pods -n gitea --no-headers 2>/dev/null | grep -c Running || echo 0)
|
|
||||||
echo "gitea running pods: $gt"
|
|
||||||
if [ "$cm" -ge 1 ] && [ "$ar" -ge 1 ] && [ "$gt" -ge 1 ]; then
|
|
||||||
echo "healthy"
|
|
||||||
else
|
|
||||||
echo "unhealthy"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
restartPolicy: Never
|
|
||||||
backoffLimit: 2
|
|
||||||
@@ -1,37 +0,0 @@
|
|||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: AnalysisTemplate
|
|
||||||
metadata:
|
|
||||||
name: prod-health-check
|
|
||||||
namespace: infra
|
|
||||||
spec:
|
|
||||||
metrics:
|
|
||||||
- name: pod-health
|
|
||||||
successCondition: result == "healthy"
|
|
||||||
provider:
|
|
||||||
job:
|
|
||||||
spec:
|
|
||||||
template:
|
|
||||||
spec:
|
|
||||||
serviceAccountName: kargo-verifier
|
|
||||||
containers:
|
|
||||||
- name: check
|
|
||||||
image: alpine/k8s:1.35.1
|
|
||||||
command: [sh, -c]
|
|
||||||
args:
|
|
||||||
- |
|
|
||||||
set -e
|
|
||||||
echo "Checking pod health..."
|
|
||||||
cm=$(kubectl get pods -n cert-manager --no-headers 2>/dev/null | grep -c Running || echo 0)
|
|
||||||
echo "cert-manager running pods: $cm"
|
|
||||||
ar=$(kubectl get pods -n argo-rollouts --no-headers 2>/dev/null | grep -c Running || echo 0)
|
|
||||||
echo "argo-rollouts running pods: $ar"
|
|
||||||
gt=$(kubectl get pods -n gitea --no-headers 2>/dev/null | grep -c Running || echo 0)
|
|
||||||
echo "gitea running pods: $gt"
|
|
||||||
if [ "$cm" -ge 1 ] && [ "$ar" -ge 1 ] && [ "$gt" -ge 1 ]; then
|
|
||||||
echo "healthy"
|
|
||||||
else
|
|
||||||
echo "unhealthy"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
restartPolicy: Never
|
|
||||||
backoffLimit: 2
|
|
||||||
@@ -1,27 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
name: kargo-verifier
|
|
||||||
namespace: infra
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRole
|
|
||||||
metadata:
|
|
||||||
name: kargo-verifier-infra
|
|
||||||
rules:
|
|
||||||
- apiGroups: [""]
|
|
||||||
resources: ["pods"]
|
|
||||||
verbs: ["get", "list"]
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRoleBinding
|
|
||||||
metadata:
|
|
||||||
name: kargo-verifier-infra
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: ClusterRole
|
|
||||||
name: kargo-verifier-infra
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: kargo-verifier
|
|
||||||
namespace: infra
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
apiVersion: kargo.akuity.io/v1alpha1
|
|
||||||
kind: Warehouse
|
|
||||||
metadata:
|
|
||||||
name: infra-charts
|
|
||||||
namespace: infra
|
|
||||||
spec:
|
|
||||||
subscriptions:
|
|
||||||
- chart:
|
|
||||||
repoURL: https://charts.jetstack.io
|
|
||||||
name: cert-manager
|
|
||||||
semverConstraint: ">=1.17.0"
|
|
||||||
discoveryLimit: 5
|
|
||||||
- chart:
|
|
||||||
repoURL: https://argoproj.github.io/argo-helm
|
|
||||||
name: argo-rollouts
|
|
||||||
semverConstraint: ">=2.39.0"
|
|
||||||
discoveryLimit: 5
|
|
||||||
- chart:
|
|
||||||
repoURL: https://dl.gitea.com/charts
|
|
||||||
name: gitea
|
|
||||||
semverConstraint: ">=10.6.0"
|
|
||||||
discoveryLimit: 5
|
|
||||||
@@ -1,7 +0,0 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
resources:
|
|
||||||
- namespace.yaml
|
|
||||||
- project.yaml
|
|
||||||
- warehouse.yaml
|
|
||||||
- stages/dev.yaml
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: test-env
|
|
||||||
labels:
|
|
||||||
kargo.akuity.io/project: "true"
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
apiVersion: kargo.akuity.io/v1alpha1
|
|
||||||
kind: Project
|
|
||||||
metadata:
|
|
||||||
name: test-env
|
|
||||||
---
|
|
||||||
apiVersion: kargo.akuity.io/v1alpha1
|
|
||||||
kind: ProjectConfig
|
|
||||||
metadata:
|
|
||||||
name: test-env
|
|
||||||
namespace: test-env
|
|
||||||
spec:
|
|
||||||
promotionPolicies:
|
|
||||||
- stageSelector: { name: dev }
|
|
||||||
autoPromotionEnabled: true
|
|
||||||
@@ -1,45 +0,0 @@
|
|||||||
apiVersion: kargo.akuity.io/v1alpha1
|
|
||||||
kind: Stage
|
|
||||||
metadata:
|
|
||||||
name: dev
|
|
||||||
namespace: test-env
|
|
||||||
spec:
|
|
||||||
requestedFreight:
|
|
||||||
- origin:
|
|
||||||
kind: Warehouse
|
|
||||||
name: test-env-images
|
|
||||||
sources:
|
|
||||||
direct: true
|
|
||||||
promotionTemplate:
|
|
||||||
spec:
|
|
||||||
vars:
|
|
||||||
- name: gitopsRepo
|
|
||||||
value: https://github.com/Kargones/deploy-app-kargo-private.git
|
|
||||||
- name: targetBranch
|
|
||||||
value: test-env/stage/${{ ctx.stage }}
|
|
||||||
steps:
|
|
||||||
- uses: git-clone
|
|
||||||
config:
|
|
||||||
repoURL: ${{ vars.gitopsRepo }}
|
|
||||||
checkout:
|
|
||||||
- branch: main
|
|
||||||
path: ./src
|
|
||||||
- branch: ${{ vars.targetBranch }}
|
|
||||||
create: true
|
|
||||||
path: ./out
|
|
||||||
- uses: git-clear
|
|
||||||
config:
|
|
||||||
path: ./out
|
|
||||||
- uses: copy
|
|
||||||
config:
|
|
||||||
inPath: ./src/test-env
|
|
||||||
outPath: ./out/test-env
|
|
||||||
- uses: git-commit
|
|
||||||
as: commit
|
|
||||||
config:
|
|
||||||
path: ./out
|
|
||||||
message: "promote(test-env/${{ ctx.stage }}): freight ${{ ctx.targetFreight.name }}"
|
|
||||||
- uses: git-push
|
|
||||||
config:
|
|
||||||
path: ./out
|
|
||||||
targetBranch: ${{ vars.targetBranch }}
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
apiVersion: kargo.akuity.io/v1alpha1
|
|
||||||
kind: Warehouse
|
|
||||||
metadata:
|
|
||||||
name: test-env-images
|
|
||||||
namespace: test-env
|
|
||||||
spec:
|
|
||||||
subscriptions: []
|
|
||||||
# TODO: Add container image subscriptions for test services
|
|
||||||
Reference in New Issue
Block a user