diff --git a/gitops-catalog/cert-manager/Chart.yaml b/gitops-catalog/cert-manager/Chart.yaml new file mode 100644 index 0000000..fa03a85 --- /dev/null +++ b/gitops-catalog/cert-manager/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: cert-manager +description: A Helm chart for deploying cert-manager with ArgoCD for automated TLS certificate management using ACME, self-signed, and other issuers +type: application +version: 0.1.0 +appVersion: "1.17.1" diff --git a/gitops-catalog/cert-manager/templates/application.yaml b/gitops-catalog/cert-manager/templates/application.yaml new file mode 100644 index 0000000..5c8f06a --- /dev/null +++ b/gitops-catalog/cert-manager/templates/application.yaml @@ -0,0 +1,36 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-cert-manager + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: cert-manager + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + chart: cert-manager + repoURL: https://charts.jetstack.io + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: cert-manager + values: | + crds: + enabled: {{ .Values.installCRDs }} + replicaCount: {{ .Values.replicas }} + prometheus: + servicemonitor: + enabled: {{ .Values.serviceMonitorEnabled }} + startupapicheck: + enabled: {{ .Values.startupapicheck }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/cert-manager/values.yaml b/gitops-catalog/cert-manager/values.yaml new file mode 100644 index 0000000..9d57b06 --- /dev/null +++ b/gitops-catalog/cert-manager/values.yaml @@ -0,0 +1,75 @@ +# cert-manager Configuration +# This values file contains all configurable parameters for deploying cert-manager via ArgoCD + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for cert-manager deployment +# @input.required: true +# @input.default: cert-manager +namespace: cert-manager + +# @input.type: string +# @input.description: cert-manager Helm chart version +# @input.required: true +# @input.default: v1.17.1 +chartVersion: v1.17.1 + +# ============================================================================= +# CERT-MANAGER CONFIGURATION +# ============================================================================= + +# @input.type: enum +# @input.description: Install cert-manager CRDs (required for first install, disable if CRDs are managed separately) +# @input.options: true,false +# @input.required: true +# @input.default: true +installCRDs: true + +# @input.type: number +# @input.description: Number of cert-manager controller replicas +# @input.required: true +# @input.default: 1 +replicas: 1 + +# @input.type: enum +# @input.description: Enable Prometheus ServiceMonitor for cert-manager metrics +# @input.options: true,false +# @input.required: true +# @input.default: false +serviceMonitorEnabled: false + +# @input.type: enum +# @input.description: Enable the cert-manager Startupapicheck job to verify API availability +# @input.options: true,false +# @input.required: true +# @input.default: true +startupapicheck: true diff --git a/gitops-catalog/envoy-gateway/Chart.yaml b/gitops-catalog/envoy-gateway/Chart.yaml new file mode 100644 index 0000000..1ceefa3 --- /dev/null +++ b/gitops-catalog/envoy-gateway/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: envoy-gateway +description: A Helm chart for deploying Envoy Gateway with ArgoCD as a Kubernetes-native API gateway for managing ingress and traffic routing +type: application +version: 0.1.0 +appVersion: "1.3.0" diff --git a/gitops-catalog/envoy-gateway/templates/application.yaml b/gitops-catalog/envoy-gateway/templates/application.yaml new file mode 100644 index 0000000..db33a27 --- /dev/null +++ b/gitops-catalog/envoy-gateway/templates/application.yaml @@ -0,0 +1,36 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-envoy-gateway + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: envoy-gateway + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + chart: gateway-helm + repoURL: https://gateway.envoyproxy.io/charts + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: envoy-gateway + values: | + deployment: + replicas: {{ .Values.replicas }} + config: + envoyGateway: + provider: + kubernetes: + enabled: {{ .Values.kubernetesProviderEnabled }} + createGatewayClass: {{ .Values.gatewayClassEnabled }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/envoy-gateway/values.yaml b/gitops-catalog/envoy-gateway/values.yaml new file mode 100644 index 0000000..e3d37d3 --- /dev/null +++ b/gitops-catalog/envoy-gateway/values.yaml @@ -0,0 +1,68 @@ +# Envoy Gateway Configuration +# This values file contains all configurable parameters for deploying Envoy Gateway via ArgoCD + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for Envoy Gateway deployment +# @input.required: true +# @input.default: envoy-gateway-system +namespace: envoy-gateway-system + +# @input.type: string +# @input.description: Envoy Gateway Helm chart version +# @input.required: true +# @input.default: v1.3.0 +chartVersion: v1.3.0 + +# ============================================================================= +# ENVOY GATEWAY CONFIGURATION +# ============================================================================= + +# @input.type: number +# @input.description: Number of Envoy Gateway controller replicas +# @input.required: true +# @input.default: 1 +replicas: 1 + +# @input.type: enum +# @input.description: Enable Kubernetes provider for gateway management +# @input.options: true,false +# @input.required: true +# @input.default: true +kubernetesProviderEnabled: true + +# @input.type: enum +# @input.description: Install GatewayClass resource for Envoy Gateway +# @input.options: true,false +# @input.required: true +# @input.default: true +gatewayClassEnabled: true diff --git a/gitops-catalog/external-dns/Chart.yaml b/gitops-catalog/external-dns/Chart.yaml new file mode 100644 index 0000000..7e99548 --- /dev/null +++ b/gitops-catalog/external-dns/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: external-dns +description: A Helm chart for deploying ExternalDNS with ArgoCD to automatically manage DNS records from Kubernetes resources +type: application +version: 0.1.0 +appVersion: "1.15.1" diff --git a/gitops-catalog/external-dns/templates/application.yaml b/gitops-catalog/external-dns/templates/application.yaml new file mode 100644 index 0000000..18d063d --- /dev/null +++ b/gitops-catalog/external-dns/templates/application.yaml @@ -0,0 +1,36 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-external-dns + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: external-dns + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + chart: external-dns + repoURL: https://kubernetes-sigs.github.io/external-dns/ + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: external-dns + values: | + provider: + name: {{ .Values.provider }} + domainFilters: + - {{ .Values.domainFilters }} + policy: {{ .Values.policy }} + sources: + - {{ .Values.sources }} + txtOwnerId: {{ .Values.txtOwnerId }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/external-dns/values.yaml b/gitops-catalog/external-dns/values.yaml new file mode 100644 index 0000000..2adb215 --- /dev/null +++ b/gitops-catalog/external-dns/values.yaml @@ -0,0 +1,81 @@ +# ExternalDNS Configuration +# This values file contains all configurable parameters for deploying ExternalDNS via ArgoCD + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for ExternalDNS deployment +# @input.required: true +# @input.default: external-dns +namespace: external-dns + +# @input.type: string +# @input.description: ExternalDNS Helm chart version +# @input.required: true +# @input.default: 1.15.1 +chartVersion: 1.15.1 + +# ============================================================================= +# EXTERNAL DNS CONFIGURATION +# ============================================================================= + +# @input.type: enum +# @input.description: DNS provider (e.g., aws, cloudflare, google, azure, civo) +# @input.options: aws,cloudflare,google,azure,civo,digitalocean,rfc2136 +# @input.required: true +# @input.default: aws +provider: aws + +# @input.type: string +# @input.description: Comma-separated list of DNS zones to manage +# @input.required: true +# @input.default: example.com +domainFilters: example.com + +# @input.type: enum +# @input.description: DNS record ownership policy (sync deletes unmanaged records, upsert-only is safer) +# @input.options: sync,upsert-only +# @input.required: true +# @input.default: upsert-only +policy: upsert-only + +# @input.type: enum +# @input.description: Kubernetes resource types to watch for DNS records +# @input.options: ingress,service,istio-gateway,istio-virtualservice +# @input.required: true +# @input.default: ingress +sources: ingress + +# @input.type: string +# @input.description: TXT record owner ID to avoid conflicts between multiple ExternalDNS instances +# @input.required: true +# @input.default: default +txtOwnerId: default diff --git a/gitops-catalog/external-secrets/Chart.yaml b/gitops-catalog/external-secrets/Chart.yaml new file mode 100644 index 0000000..79a36f5 --- /dev/null +++ b/gitops-catalog/external-secrets/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: external-secrets +description: A Helm chart for deploying External Secrets Operator with ArgoCD to sync secrets from external providers like AWS, Vault, and GCP into Kubernetes +type: application +version: 0.1.0 +appVersion: "0.14.3" diff --git a/gitops-catalog/external-secrets/templates/application.yaml b/gitops-catalog/external-secrets/templates/application.yaml new file mode 100644 index 0000000..e673510 --- /dev/null +++ b/gitops-catalog/external-secrets/templates/application.yaml @@ -0,0 +1,36 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-external-secrets + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: external-secrets + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + chart: external-secrets + repoURL: https://charts.external-secrets.io + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: external-secrets + values: | + installCRDs: {{ .Values.installCRDs }} + replicaCount: {{ .Values.replicas }} + webhook: + create: {{ .Values.webhookEnabled }} + certController: + create: {{ .Values.certControllerEnabled }} + serviceMonitor: + enabled: {{ .Values.serviceMonitorEnabled }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/external-secrets/values.yaml b/gitops-catalog/external-secrets/values.yaml new file mode 100644 index 0000000..ce77eb4 --- /dev/null +++ b/gitops-catalog/external-secrets/values.yaml @@ -0,0 +1,82 @@ +# External Secrets Operator Configuration +# This values file contains all configurable parameters for deploying External Secrets Operator via ArgoCD + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for External Secrets Operator deployment +# @input.required: true +# @input.default: external-secrets +namespace: external-secrets + +# @input.type: string +# @input.description: External Secrets Operator Helm chart version +# @input.required: true +# @input.default: 0.14.3 +chartVersion: 0.14.3 + +# ============================================================================= +# EXTERNAL SECRETS CONFIGURATION +# ============================================================================= + +# @input.type: enum +# @input.description: Install External Secrets CRDs +# @input.options: true,false +# @input.required: true +# @input.default: true +installCRDs: true + +# @input.type: number +# @input.description: Number of operator replicas +# @input.required: true +# @input.default: 1 +replicas: 1 + +# @input.type: enum +# @input.description: Enable the webhook for validating ExternalSecret resources +# @input.options: true,false +# @input.required: true +# @input.default: true +webhookEnabled: true + +# @input.type: enum +# @input.description: Enable the cert-controller for managing webhook certificates +# @input.options: true,false +# @input.required: true +# @input.default: true +certControllerEnabled: true + +# @input.type: enum +# @input.description: Enable ServiceMonitor for Prometheus metrics collection +# @input.options: true,false +# @input.required: true +# @input.default: false +serviceMonitorEnabled: false diff --git a/gitops-catalog/gpu-operator-base/Chart.yaml b/gitops-catalog/gpu-operator-base/Chart.yaml new file mode 100644 index 0000000..be2e1d9 --- /dev/null +++ b/gitops-catalog/gpu-operator-base/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: gpu-operator-base +description: A Helm chart for deploying NVIDIA GPU Operator with ArgoCD for GPU workload support on Kubernetes +type: application +version: 0.1.0 +appVersion: "24.9.2" diff --git a/gitops-catalog/gpu-operator-base/templates/application.yaml b/gitops-catalog/gpu-operator-base/templates/application.yaml new file mode 100644 index 0000000..004d0d8 --- /dev/null +++ b/gitops-catalog/gpu-operator-base/templates/application.yaml @@ -0,0 +1,41 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-gpu-operator + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: gpu-operator-base + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + chart: gpu-operator + repoURL: https://helm.ngc.nvidia.com/nvidia + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: gpu-operator + values: | + driver: + enabled: {{ .Values.driverEnabled }} + toolkit: + enabled: {{ .Values.toolkitEnabled }} + devicePlugin: + enabled: {{ .Values.devicePluginEnabled }} + gfd: + enabled: {{ .Values.gfdEnabled }} + operator: + defaultRuntime: "{{ .Values.defaultRuntime }}" + validator: + cuda: + runtimeClassName: "{{ .Values.cudaRuntimeClassName }}" + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/gpu-operator-base/values.yaml b/gitops-catalog/gpu-operator-base/values.yaml new file mode 100644 index 0000000..d44451b --- /dev/null +++ b/gitops-catalog/gpu-operator-base/values.yaml @@ -0,0 +1,88 @@ +# NVIDIA GPU Operator Base Configuration +# This values file contains all configurable parameters for deploying NVIDIA GPU Operator via ArgoCD + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for GPU Operator deployment +# @input.required: true +# @input.default: gpu-operator +namespace: gpu-operator + +# @input.type: string +# @input.description: NVIDIA GPU Operator Helm chart version +# @input.required: true +# @input.default: 24.9.2 +chartVersion: 24.9.2 + +# ============================================================================= +# GPU OPERATOR CONFIGURATION +# ============================================================================= + +# @input.type: enum +# @input.description: Enable NVIDIA driver installation on nodes +# @input.options: true,false +# @input.required: true +# @input.default: true +driverEnabled: true + +# @input.type: enum +# @input.description: Enable NVIDIA container toolkit +# @input.options: true,false +# @input.required: true +# @input.default: false +toolkitEnabled: false + +# @input.type: enum +# @input.description: Enable NVIDIA device plugin for GPU scheduling +# @input.options: true,false +# @input.required: true +# @input.default: true +devicePluginEnabled: true + +# @input.type: enum +# @input.description: Enable GPU Feature Discovery for node labeling +# @input.options: true,false +# @input.required: true +# @input.default: true +gfdEnabled: true + +# @input.type: string +# @input.description: Default container runtime for the operator +# @input.required: true +# @input.default: containerd +defaultRuntime: containerd + +# @input.type: string +# @input.description: RuntimeClassName for CUDA validation +# @input.required: true +# @input.default: nvidia +cudaRuntimeClassName: nvidia diff --git a/gitops-catalog/grafana/Chart.yaml b/gitops-catalog/grafana/Chart.yaml new file mode 100644 index 0000000..ee37f19 --- /dev/null +++ b/gitops-catalog/grafana/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: grafana +description: A Helm chart for deploying standalone Grafana with ArgoCD for metrics visualization, dashboards, and alerting +type: application +version: 0.1.0 +appVersion: "8.12.1" diff --git a/gitops-catalog/grafana/templates/application.yaml b/gitops-catalog/grafana/templates/application.yaml new file mode 100644 index 0000000..57ee5ec --- /dev/null +++ b/gitops-catalog/grafana/templates/application.yaml @@ -0,0 +1,39 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-grafana + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: grafana + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + chart: grafana + repoURL: https://grafana.github.io/helm-charts + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: grafana + values: | + replicas: {{ .Values.replicas }} + persistence: + enabled: {{ .Values.persistenceEnabled }} + size: {{ .Values.persistenceSize }} + ingress: + enabled: {{ .Values.ingressEnabled }} + sidecar: + dashboards: + enabled: {{ .Values.sidecarDashboardsEnabled }} + datasources: + enabled: {{ .Values.sidecarDatasourcesEnabled }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/grafana/values.yaml b/gitops-catalog/grafana/values.yaml new file mode 100644 index 0000000..0de6218 --- /dev/null +++ b/gitops-catalog/grafana/values.yaml @@ -0,0 +1,88 @@ +# Grafana Configuration +# This values file contains all configurable parameters for deploying standalone Grafana via ArgoCD + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for Grafana deployment +# @input.required: true +# @input.default: observability +namespace: observability + +# @input.type: string +# @input.description: Grafana Helm chart version +# @input.required: true +# @input.default: 8.12.1 +chartVersion: 8.12.1 + +# ============================================================================= +# GRAFANA CONFIGURATION +# ============================================================================= + +# @input.type: number +# @input.description: Number of Grafana replicas +# @input.required: true +# @input.default: 1 +replicas: 1 + +# @input.type: enum +# @input.description: Enable persistent storage for Grafana dashboards and data +# @input.options: true,false +# @input.required: true +# @input.default: true +persistenceEnabled: true + +# @input.type: string +# @input.description: Storage size for Grafana persistent volume +# @input.required: true +# @input.default: 10Gi +persistenceSize: 10Gi + +# @input.type: enum +# @input.description: Enable Grafana Ingress +# @input.options: true,false +# @input.required: true +# @input.default: false +ingressEnabled: false + +# @input.type: enum +# @input.description: Enable sidecar for automatic dashboard provisioning from ConfigMaps +# @input.options: true,false +# @input.required: true +# @input.default: true +sidecarDashboardsEnabled: true + +# @input.type: enum +# @input.description: Enable sidecar for automatic datasource provisioning from ConfigMaps +# @input.options: true,false +# @input.required: true +# @input.default: true +sidecarDatasourcesEnabled: true diff --git a/gitops-catalog/groundcover/Chart.yaml b/gitops-catalog/groundcover/Chart.yaml new file mode 100644 index 0000000..1929491 --- /dev/null +++ b/gitops-catalog/groundcover/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: groundcover +description: A Helm chart for deploying groundcover eBPF-based observability platform with ArgoCD for zero-instrumentation APM, metrics, logs, and traces +type: application +version: 0.1.0 +appVersion: "1.0.0" diff --git a/gitops-catalog/groundcover/templates/application.yaml b/gitops-catalog/groundcover/templates/application.yaml new file mode 100644 index 0000000..9614e70 --- /dev/null +++ b/gitops-catalog/groundcover/templates/application.yaml @@ -0,0 +1,57 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-groundcover + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: groundcover + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + chart: groundcover + repoURL: https://helm.groundcover.com/ + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: groundcover + values: | + global: + groundcover_token: {{ .Values.apiKey }} + cluster: + name: {{ .Values.clusterDisplayName }} + agent: + logs: + enabled: {{ .Values.logsEnabled }} + traces: + enabled: {{ .Values.tracesEnabled }} + rbac: + pspEnabled: {{ .Values.pspEnabled }} + groundcover: + rbac: + pspEnabled: {{ .Values.pspEnabled }} + victoria-metrics-single: + rbac: + pspEnabled: {{ .Values.pspEnabled }} + victoria-metrics-agent: + rbac: + pspEnabled: {{ .Values.pspEnabled }} + loki: + rbac: + pspEnabled: {{ .Values.pspEnabled }} + promscale: + rbac: + pspEnabled: {{ .Values.pspEnabled }} + timescaledb-single: + rbac: + pspEnabled: {{ .Values.pspEnabled }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/groundcover/values.yaml b/gitops-catalog/groundcover/values.yaml new file mode 100644 index 0000000..900dcd3 --- /dev/null +++ b/gitops-catalog/groundcover/values.yaml @@ -0,0 +1,82 @@ +# Groundcover Observability Platform Configuration +# This values file contains all configurable parameters for deploying groundcover via ArgoCD + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for groundcover deployment +# @input.required: true +# @input.default: groundcover +namespace: groundcover + +# @input.type: string +# @input.description: groundcover Helm chart version +# @input.required: true +# @input.default: 0.36.3 +chartVersion: 0.36.3 + +# ============================================================================= +# GROUNDCOVER CONFIGURATION +# ============================================================================= + +# @input.type: string +# @input.description: groundcover API key for authentication +# @input.required: true +# @input.default: "" +apiKey: "" + +# @input.type: string +# @input.description: Cluster display name shown in groundcover dashboard +# @input.required: true +# @input.default: my-cluster +clusterDisplayName: my-cluster + +# @input.type: enum +# @input.description: Enable log collection +# @input.options: true,false +# @input.required: true +# @input.default: true +logsEnabled: true + +# @input.type: enum +# @input.description: Enable distributed tracing +# @input.options: true,false +# @input.required: true +# @input.default: true +tracesEnabled: true + +# @input.type: enum +# @input.description: Enable PodSecurityPolicy resources (disable for Kubernetes 1.25+ where PSP is removed) +# @input.options: true,false +# @input.required: true +# @input.default: false +# @input.tip: PSP was removed in Kubernetes 1.25. Set to false for modern clusters. +pspEnabled: false diff --git a/gitops-catalog/metrics-server/Chart.yaml b/gitops-catalog/metrics-server/Chart.yaml new file mode 100644 index 0000000..ca3ee82 --- /dev/null +++ b/gitops-catalog/metrics-server/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: metrics-server +description: A Helm chart for deploying Kubernetes Metrics Server with ArgoCD for cluster resource metrics (CPU/memory) used by HPA and kubectl top +type: application +version: 0.1.0 +appVersion: "0.8.0" diff --git a/gitops-catalog/metrics-server/templates/application.yaml b/gitops-catalog/metrics-server/templates/application.yaml new file mode 100644 index 0000000..45e984e --- /dev/null +++ b/gitops-catalog/metrics-server/templates/application.yaml @@ -0,0 +1,41 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-metrics-server + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: metrics-server + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + chart: metrics-server + repoURL: https://kubernetes-sigs.github.io/metrics-server/ + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: metrics-server + values: | + replicas: {{ .Values.replicas }} + hostNetwork: + enabled: {{ .Values.hostNetwork }} + args: + - --kubelet-preferred-address-types={{ .Values.kubeletPreferredAddressType }} + - --metric-resolution={{ .Values.metricResolution }} + {{- if .Values.kubeletInsecureTls }} + - --kubelet-insecure-tls + {{- end }} + podDisruptionBudget: + enabled: {{ .Values.pdbEnabled }} + serviceMonitor: + enabled: {{ .Values.serviceMonitorEnabled }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/metrics-server/values.yaml b/gitops-catalog/metrics-server/values.yaml new file mode 100644 index 0000000..3cf42c9 --- /dev/null +++ b/gitops-catalog/metrics-server/values.yaml @@ -0,0 +1,94 @@ +# Kubernetes Metrics Server Configuration +# This values file contains all configurable parameters for deploying Metrics Server via ArgoCD + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for Metrics Server deployment +# @input.required: true +# @input.default: kube-system +namespace: kube-system + +# @input.type: string +# @input.description: Metrics Server Helm chart version +# @input.required: true +# @input.default: 3.12.2 +chartVersion: 3.12.2 + +# ============================================================================= +# METRICS SERVER CONFIGURATION +# ============================================================================= + +# @input.type: number +# @input.description: Number of Metrics Server replicas (use 2+ for HA on multi-node clusters) +# @input.required: true +# @input.default: 1 +replicas: 1 + +# @input.type: enum +# @input.description: Skip kubelet TLS verification (required on clusters with self-signed kubelet certs, e.g. kubeadm/kind/Civo) +# @input.options: true,false +# @input.required: true +# @input.default: true +kubeletInsecureTls: true + +# @input.type: string +# @input.description: Preferred kubelet address type for metric scraping +# @input.required: true +# @input.default: InternalIP +kubeletPreferredAddressType: InternalIP + +# @input.type: string +# @input.description: Metric resolution interval (how often metrics are scraped) +# @input.required: true +# @input.default: 15s +metricResolution: 15s + +# @input.type: enum +# @input.description: Enable host network (set to true for clusters using CNI plugins that don't reach pods from the control plane, e.g. EKS with custom CNI) +# @input.options: true,false +# @input.required: true +# @input.default: false +hostNetwork: false + +# @input.type: enum +# @input.description: Create a PodDisruptionBudget for Metrics Server +# @input.options: true,false +# @input.required: true +# @input.default: false +pdbEnabled: false + +# @input.type: enum +# @input.description: Enable ServiceMonitor for Prometheus scraping (requires prometheus-operator CRDs) +# @input.options: true,false +# @input.required: true +# @input.default: false +serviceMonitorEnabled: false diff --git a/gitops-catalog/nvidia-nim-operator/Chart.yaml b/gitops-catalog/nvidia-nim-operator/Chart.yaml new file mode 100644 index 0000000..808f173 --- /dev/null +++ b/gitops-catalog/nvidia-nim-operator/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: nvidia-nim-operator +description: A Helm chart for deploying NVIDIA NIM Operator with ArgoCD for GPU-accelerated inference microservices +type: application +version: 0.1.0 +appVersion: "3.0.2" diff --git a/gitops-catalog/nvidia-nim-operator/templates/application.yaml b/gitops-catalog/nvidia-nim-operator/templates/application.yaml new file mode 100644 index 0000000..b7c90da --- /dev/null +++ b/gitops-catalog/nvidia-nim-operator/templates/application.yaml @@ -0,0 +1,38 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-nim-operator + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: nvidia-nim-operator + kubefirst.konstruct.io/source: catalog-templates + argocd.argoproj.io/sync-wave: '50' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + repoURL: https://helm.ngc.nvidia.com/nvidia + chart: k8s-nim-operator + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: nim-operator + values: | + operator: + upgradeCRD: false + image: + repository: nvcr.io/nvidia/cloud-native/k8s-nim-operator + admissionController: + enabled: {{ .Values.admissionControllerEnabled }} + certManager: + enabled: {{ .Values.certManagerEnabled }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/gitops-catalog/nvidia-nim-operator/values.yaml b/gitops-catalog/nvidia-nim-operator/values.yaml new file mode 100644 index 0000000..dcac604 --- /dev/null +++ b/gitops-catalog/nvidia-nim-operator/values.yaml @@ -0,0 +1,77 @@ +# NVIDIA NIM Operator Configuration +# This values file contains all configurable parameters for deploying +# NVIDIA NIM Operator via ArgoCD. NIM enables deployment and management +# of GPU-accelerated inference microservices. + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: civo-gpu +clusterName: civo-gpu + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/civonetes/demo-organization-gitops.git +gitopsRepoUrl: https://github.com/civonetes/demo-organization-gitops.git + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/civo-gpu +registryPath: registry/clusters/civo-gpu + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: civo-gpu +clusterDestination: civo-gpu + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: civo-gpu +project: civo-gpu + +# @input.type: string +# @input.description: Namespace for NIM Operator deployment +# @input.required: true +# @input.default: nim-operator +namespace: nim-operator + +# @input.type: string +# @input.description: NVIDIA NIM Operator Helm chart version +# @input.required: true +# @input.default: 3.0.2 +chartVersion: 3.0.2 + +# ============================================================================= +# NIM OPERATOR CONFIGURATION +# ============================================================================= + +# @input.type: enum +# @input.description: Enable the NIM admission controller webhook +# @input.options: true,false +# @input.required: true +# @input.default: true +admissionControllerEnabled: true + +# @input.type: enum +# @input.description: Enable cert-manager integration for webhook TLS +# @input.options: true,false +# @input.required: true +# @input.default: true +certManagerEnabled: true + +# ============================================================================= +# NGC CREDENTIALS - Required to pull NIM container images +# ============================================================================= + +# @input.type: secret +# @input.description: NVIDIA NGC API key for pulling NIM container images (get from ngc.nvidia.com) +# @input.required: true +# @input.secretKey: ngc-api-key +# @input.secretEnv: NGC_API_KEY +# @input.secretBackend: vault +# @input.secretPath: /nvidia-nim +ngcApiKey: "" diff --git a/gitops-catalog/ollama-openwebui/Chart.yaml b/gitops-catalog/ollama-openwebui/Chart.yaml new file mode 100644 index 0000000..7905b06 --- /dev/null +++ b/gitops-catalog/ollama-openwebui/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: ollama-openwebui +description: A Helm chart for deploying Ollama + Open WebUI with ArgoCD for running and interacting with local LLMs on Kubernetes (GPU-enabled by default via the CUDA image) +type: application +version: 0.1.0 +appVersion: "0.8.12" diff --git a/gitops-catalog/ollama-openwebui/templates/application.yaml b/gitops-catalog/ollama-openwebui/templates/application.yaml new file mode 100644 index 0000000..e7da425 --- /dev/null +++ b/gitops-catalog/ollama-openwebui/templates/application.yaml @@ -0,0 +1,57 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-openwebui + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: ollama-openwebui + kubefirst.konstruct.io/source: catalog-templates + argocd.argoproj.io/sync-wave: '50' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + repoURL: https://helm.openwebui.com/ + chart: open-webui + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: open-webui + values: | + image: + repository: {{ .Values.imageRepository }} + tag: "{{ .Values.imageTag }}" + serviceAccount: + create: true + name: openwebui-sa + ollama: + enabled: {{ .Values.ollamaEnabled }} + {{- if .Values.gpuEnabled }} + extraArgs: + - "--gpus all" + extraHosts: + - "host.docker.internal:host-gateway" + {{- end }} + persistentVolume: + enabled: true + size: {{ .Values.persistentVolumeSize }} + ingress: + enabled: {{ .Values.ingressEnabled }} + class: "{{ .Values.ingressClassName }}" + annotations: + nginx.ingress.kubernetes.io/force-ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" + cert-manager.io/cluster-issuer: "{{ .Values.clusterIssuer }}" + host: "ollama.{{ .Values.domainName }}" + tls: true + existingSecret: "{{ .Values.clusterName }}-{{ .Values.tlsSecretName }}" + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/gitops-catalog/ollama-openwebui/values.yaml b/gitops-catalog/ollama-openwebui/values.yaml new file mode 100644 index 0000000..3a99c69 --- /dev/null +++ b/gitops-catalog/ollama-openwebui/values.yaml @@ -0,0 +1,118 @@ +# Ollama + Open WebUI Configuration +# This values file contains all configurable parameters for deploying +# Ollama + Open WebUI via ArgoCD. The Open WebUI Helm chart bundles +# Ollama as an optional subchart - toggle with `ollamaEnabled`. + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: gg-gpu + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: gg-gpu + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: gg-gpu + +# @input.type: string +# @input.description: Namespace for Open WebUI and Ollama deployment +# @input.required: true +# @input.default: openwebui +namespace: openwebui + +# @input.type: string +# @input.description: Open WebUI Helm chart version (from https://helm.openwebui.com) +# @input.required: true +# @input.default: 6.38.0 +chartVersion: 3.1.19 + +# ============================================================================= +# OPEN WEBUI CONFIGURATION +# ============================================================================= + +# @input.type: string +# @input.description: Open WebUI container image repository +# @input.required: true +# @input.default: ghcr.io/open-webui/open-webui +imageRepository: ghcr.io/open-webui/open-webui + +# @input.type: enum +# @input.description: Image tag - "cuda" for NVIDIA GPU support, "main" for CPU-only +# @input.options: cuda,main,ollama +# @input.required: true +# @input.default: cuda +imageTag: cuda + +# @input.type: enum +# @input.description: Enable Ollama as a bundled subchart (runs alongside Open WebUI in the same namespace) +# @input.options: true,false +# @input.required: true +# @input.default: true +ollamaEnabled: true + +# @input.type: enum +# @input.description: Enable NVIDIA GPU access for the Open WebUI pod (requires NVIDIA GPU Operator installed on the cluster) +# @input.options: true,false +# @input.required: true +# @input.default: true +gpuEnabled: true + +# @input.type: string +# @input.description: Persistent volume size for model and conversation storage +# @input.required: true +# @input.default: 50Gi +persistentVolumeSize: 50Gi + +# ============================================================================= +# INGRESS CONFIGURATION +# ============================================================================= + +# @input.type: enum +# @input.description: Expose Open WebUI via an Ingress +# @input.options: true,false +# @input.required: true +# @input.default: false +ingressEnabled: false + +# @input.type: string +# @input.description: Base domain name for the Ingress host (final host is "ollama.") +# @input.required: true +# @input.default: example.com +domainName: example.com + +# @input.type: string +# @input.description: Ingress class name (controller that will serve the route) +# @input.required: true +# @input.default: nginx +ingressClassName: nginx + +# @input.type: string +# @input.description: cert-manager ClusterIssuer used to provision the TLS certificate +# @input.required: true +# @input.default: letsencrypt-prod +clusterIssuer: letsencrypt-prod + +# @input.type: string +# @input.description: Secret name that will hold the TLS certificate +# @input.required: true +# @input.default: ollama-http-ingress +tlsSecretName: ollama-http-ingress diff --git a/gitops-catalog/prometheus/Chart.yaml b/gitops-catalog/prometheus/Chart.yaml new file mode 100644 index 0000000..2081532 --- /dev/null +++ b/gitops-catalog/prometheus/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: prometheus +description: A Helm chart for deploying kube-prometheus-stack with ArgoCD for full-stack Kubernetes monitoring with Prometheus, Alertmanager, and Grafana dashboards +type: application +version: 0.1.0 +appVersion: "69.8.0" diff --git a/gitops-catalog/prometheus/templates/application.yaml b/gitops-catalog/prometheus/templates/application.yaml new file mode 100644 index 0000000..d025f8c --- /dev/null +++ b/gitops-catalog/prometheus/templates/application.yaml @@ -0,0 +1,46 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-prometheus + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: prometheus + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + chart: kube-prometheus-stack + repoURL: https://prometheus-community.github.io/helm-charts + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: kube-prometheus-stack + values: | + grafana: + enabled: {{ .Values.grafanaEnabled }} + alertmanager: + enabled: {{ .Values.alertmanagerEnabled }} + prometheus: + prometheusSpec: + retention: {{ .Values.retention }} + storageSpec: + volumeClaimTemplate: + spec: + resources: + requests: + storage: {{ .Values.storageSize }} + nodeExporter: + enabled: {{ .Values.nodeExporterEnabled }} + kubeStateMetrics: + enabled: {{ .Values.kubeStateMetricsEnabled }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/gitops-catalog/prometheus/values.yaml b/gitops-catalog/prometheus/values.yaml new file mode 100644 index 0000000..dd0ab9b --- /dev/null +++ b/gitops-catalog/prometheus/values.yaml @@ -0,0 +1,88 @@ +# kube-prometheus-stack Configuration +# This values file contains all configurable parameters for deploying kube-prometheus-stack via ArgoCD + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for Prometheus stack deployment +# @input.required: true +# @input.default: observability +namespace: observability + +# @input.type: string +# @input.description: kube-prometheus-stack Helm chart version +# @input.required: true +# @input.default: 69.8.0 +chartVersion: 69.8.0 + +# ============================================================================= +# PROMETHEUS STACK CONFIGURATION +# ============================================================================= + +# @input.type: enum +# @input.description: Enable bundled Grafana deployment (disable if using standalone Grafana) +# @input.options: true,false +# @input.required: true +# @input.default: true +grafanaEnabled: true + +# @input.type: enum +# @input.description: Enable Alertmanager for alert routing and notification +# @input.options: true,false +# @input.required: true +# @input.default: true +alertmanagerEnabled: true + +# @input.type: string +# @input.description: Prometheus data retention period +# @input.required: true +# @input.default: 15d +retention: 15d + +# @input.type: string +# @input.description: Storage size for Prometheus data (PVC) +# @input.required: true +# @input.default: 50Gi +storageSize: 50Gi + +# @input.type: enum +# @input.description: Enable Node Exporter for host-level metrics +# @input.options: true,false +# @input.required: true +# @input.default: true +nodeExporterEnabled: true + +# @input.type: enum +# @input.description: Enable kube-state-metrics for Kubernetes object metrics +# @input.options: true,false +# @input.required: true +# @input.default: true +kubeStateMetricsEnabled: true diff --git a/gitops-catalog/reloader/Chart.yaml b/gitops-catalog/reloader/Chart.yaml new file mode 100644 index 0000000..adeba65 --- /dev/null +++ b/gitops-catalog/reloader/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: reloader +description: A Helm chart for deploying Stakater Reloader with ArgoCD to automatically restart pods when ConfigMaps or Secrets are updated +type: application +version: 0.1.0 +appVersion: "1.2.1" diff --git a/gitops-catalog/reloader/templates/application.yaml b/gitops-catalog/reloader/templates/application.yaml new file mode 100644 index 0000000..c176da4 --- /dev/null +++ b/gitops-catalog/reloader/templates/application.yaml @@ -0,0 +1,38 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-reloader + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: reloader + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + chart: reloader + repoURL: https://stakater.github.io/stakater-charts + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: reloader + values: | + reloader: + watchGlobally: true + ignoreConfigMaps: {{ not .Values.watchConfigMaps }} + ignoreSecrets: {{ not .Values.watchSecrets }} + isArgoRollouts: false + deployment: + env: + open: + IGNORE_CONFIGMAPS_WITHOUT_ANNOTATION: "{{ .Values.ignoreConfigMapsWithoutAnnotation }}" + IGNORE_SECRETS_WITHOUT_ANNOTATION: "{{ .Values.ignoreSecretsWithoutAnnotation }}" + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/reloader/values.yaml b/gitops-catalog/reloader/values.yaml new file mode 100644 index 0000000..7ec76ba --- /dev/null +++ b/gitops-catalog/reloader/values.yaml @@ -0,0 +1,76 @@ +# Stakater Reloader Configuration +# This values file contains all configurable parameters for deploying Reloader via ArgoCD + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for Reloader deployment +# @input.required: true +# @input.default: reloader +namespace: reloader + +# @input.type: string +# @input.description: Reloader Helm chart version +# @input.required: true +# @input.default: 1.2.1 +chartVersion: 1.2.1 + +# ============================================================================= +# RELOADER CONFIGURATION +# ============================================================================= + +# @input.type: enum +# @input.description: Watch ConfigMaps for changes and trigger rolling restarts +# @input.options: true,false +# @input.required: true +# @input.default: true +watchConfigMaps: true + +# @input.type: enum +# @input.description: Watch Secrets for changes and trigger rolling restarts +# @input.options: true,false +# @input.required: true +# @input.default: true +watchSecrets: true + +# @input.type: enum +# @input.description: Only watch resources with the reloader annotation (false = watch all resources) +# @input.options: true,false +# @input.required: true +# @input.default: false +ignoreConfigMapsWithoutAnnotation: false + +# @input.type: enum +# @input.description: Only watch secrets with the reloader annotation (false = watch all secrets) +# @input.options: true,false +# @input.required: true +# @input.default: false +ignoreSecretsWithoutAnnotation: false diff --git a/gitops-catalog/runai/Chart.yaml b/gitops-catalog/runai/Chart.yaml new file mode 100644 index 0000000..cd5a6aa --- /dev/null +++ b/gitops-catalog/runai/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: runai +description: A Helm chart for deploying Run.ai GPU orchestration platform with ArgoCD for GPU resource scheduling and management +type: application +version: 0.1.0 +appVersion: "2.16.79" diff --git a/gitops-catalog/runai/static/manifests/runai-cluster.yaml b/gitops-catalog/runai/static/manifests/runai-cluster.yaml new file mode 100644 index 0000000..8657fb6 --- /dev/null +++ b/gitops-catalog/runai/static/manifests/runai-cluster.yaml @@ -0,0 +1,7958 @@ +--- +# Source: runai-cluster/charts/runai-engine/templates/priorityclasses/critical-priority-class.yaml +apiVersion: scheduling.k8s.io/v1 +kind: PriorityClass +metadata: + name: runai-engine-critical +value: 1000000000 +--- +# Source: runai-cluster/templates/priorityclasses/build-priority-class.yaml +apiVersion: scheduling.k8s.io/v1 +kind: PriorityClass +metadata: + name: build + namespace: runai +value: 100 +--- +# Source: runai-cluster/templates/priorityclasses/critical-priority-class.yaml +apiVersion: scheduling.k8s.io/v1 +kind: PriorityClass +metadata: + name: runai-critical + namespace: runai +value: 1000000000 +--- +# Source: runai-cluster/templates/priorityclasses/inference-priority-class.yaml +apiVersion: scheduling.k8s.io/v1 +kind: PriorityClass +metadata: + name: inference + namespace: runai +value: 125 +--- +# Source: runai-cluster/templates/priorityclasses/interactive-preemptible-priority-class.yaml +apiVersion: scheduling.k8s.io/v1 +kind: PriorityClass +metadata: + name: interactive-preemptible + namespace: runai +value: 75 +--- +# Source: runai-cluster/templates/priorityclasses/train-critical-priority-class.yaml +apiVersion: scheduling.k8s.io/v1 +kind: PriorityClass +metadata: + name: train-critical + namespace: runai +value: 60 +--- +# Source: runai-cluster/templates/priorityclasses/train-high-priority-class.yaml +apiVersion: scheduling.k8s.io/v1 +kind: PriorityClass +metadata: + name: train-high + namespace: runai +value: 55 +--- +# Source: runai-cluster/templates/priorityclasses/train-priority-class.yaml +apiVersion: scheduling.k8s.io/v1 +kind: PriorityClass +metadata: + name: train + namespace: runai +value: 50 +--- +# Source: runai-cluster/charts/runai-engine/templates/operator/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: engine-operator + namespace: runai +--- +# Source: runai-cluster/charts/runai-engine/templates/resource-reservation-namespace.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: runai-reservation-engine + namespace: runai-reservation +--- +# Source: runai-cluster/templates/rbac.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: runai-operator + namespace: runai +--- +# Source: runai-cluster/charts/runai-engine/templates/operator/rbac/role.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-engine-operator +rules: +- apiGroups: + - "" + resources: + - configmaps + - secrets + - serviceaccounts + - services + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch +- apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - apps + resources: + - daemonsets + - deployments + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - engine.run.ai + resources: + - configs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - engine.run.ai + resources: + - configs/finalizers + verbs: + - update +- apiGroups: + - engine.run.ai + resources: + - configs/status + verbs: + - get + - patch + - update +- apiGroups: + - engine.run.ai + resources: + - schedulingshards + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - engine.run.ai + resources: + - schedulingshards/finalizers + verbs: + - update +- apiGroups: + - engine.run.ai + resources: + - schedulingshards/status + verbs: + - get + - patch + - update +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/binder-ro.yaml +# Run:AI Binder +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-binder-ro +rules: + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/binder.yaml +# A Kubernetes Pod Binder with Admission Webhook +# Responsible for the management of Job submission policies and the validation of the input provided to submit the Job +# This ClusterRole has no associated ClusterRoleBinding (only RoleBinding at the project level) +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-binder-project-engine +rules: + - apiGroups: + - "" + resources: + - configmaps + - pods/finalizers + verbs: + - create + - update + - apiGroups: + - apps + resources: + - statefulsets/finalizers + - deployments/finalizers + - replicasets/finalizers + verbs: + - create + - update + - apiGroups: + - batch + resources: + - jobs/finalizers + verbs: + - create + - update + - apiGroups: + - run.ai + resources: + - runaijobs/finalizers + verbs: + - create + - update + - apiGroups: + - kubeflow.org + resources: + - mpijobs/finalizers + - notebooks/finalizers + - pytorchjobs/finalizers + - tfjobs/finalizers + - xgboostjobs/finalizers + verbs: + - create + - update +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/pod-group-controller.yaml +# Run:AI Pod Grouper +# Responsible to watch pods in the cluster and group them to podgroups according to their job type +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: pod-group-controller +rules: + - apiGroups: + - "" + resources: + - pods + - nodes + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.k8s.io + resources: + - priorityclasses + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.run.ai + resources: + - podgroups + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.run.ai + resources: + - podgroups/status + verbs: + - get + - list + - watch + - update + - patch +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/pod-group-controller.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: pod-group-controller-ro +rules: + - apiGroups: + - "" + resources: + - pods + - nodes + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.k8s.io + resources: + - priorityclasses + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.run.ai + resources: + - podgroups + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.run.ai + resources: + - podgroups/status + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/pod-grouper.yaml +# Run:AI Pod Grouper +# Responsible to watch pods in the cluster and group them to podgroups according to their job type +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: pod-grouper-engine +rules: + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + - update + - patch + - create + - apiGroups: + - scheduling.run.ai + resources: + - podgroups + verbs: + - get + - list + - watch + - update + - patch + - create + - apiGroups: + - "" + resources: + - pods/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - apps + resources: + - replicasets + - deployments + - statefulsets + verbs: + - get + - list + - watch + - apiGroups: + - apps + resources: + - replicasets/finalizers + - deployments/finalizers + - statefulsets/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - batch + resources: + - jobs + - cronjobs + verbs: + - get + - list + - watch + - apiGroups: + - batch + resources: + - jobs/finalizers + - cronjobs/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - run.ai + resources: + - runaijobs + verbs: + - get + - list + - watch + - apiGroups: + - run.ai + resources: + - runaijobs/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - kubeflow.org + resources: + - mpijobs + - notebooks + - pytorchjobs + - tfjobs + - xgboostjobs + - scheduledworkflows + verbs: + - get + - list + - watch + - apiGroups: + - kubeflow.org + resources: + - mpijobs/finalizers + - notebooks/finalizers + - pytorchjobs/finalizers + - tfjobs/finalizers + - xgboostjobs/finalizers + - scheduledworkflows/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - machinelearning.seldon.io + resources: + - seldondeployments + verbs: + - get + - list + - watch + - apiGroups: + - machinelearning.seldon.io + resources: + - seldondeployments/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - serving.knative.dev + resources: + - revisions + - configurations + - services + verbs: + - get + - list + - watch + - apiGroups: + - serving.knative.dev + resources: + - revisions/finalizers + - configurations/finalizers + - services/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - kubevirt.io + resources: + - virtualmachines + - virtualmachineinstances + verbs: + - get + - list + - watch + - apiGroups: + - kubevirt.io + resources: + - virtualmachines/finalizers + - virtualmachineinstances/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - amlarc.azureml.com + resources: + - amljobs + verbs: + - get + - list + - watch + - apiGroups: + - amlarc.azureml.com + resources: + - amljobs/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - ray.io + resources: + - rayclusters + - rayjobs + - rayservices + verbs: + - get + - list + - watch + - apiGroups: + - ray.io + resources: + - rayclusters/finalizers + - rayjobs/finalizers + - rayservices/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - workspace.devfile.io + resources: + - devworkspaces + verbs: + - get + - list + - watch + - apiGroups: + - workspace.devfile.io + resources: + - devworkspaces/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - get + - list + - watch + - apiGroups: + - argoproj.io + resources: + - workflows/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - tekton.dev + resources: + - pipelineruns + - taskruns + verbs: + - get + - list + - watch + - apiGroups: + - tekton.dev + resources: + - pipelineruns/finalizers + - taskruns/finalizers + verbs: + - patch + - update + - create +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/queue-controller.yaml +# Run:AI Queue Controller +# Responsible to convert queue versions and update queue status based on other queues and podgroups +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: queue-controller-engine +rules: + - apiGroups: + - scheduling.run.ai + resources: + - podgroups + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.run.ai + resources: + - queues + verbs: + - get + - list + - patch + - update + - watch + - apiGroups: + - scheduling.run.ai + resources: + - queues/finalizers + verbs: + - update + - apiGroups: + - scheduling.run.ai + resources: + - queues/status + verbs: + - get + - patch + - update +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/scheduler.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-engine-scheduler-cluster-wide +rules: + - apiGroups: + - "" + resources: + - configmaps + - events + - persistentvolumeclaims + - pods + - pods/status + - pods/binding + - services + - persistentvolumes + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.run.ai + resources: + - podgroups + - podgroups/status + - queues + - runaijobs + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch + - patch + - apiGroups: + - storage.k8s.io + resources: + - storageclasses + - csinodes + - csidrivers + - csistoragecapacities + verbs: + - get + - list + - watch + - apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.k8s.io + resources: + - priorityclasses + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/scheduler.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-scheduler-rw-engine +rules: + - apiGroups: + - "" + resources: + - configmaps + - events + - persistentvolumeclaims + - pods + - pods/status + - pods/binding + - pods/finalizers + - services + - services/finalizers + verbs: + - create + - delete + - get + - list + - patch + - update + - apiGroups: + - batch.volcano.sh + resources: + - jobs + - podgroups + - podgroups/status + verbs: + - create + - delete + - get + - list + - patch + - update + - apiGroups: + - scheduling.run.ai + resources: + - podgroups + - podgroups/status + verbs: + - create + - delete + - get + - list + - patch + - update +--- +# Source: runai-cluster/templates/clusterroles/accessrule-controller.yaml +# Run:AI AccessRule Controller +# Allows the reading of accessrule related data, reasding other Run:AI related CRDs, and CRUD of RoleBindings. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-accessrule-controller +rules: + - apiGroups: + - run.ai + resources: + - accessrules + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - run.ai + resources: + - accessrules/status + verbs: + - get + - update + - patch + - watch + - apiGroups: + - run.ai + resources: + - accessrules/finalizers + verbs: + - update + - patch + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + - clusterrolebindings + - rolebindings + verbs: + - get + - list + - watch + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterrolebindings + - clusterroles + resourceNames: + - runai-compute-resource-administrator + - runai-credentials-administrator + - runai-data-source-administrator + - runai-department-administrator + - runai-department-viewer + - runai-editor + - runai-environment-administrator + - runai-l1-researcher + - runai-l2-researcher + - runai-ml-engineer + - runai-research-manager + - runai-system-administrator + - runai-template-administrator + - runai-viewer + verbs: + - bind + - update + - patch + - apiGroups: + - run.ai + resources: + - projects + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.run.ai + resources: + - departments + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - namespaces + - serviceaccounts + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/accessrule-controller.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-accessrule-controller-project +rules: + - apiGroups: + - rbac.authorization.k8s.io + resources: + - rolebindings + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + verbs: + - bind +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/compute-resource-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-compute-resource-administrator +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - departments + - projects + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/compute-resource-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-compute-resource-administrator-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/compute-resource-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-compute-resource-administrator-runai +rules: + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/credentials-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-credentials-administrator +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - projects + - departments + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/credentials-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-credentials-administrator-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/credentials-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-credentials-administrator-runai +rules: + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/credentials-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-credentials-administrator-runai-cs +rules: + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/data-source-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-data-source-administrator +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - departments + - projects + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/data-source-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-data-source-administrator-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/data-source-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-data-source-administrator-runai +rules: + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/data-source-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-data-source-administrator-runai-cs +rules: + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-department-administrator +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - accessrules + - nodepools + - projects + - departments + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-department-administrator-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - create + - delete + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-department-administrator-runai +rules: + - apiGroups: + - "" + resources: + - configmaps + resourceNames: + - runai-cli-index + verbs: + - update + - patch + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-department-administrator-runai-cs +rules: + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-viewer.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-department-viewer +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - nodepools + - projects + - departments + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-viewer.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-department-viewer-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-viewer.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-department-viewer-runai +rules: + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/editor.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-editor +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - projects + - departments + - nodepools + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/editor.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-editor-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/editor.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-editor-runai +rules: + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/editor.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-editor-runai-cs +rules: + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/environment-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-environment-administrator +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - projects + - departments + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/environment-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-environment-administrator-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/environment-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-environment-administrator-runai +rules: + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l1-researcher.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-l1-researcher +rules: + - apiGroups: + - run.ai + resources: + - projects + - nodepools + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l1-researcher.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-l1-researcher-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - create + - delete + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l1-researcher.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-l1-researcher-runai +rules: + - apiGroups: + - "" + resources: + - configmaps + resourceNames: + - runai-cli-index + verbs: + - update + - patch + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l1-researcher.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-l1-researcher-runai-cs +rules: + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l2-researcher.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-l2-researcher +rules: + - apiGroups: + - run.ai + resources: + - projects + - nodepools + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l2-researcher.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-l2-researcher-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - create + - delete + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l2-researcher.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-l2-researcher-runai +rules: + - apiGroups: + - "" + resources: + - configmaps + resourceNames: + - runai-cli-index + verbs: + - update + - patch + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/ml-engineer.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-ml-engineer +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - projects + - nodepools + - departments + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/ml-engineer.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-ml-engineer-ns +rules: + - apiGroups: + - scheduling.run.ai + - run.ai + - apps + resources: + - runaijobs + - podgroups + - inferenceworkloads + - statefulsets + - replicasets + - deployments + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/ml-engineer.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-ml-engineer-runai +rules: + - apiGroups: + - "" + resources: + - configmaps + resourceNames: + - runai-cli-index + verbs: + - update + - patch + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/research-manager.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-research-manager +rules: + - apiGroups: + - run.ai + resources: + - projects + - nodepools + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/research-manager.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-research-manager-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/research-manager.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-research-manager-runai +rules: + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/research-manager.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-research-manager-runai-cs +rules: + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/system-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-system-administrator +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - projects + - nodepools + - accessrules + - departments + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/system-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-system-administrator-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/system-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-system-administrator-runai +rules: + - apiGroups: + - "" + resources: + - configmaps + resourceNames: + - runai-cli-index + verbs: + - update + - patch + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/system-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-system-administrator-runai-cs +rules: + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/template-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-template-administrator +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - projects + - departments + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/template-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-template-administrator-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - apiGroups: + - run.ai + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/template-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-template-administrator-runai +rules: + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/template-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-template-administrator-runai-cs +rules: + - apiGroups: + - run.ai + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/viewer.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-viewer +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - projects + - nodepools + - departments + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/viewer.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-viewer-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/viewer.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-viewer-runai +rules: + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# Installs and maintains Run:AI installation +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-operator +rules: + - apiGroups: + - "apps" + resources: + - deployments + - daemonsets + verbs: + - list + - apiGroups: + - "" + resources: + - services + verbs: + - list + - apiGroups: + - apiextensions.k8s.io + resourceNames: + - queues.scheduling.run.ai + resources: + - customresourcedefinitions + verbs: + - get + - update + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - watch + - list + - apiGroups: + - engine.run.ai + resources: + - configs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - node.k8s.io + resources: + - runtimeclasses + verbs: + - get + - list + - create + - update + - watch + - patch + - delete + - apiGroups: + - cert-manager.io + resources: + - issuers + - certificates + verbs: + - get + - list + - create + - delete + - update + - watch + - patch + - update + - apiGroups: + - run.ai + resources: + - nodepools + - accessrules + verbs: + - delete + - get + - list + - watch + - deletecollection + - update + - apiGroups: + - run.ai + resources: + - runaiconfigs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - run.ai + resources: + - runaiconfigs/finalizers + verbs: + - update + - apiGroups: + - run.ai + resources: + - runaiconfigs/status + verbs: + - get + - patch + - update + - apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + - validatingwebhookconfigurations + verbs: + - get + - watch + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# Researcher User interface used to create Jobs and view Projects. +# Read-only cluster role +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: researcher-service-ro +rules: + - apiGroups: + - "" + - amlarc.azureml.com + - apps + - run.ai + - scheduling.run.ai + - kubeflow.org + resources: + - amljob + - configmaps + - namespaces + - projects + - departments + - runaijobs + - statefulsets + - deployments + - mpijobs + - pytorchjobs + - tfjobs + - xgboostjobs + - nodes + - nodepools + - trainingworkloads + - interactiveworkloads + - inferenceworkloads + - distributedworkloads + - trainingpolicies + - interactivepolicies + - inferencepolicies + - distributedpolicies + - persistentvolumeclaims + verbs: + - get + - list + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create + - apiGroups: + - run.ai + resources: + - accessrules + - projects + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# Researcher User interface used to create Jobs and view Projects +# This ClusterRole has no associated ClusterRoleBinding (only RoleBinding at the project level) +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: researcher-service-rw +rules: + - apiGroups: + - "" + - amlarc.azureml.com + - apps + - batch + - batch.volcano.sh + - run.ai + - kubeflow.org + - extensions + - networking.k8s.io + - serving.knative.dev + resources: + - amljobs + - configmaps + - namespaces + - pods + - pods/log + - jobs + - projects + - runaijobs + - statefulsets + - mpijobs + - deployments + - services + - ingresses + - trainingworkloads + - trainingpolicies + - interactiveworkloads + - interactivepolicies + - inferenceworkloads + - inferencepolicies + - distributedworkloads + - distributedpolicies + verbs: + - create + - delete + - get + - list + - patch + - update + - apiGroups: + - route.openshift.io + resources: + - routes + - routes/custom-host + verbs: + - create + - delete +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# workload-controller is used to create runaijobs based on workloads and policies. +# This ClusterRole has no associated ClusterRoleBinding (only RoleBinding at the project level) +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: workload-controller-rw +rules: + - apiGroups: + - "" + - amlarc.azureml.com + - apps + - run.ai + - kubeflow.org + - networking.k8s.io + - serving.knative.dev + resources: + - amljobs + - configmaps + - deployments + - runaijobs + - mpijobs + - pytorchjobs + - tfjobs + - xgboostjobs + - services + - persistentvolumeclaims + - ingresses + - interactivepolicies + - interactivepolicies/status + - interactiveworkloads + - interactiveworkloads/status + - interactiveworkloads/finalizers + - trainingpolicies + - trainingpolicies/status + - trainingworkloads + - trainingworkloads/status + - trainingworkloads/finalizers + - inferencepolicies + - inferencepolicies/status + - inferenceworkloads + - inferenceworkloads/status + - inferenceworkloads/finalizers + - distributedpolicies + - distributedpolicies/status + - distributedworkloads + - distributedworkloads/status + - distributedworkloads/finalizers + verbs: + - create + - delete + - get + - list + - patch + - watch + - update + - apiGroups: + - route.openshift.io + resources: + - routes + - routes/custom-host + verbs: + - create + - delete + - watch + - list + - get + - update + - patch + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: workload-controller-ro +rules: + - apiGroups: + - "" + - run.ai + - scheduling.run.ai + - networking.k8s.io + - kubeflow.org + resources: + - runaijobs + - mpijobs + - pytorchjobs + - tfjobs + - xgboostjobs + - projects + - departments + - accessrules + - configmaps + - namespaces + - interactivepolicies + - interactivepolicies/status + - interactivepolicies/finalizers + - interactiveworkloads + - interactiveworkloads/status + - interactiveworkloads/finalizers + - trainingpolicies + - trainingpolicies/status + - trainingpolicies/finalizers + - trainingworkloads + - trainingworkloads/status + - trainingworkloads/finalizers + - inferencepolicies + - inferencepolicies/status + - inferenceworkloads + - inferenceworkloads/status + - inferenceworkloads/finalizers + - distributedpolicies + - distributedpolicies/status + - distributedworkloads + - distributedworkloads/status + - distributedworkloads/finalizers + - persistentvolumeclaims + - serviceaccounts + - nodepools + - nodes + - services + - ingresses + - pods + verbs: + - get + - list + - watch + - apiGroups: + - route.openshift.io + resources: + - routes + - routes/custom-host + verbs: + - create + - delete + - watch + - list + - get + - update + - patch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# Run:AI Scheduler reader +# Allow the reading of the current state of the cluster (pods, nodes, pod-groups, jobs, StatefulSets, deployments) to make optimal scheduling decisions. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-scheduler-ro +rules: + - apiGroups: + - "" + - amlarc.azureml.com + - batch + - batch.volcano.sh + - kubeflow.org + - machinelearning.seldon.io + - policy + - run.ai + - scheduling.k8s.io + - scheduling.run.ai + - scheduling.incubator.k8s.io + - storage.k8s.io + - serving.knative.dev + - serving.kserve.io + - apps + resources: + - amljobs + - deployments + - configmaps + - jobs + - mpijobs + - pytorchjobs + - tfjobs + - namespaces + - xgboostjobs + - nodes + - persistentvolumes + - persistentvolumeclaims + - poddisruptionbudgets + - podgroups + - pods + - priorityclasses + - queues + - replicasets + - runaijobs + - seldondeployments + - storageclasses + - revisions + - configurations + - services + - inferenceservices + - csinodes + - csidrivers + - csistoragecapacities + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + - update + - patch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-scheduler-ro-kubevirt +rules: + - apiGroups: + - "" + - kubevirt.io + resources: + - virtualmachineinstances + - virtualmachines + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: workload-overseer +rules: + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - apiGroups: + - run.ai + resources: + - trainingworkloads + - interactiveworkloads + verbs: + - get + - list + - update + - watch + - delete + - apiGroups: + - run.ai + resources: + - projects + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# Allow the reading of the current state of pods & workloads to sync backend +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cluster-sync +rules: + - apiGroups: + - "" + - kubeflow.org + - scheduling.run.ai + - run.ai + - apps + - serving.knative.dev + - knative.dev + - storage.k8s.io + - machinelearning.seldon.io + - kubevirt.io + - amlarc.azureml.com + - batch + resources: + - nodes + - pods + - podgroups + - namespaces + - runaijobs + - mpijobs + - pytorchjobs + - tfjobs + - xgboostjobs + - notebooks + - seldondeployments + - virtualmachines + - virtualmachineinstances + - statefulsets + - replicasets + - amljobs + - revisions + - configurations + - cronjobs + - deployments + - jobs + - services + - nodepools + - projects + - interactiveworkloads + - trainingworkloads + - distributedworkloads + - persistentvolumeclaims + - storageclasses + - events + - externalworkloads + - interactivepolicies + - trainingpolicies + - scheduledworkflows + verbs: + - get + - list + - watch + - apiGroups: + - "workspace.devfile.io" + resources: + - devworkspaces + verbs: + - get + - list + - watch + - apiGroups: + - ray.io + resources: + - rayclusters + - rayjobs + - rayservices + verbs: + - get + - list + - watch + - apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - get + - list + - watch + - apiGroups: + - tekton.dev + resources: + - pipelineruns + - taskruns + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - secrets + verbs: + - list + - watch + - apiGroups: + - scheduling.k8s.io + resources: + - priorityclasses + verbs: + - get + - list + - watch + - apiGroups: + - run.ai + resources: + - externalworkloads/status + - interactiveworkloads/status + - trainingworkloads/status + - distributedworkloads/status + verbs: + - update + - patch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# This ClusterRole has no associated ClusterRoleBinding (only RoleBinding at the project level) +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cluster-sync-project +rules: + - apiGroups: + - "" + - run.ai + resources: + - externalworkloads + - trainingworkloads + - interactiveworkloads + - distributedworkloads + verbs: + - patch + - update +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: assets-sync +rules: + - apiGroups: + - "" + resources: + - secrets + - persistentvolumeclaims + - serviceaccounts + verbs: + - get + - list + - delete + - update + - create +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: assets-sync-cluster +rules: + - apiGroups: + - "" + - scheduling.run.ai + resources: + - namespaces + - departments + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# Run:AI Mig Parted +# Allow the reading of the current state of the nodes to make changes in mig configuration. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-mig-parted +rules: + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch + - update + - patch + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + - delete +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# Run:AI Scheduler writer +# Allows the applying of scheduling decisions to the cluster, like updating pod, creating pod-group, etc. +# This ClusterRole has no associated ClusterRoleBinding (only RoleBinding at the project level) +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-scheduler-rw +rules: + - apiGroups: + - "" + - amlarc.azureml.com + - apps + - batch + - batch.volcano.sh + - kubeflow.org + - run.ai + - scheduling.run.ai + - scheduling.incubator.k8s.io + - serving.knative.dev + - apps + resources: + - amljobs + - configmaps + - events + - jobs + - mpijobs + - pytorchjobs + - tfjobs + - xgboostjobs + - persistentvolumeclaims + - podgroups + - podgroups/status + - pods + - pods/status + - pods/binding + - runaijobs + - statefulsets + - statefulsets/finalizers + - jobs/finalizers + - deployments + - deployments/finalizers + - runaijobs/finalizers + - mpijobs/finalizers + - pytorchjobs/finalizers + - tfjobs/finalizers + - xgboostjobs/finalizers + - replicasets/finalizers + - pods/finalizers + - revisions + - revisions/finalizers + - services + - services/finalizers + verbs: + - create + - delete + - get + - list + - patch + - update +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# Run:AI Agent +# Connects between the Run:AI GPU cluster and the Run:AI Backend. Creates Project CRDs +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-agent +rules: + - apiGroups: + - "" + resources: + - configmaps + verbs: + - list + - get + - update + - create + - watch + - apiGroups: + - "" + resources: + - namespaces + verbs: + - list + - apiGroups: + - run.ai + resources: + - projects + - nodepools + - nodepools/status + - accessrules + - accessrules/status + - trainingpolicies + - interactivepolicies + verbs: + - create + - delete + - get + - list + - update + - watch + - apiGroups: + - scheduling.run.ai + - scheduling.incubator.k8s.io + resources: + - departments + verbs: + - create + - delete + - get + - list + - update + - watch + - apiGroups: + - run.ai + resources: + - runaiconfigs + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# A Kubernetes Admission Controller +# Responsible for the management of Job submission policies and the validation of the input provided to submit the Job +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-admission-controller-ro +rules: + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - watch + - apiGroups: + - "" + - apps + - batch + - kubeflow.org + - run.ai + resources: + - configmaps + - statefulsets/finalizers + - jobs/finalizers + - deployments/finalizers + - runaijobs/finalizers + - mpijobs/finalizers + - pytorchjobs/finalizers + - tfjobs/finalizers + - xgboostjobs/finalizers + - replicasets/finalizers + - pods/finalizers + verbs: + - get + - apiGroups: + - run.ai + resources: + - nodepools + - projects + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# A Kubernetes Pod Binder with Admission Webhook +# Responsible for the management of Job submission policies and the validation of the input provided to submit the Job +# This ClusterRole has no associated ClusterRoleBinding (only RoleBinding at the project level) +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-binder-project +rules: + - apiGroups: + - "" + - apps + - batch + - kubeflow.org + - run.ai + resources: + - configmaps + - statefulsets/finalizers + - jobs/finalizers + - deployments/finalizers + - runaijobs/finalizers + - mpijobs/finalizers + - pytorchjobs/finalizers + - tfjobs/finalizers + - xgboostjobs/finalizers + - replicasets/finalizers + - pods/finalizers + verbs: + - create + - update + - apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - pods/finalizers + verbs: + - update + - apiGroups: + - "" + resources: + - pods/status + verbs: + - get + - patch + - update +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# A Kubernetes Admission Controller +# Responsible for the management of Job submission policies and the validation of the input provided to submit the Job +# This ClusterRole has no associated ClusterRoleBinding (only RoleBinding at the project level) +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-admission-controller-project +rules: + - apiGroups: + - "" + - apps + - batch + - kubeflow.org + - run.ai + resources: + - configmaps + - statefulsets/finalizers + - jobs/finalizers + - deployments/finalizers + - runaijobs/finalizers + - mpijobs/finalizers + - pytorchjobs/finalizers + - tfjobs/finalizers + - xgboostjobs/finalizers + - replicasets/finalizers + - pods/finalizers + verbs: + - create + - update +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +## Creation of custom certificates +## Relevant for regular Kubernetes. Not relevant for Openshift installations. +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-init-ca +rules: + - apiGroups: ["admissionregistration.k8s.io"] + resources: ["validatingwebhookconfigurations"] + verbs: ["get", "watch", "list", "create", "update", "patch", "delete"] + - apiGroups: ["admissionregistration.k8s.io"] + resources: ["mutatingwebhookconfigurations"] + verbs: ["get", "watch", "list", "create", "update", "patch", "delete"] + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["get"] + - apiGroups: ["certificates.k8s.io"] + resources: ["certificatesigningrequests"] + verbs: ["get", "watch", "list", "create", "update", "patch", "delete"] + - apiGroups: ["certificates.k8s.io"] + resources: ["certificatesigningrequests/approval", "certificatesigningrequests/status"] + verbs: ["update"] + - apiGroups: ["certificates.k8s.io"] + resources: ["signers"] + resourceNames: ["kubernetes.io/legacy-unknown", "kubernetes.io/kubelet-serving"] + verbs: ["approve"] +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# Used for an extension of the Kubernetes Job to the "runaijob" CRD +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-job-controller +rules: + - apiGroups: + - "" + resources: + - pods + - events + - configmaps + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - pods/exec + verbs: + - create + - apiGroups: + - run.ai + resources: + - '*' + verbs: + - '*' +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# Job Controller Writer. +# This ClusterRole has no associated ClusterRoleBinding (only RoleBinding at the project level) +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-job-controller-project +rules: + - apiGroups: + - "" + resources: + - pods + - events + - configmaps + verbs: + - create + - delete + - patch + - update +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# Run:AI Projects +# Alows the reading of project-related data and editing of Run:AI specific CRDs. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-project-controller +rules: + - apiGroups: + - run.ai + resources: + - projects + - projects/finalizers + - projects/status + verbs: + - '*' + - apiGroups: + - scheduling.run.ai + - scheduling.incubator.k8s.io + resources: + - queues + - departments + - departments/finalizers + verbs: + - '*' + - apiGroups: + - "" + resources: + - configmaps + - namespaces + verbs: + - get + - list + - watch + - apiGroups: + - rbac.authorization.k8s.io + resources: + - rolebindings + verbs: + - get + - list + - watch + - apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-prometheus +rules: + - apiGroups: + - "" + resources: + - nodes + - nodes/metrics + - pods + - endpoints + - services + verbs: + - get + - list + - watch + - nonResourceURLs: + - /metrics + - /metrics/cadvisor + verbs: + - get +--- +# Source: runai-cluster/templates/clusterroles/external-workload-integrator.yaml +# Run:AI ExternalWorkloadIntegrator +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-external-workload-integrator +rules: + - apiGroups: + - run.ai + resources: + - externalworkloads + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - run.ai + resources: + - externalworkloads/status + verbs: + - get + - update + - patch + - watch + - apiGroups: + - run.ai + resources: + - externalworkloads/finalizers + verbs: + - update + - patch + - apiGroups: + - run.ai + resources: + - projects + - nodepools + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.run.ai + resources: + - departments + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - watch + - list + - apiGroups: + - run.ai + resources: + - trainingworkloads + - interactiveworkloads + - distributedworkloads + verbs: + - get + - list + - watch + - apiGroups: + - "workspace.devfile.io" + resources: + - devworkspaces + - devworkspaces/finalizers + verbs: + - get + - list + - watch + - apiGroups: + - ray.io + resources: + - rayclusters + - rayjobs + - rayservices + - rayclusters/finalizers + - rayjobs/finalizers + - rayservices/finalizers + verbs: + - get + - list + - watch + - apiGroups: + - "" + - apps + - machinelearning.seldon.io + - kubevirt.io + - kubeflow.org + - run.ai + - amlarc.azureml.com + - serving.knative.dev + - knative.dev + - batch + resources: + - deployments + - jobs + - runaijobs + - mpijobs + - pytorchjobs + - tfjobs + - xgboostjobs + - notebooks + - seldondeployments + - virtualmachines + - virtualmachineinstances + - statefulsets + - replicasets + - pods + - amljobs + - revisions + - configurations + - services + - cronjobs + - scheduledworkflows + verbs: + - get + - list + - watch + - apiGroups: + - "" + - apps + - machinelearning.seldon.io + - kubevirt.io + - kubeflow.org + - run.ai + - amlarc.azureml.com + - serving.knative.dev + - knative.dev + - batch + resources: + - deployments/finalizers + - jobs/finalizers + - runaijobs/finalizers + - mpijobs/finalizers + - pytorchjobs/finalizers + - tfjobs/finalizers + - xgboostjobs/finalizers + - seldondeployments/finalizers + - virtualmachines/finalizers + - virtualmachineinstances/finalizers + - statefulsets/finalizers + - replicasets/finalizers + - pods/finalizers + - amljobs/finalizers + - revisions/finalizers + - configurations/finalizers + - services/finalizers + - cronjobs/finalizers + - scheduledworkflows/finalizers + verbs: + - get + - list + - watch + - apiGroups: + - argoproj.io + resources: + - workflows + - workflows/finalizers + verbs: + - get + - list + - watch + - apiGroups: + - tekton.dev + resources: + - pipelineruns + - taskruns + - pipelineruns/finalizers + - taskruns/finalizers + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.run.ai + resources: + - podgroups + verbs: + - get + - list + - watch + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/external-workload-integrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-external-workload-integrator-project +rules: + - apiGroups: + - "" + resources: + - pods + verbs: + - update + - patch +--- +# Source: runai-cluster/templates/clusterroles/metrics-exporter.yaml +# Run:AI Metrics Exporter +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: metrics-exporter +rules: + - apiGroups: + - scheduling.run.ai + resources: + - queues + verbs: + - list + - get + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + - list + - get + - watch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - list + - get + - watch + - apiGroups: + - scheduling.run.ai + resources: + - podgroups + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.k8s.io + resources: + - priorityclasses + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - pods + verbs: + - list + - get + - watch +--- +# Source: runai-cluster/templates/clusterroles/node-scale-adjuster.yaml +# Run:AI Node Scale Adjuster +# Allows runai to work with cluster autoscalers +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: node-scale-adjuster-ro +rules: + - apiGroups: + - "" + resources: + - pods + verbs: + - list + - get + - watch +--- +# Source: runai-cluster/templates/clusterroles/nodepool-controller.yaml +# Run:AI NodePool Controller +# Allows the reading of nodepool related data and editing of Run:AI specific CRDs and Nodes. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: nodepool-controller +rules: + - apiGroups: + - run.ai + resources: + - nodepools + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - run.ai + resources: + - nodepools/status + verbs: + - get + - update + - patch + - watch + - apiGroups: + - run.ai + resources: + - nodepools/finalizers + verbs: + - update + - patch + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch + - update + - patch + - apiGroups: + - "" + - apps + resources: + - deployments + - pods + - services + verbs: + - get + - list + - watch + - apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - get + - list + - watch + - apiGroups: + - run.ai + resources: + - runaiconfigs + verbs: + - get + - list + - watch + - apiGroups: + - engine.run.ai + resources: + - schedulingshards + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +--- +# Source: runai-cluster/templates/clusterroles/pod-group-assigner.yaml +# Run:AI Pod Grouper +# Responsible to watch pods in the cluster and group them to podgroups according to their job type +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: pod-group-assigner +rules: + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + - patch + - update + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.run.ai + resources: + - podgroups + verbs: + - get + - list + - watch + - update + - patch + - apiGroups: + - scheduling.run.ai + resources: + - queues + verbs: + - get + - list + - watch + - apiGroups: + - run.ai + resources: + - projects + - nodepools + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/pod-grouper.yaml +# Run:AI Pod Grouper +# Responsible to watch pods in the cluster and group them to podgroups according to their job type +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: pod-grouper +rules: + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - update + - watch + - patch + - apiGroups: + - "workspace.devfile.io" + resources: + - devworkspaces + verbs: + - get + - list + - watch + - apiGroups: + - "workspace.devfile.io" + resources: + - devworkspaces/finalizers + verbs: + - create + - update + - patch + - apiGroups: + - ray.io + resources: + - rayclusters + - rayjobs + - rayservices + verbs: + - get + - list + - watch + - apiGroups: + - ray.io + resources: + - rayclusters/finalizers + - rayjobs/finalizers + - rayservices/finalizers + verbs: + - create + - update + - patch + - apiGroups: + - "" + - apps + - machinelearning.seldon.io + - kubevirt.io + - kubeflow.org + - run.ai + - amlarc.azureml.com + - serving.knative.dev + - knative.dev + - batch + resources: + - deployments + - jobs + - runaijobs + - mpijobs + - pytorchjobs + - tfjobs + - xgboostjobs + - notebooks + - seldondeployments + - virtualmachines + - virtualmachineinstances + - statefulsets + - replicasets + - pods + - amljobs + - revisions + - configurations + - services + - cronjobs + verbs: + - get + - list + - watch + - apiGroups: + - "" + - apps + - machinelearning.seldon.io + - kubevirt.io + - kubeflow.org + - run.ai + - amlarc.azureml.com + - serving.knative.dev + - knative.dev + - batch + resources: + - deployments/finalizers + - jobs/finalizers + - runaijobs/finalizers + - mpijobs/finalizers + - pytorchjobs/finalizers + - tfjobs/finalizers + - xgboostjobs/finalizers + - seldondeployments/finalizers + - virtualmachines/finalizers + - virtualmachineinstances/finalizers + - statefulsets/finalizers + - replicasets/finalizers + - pods/finalizers + - amljobs/finalizers + - revisions/finalizers + - configurations/finalizers + - services/finalizers + - cronjobs/finalizers + verbs: + - get + - list + - watch + - update + - create + - apiGroups: + - scheduling.run.ai + resources: + - podgroups + verbs: + - get + - list + - watch + - update + - create +--- +# Source: runai-cluster/templates/clusterroles/project-controller-cluster-wide-resources.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-project-controller-cluster-secret +rules: + - apiGroups: + - run.ai + resources: + - projects + - projects/finalizers + verbs: + - '*' + - apiGroups: + - scheduling.run.ai + - scheduling.incubator.k8s.io + resources: + - queues + verbs: + - '*' + - apiGroups: + - "" + resources: + - secrets + - serviceaccounts + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/project-controller-cluster-wide-resources.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-project-controller-cluster-secret-per-project +rules: + - apiGroups: + - "" + resourceNames: + - default + resources: + - serviceaccounts + verbs: + - update + - create + - apiGroups: + - "" + resources: + - secrets + - secrets/finalizers + verbs: + - update + - create + - delete +--- +# Source: runai-cluster/templates/clusterroles/project-controller-cluster-wide-resources.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-project-controller-cluster-pvc +rules: + - apiGroups: + - run.ai + resources: + - projects + - projects/finalizers + verbs: + - '*' + - apiGroups: + - scheduling.run.ai + - scheduling.incubator.k8s.io + resources: + - queues + verbs: + - '*' + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/project-controller-cluster-wide-resources.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-project-controller-cluster-pvc-per-project +rules: + - apiGroups: + - "" + resources: + - persistentvolumeclaims + - persistentvolumeclaims/finalizers + verbs: + - update + - create + - delete + - list + - watch + - patch +--- +# Source: runai-cluster/templates/clusterroles/project-controller-limit-range.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-project-controller-limit-range +rules: + - apiGroups: + - "" + resources: + - limitranges + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/project-controller-limit-range.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-project-controller-limit-range-per-project +rules: + - apiGroups: + - "" + resourceNames: + - runai-limit-range + resources: + - limitranges + - limitranges/finalizers + verbs: + - update + - create + - delete + - patch +--- +# Source: runai-cluster/templates/clusterroles/project-controller-ns-creation.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-project-controller-ns-creation +rules: + - apiGroups: + - "" + resources: + - namespaces + - namespaces/finalizers + verbs: + - create + - update +--- +# Source: runai-cluster/templates/clusterroles/project-controller-rb-creation.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-project-controller-rolebinding-creation +rules: + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + verbs: + - bind + - apiGroups: + - rbac.authorization.k8s.io + resources: + - rolebindings + verbs: + - '*' +--- +# Source: runai-cluster/templates/clusterroles/project-controller-service-monitor-creation.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-project-controller-servicemonitor-creation +rules: + - apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - create +--- +# Source: runai-cluster/templates/clusterroles/status-updater.yaml +# Run:AI Status Updater +# Responsible to watch pods in the cluster and update status and usage metrics on pod, pod-group and top-owner +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: status-updater +rules: + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + - update + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - update + - watch + - patch + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - pods/status + verbs: + - get + - patch + - update + - apiGroups: + - "scheduling.run.ai" + resources: + - podgroups + verbs: + - get + - list + - watch + - patch + - apiGroups: + - batch + resources: + - jobs + verbs: + - get + - list + - watch + - patch + - apiGroups: + - apps + resources: + - deployments + - statefulsets + - replicasets + verbs: + - get + - list + - watch + - patch + - apiGroups: + - machinelearning.seldon.io + resources: + - seldondeployments + verbs: + - get + - list + - watch + - patch + - apiGroups: + - kubevirt.io + resources: + - virtualmachines + - virtualmachineinstances + verbs: + - get + - list + - watch + - patch + - apiGroups: + - amlarc.azureml.com + resources: + - amljobs + verbs: + - get + - list + - watch + - patch + - apiGroups: + - kubeflow.org + resources: + - mpijobs + - notebooks + - pytorchjobs + - tfjobs + - xgboostjobs + - scheduledworkflows + verbs: + - get + - list + - watch + - patch + - apiGroups: + - run.ai + resources: + - runaijobs + verbs: + - get + - list + - watch + - patch + - apiGroups: + - serving.knative.dev + - knative.dev + resources: + - revisions + - configurations + - services + verbs: + - get + - list + - watch + - patch + - apiGroups: + - ray.io + resources: + - rayclusters + - rayjobs + - rayservices + verbs: + - get + - list + - watch + - patch + - apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - get + - list + - watch + - apiGroups: + - tekton.dev + resources: + - pipelineruns + - taskruns + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/status-updater.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: status-updater-ro +rules: + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - pods/status + verbs: + - get + - apiGroups: + - "scheduling.run.ai" + resources: + - podgroups + verbs: + - get + - list + - watch + - apiGroups: + - batch + resources: + - jobs + verbs: + - get + - list + - watch + - apiGroups: + - run.ai + resources: + - runaijobs + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/charts/runai-engine/templates/operator/rbac/role_binding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-engine-operator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-engine-operator +subjects: +- kind: ServiceAccount + name: engine-operator + namespace: runai +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/binder-ro.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-binder-ro +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-binder-ro +subjects: + - kind: ServiceAccount + name: binder + namespace: runai +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/pod-group-controller.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: pod-group-controller-ro +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: pod-group-controller-ro +subjects: + - kind: ServiceAccount + name: pod-group-controller + namespace: runai +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/pod-grouper.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: pod-grouper-engine +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: pod-grouper-engine +subjects: + - kind: ServiceAccount + name: pod-grouper + namespace: runai +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/queue-controller.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: queue-controller-engine +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: queue-controller-engine +subjects: + - kind: ServiceAccount + name: queue-controller + namespace: runai +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/scheduler.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-engine-scheduler-cluster-wide +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-engine-scheduler-cluster-wide +subjects: + - kind: ServiceAccount + name: runai-scheduler + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/accessrule-controller.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-accessrule-controller +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-accessrule-controller +subjects: + - kind: ServiceAccount + name: accessrule-controller + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/compute-resource-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-compute-resource-administrator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-compute-resource-administrator +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/credentials-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-credentials-administrator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-credentials-administrator +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/data-source-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-data-source-administrator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-data-source-administrator +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-department-administrator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-department-administrator +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-viewer.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-department-viewer +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-department-viewer +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/editor.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-editor +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-editor +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/environment-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-environment-administrator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-environment-administrator +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l1-researcher.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-l1-researcher +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-l1-researcher +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l2-researcher.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-l2-researcher +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-l2-researcher +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/ml-engineer.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-ml-engineer +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-ml-engineer +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/research-manager.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-research-manager +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-research-manager +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/system-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-system-administrator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-system-administrator +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/template-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-template-administrator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-template-administrator +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/viewer.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-viewer +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-viewer +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-operator + namespace: runai +subjects: + - kind: ServiceAccount + name: runai-operator + namespace: runai +roleRef: + kind: ClusterRole + name: runai-operator + apiGroup: rbac.authorization.k8s.io +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: researcher-service-ro +subjects: + - kind: ServiceAccount + name: researcher-service + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: researcher-service-ro +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: workload-controller-ro +subjects: + - kind: ServiceAccount + name: workload-controller + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: workload-controller-ro +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-scheduler-ro +subjects: + - kind: ServiceAccount + name: runai-scheduler + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-scheduler-ro +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-scheduler-ro-kubevirt +subjects: + - kind: ServiceAccount + name: runai-scheduler + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-scheduler-ro-kubevirt +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: workload-overseer +subjects: + - kind: ServiceAccount + name: workload-overseer + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: workload-overseer +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: cluster-sync +subjects: + - kind: ServiceAccount + name: cluster-sync + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-sync +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: assets-sync +subjects: + - kind: ServiceAccount + name: assets-sync + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: assets-sync-cluster +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-mig-parted +subjects: + - kind: ServiceAccount + name: runai-mig-manager + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-mig-parted +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-agent +subjects: + - kind: ServiceAccount + name: runai-agent + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-agent +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-admission-controller-ro +roleRef: + kind: ClusterRole + apiGroup: rbac.authorization.k8s.io + name: runai-admission-controller-ro +subjects: + - kind: ServiceAccount + name: runai-admission-controller + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-init-ca +roleRef: + kind: ClusterRole + apiGroup: rbac.authorization.k8s.io + name: runai-init-ca +subjects: + - kind: ServiceAccount + namespace: runai + name: init-ca +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-job-controller +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-job-controller +subjects: + - kind: ServiceAccount + name: runai-job-controller + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-project-controller +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-project-controller +subjects: + - kind: ServiceAccount + name: runai-project-controller + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-prometheus +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-prometheus +subjects: + - kind: ServiceAccount + name: runai-prometheus + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/external-workload-integrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-external-workload-integrator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-external-workload-integrator +subjects: + - kind: ServiceAccount + name: external-workload-integrator + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/metrics-exporter.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: metrics-exporter +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: metrics-exporter +subjects: + - kind: ServiceAccount + name: metrics-exporter + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/node-scale-adjuster.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: node-scale-adjuster-ro +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: node-scale-adjuster-ro +subjects: + - kind: ServiceAccount + name: node-scale-adjuster + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/nodepool-controller.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: nodepool-controller +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: nodepool-controller +subjects: + - kind: ServiceAccount + name: nodepool-controller + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/pod-group-assigner.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: pod-group-assigner +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: pod-group-assigner +subjects: + - kind: ServiceAccount + name: pod-group-assigner + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/pod-grouper.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: pod-grouper +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: pod-grouper +subjects: + - kind: ServiceAccount + name: pod-grouper + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/project-controller-cluster-wide-resources.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-project-controller-cluster-secret +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-project-controller-cluster-secret +subjects: + - kind: ServiceAccount + name: runai-project-controller + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/project-controller-cluster-wide-resources.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-project-controller-cluster-pvc +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-project-controller-cluster-pvc +subjects: + - kind: ServiceAccount + name: runai-project-controller + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/project-controller-limit-range.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-project-controller-limit-range +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-project-controller-limit-range +subjects: + - kind: ServiceAccount + name: runai-project-controller + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/project-controller-ns-creation.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-project-controller-ns-creation +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-project-controller-ns-creation +subjects: + - kind: ServiceAccount + name: runai-project-controller + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/project-controller-rb-creation.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-project-controller-rolebinding-creation +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-project-controller-rolebinding-creation +subjects: + - kind: ServiceAccount + name: runai-project-controller + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/project-controller-service-monitor-creation.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-project-controller-servicemonitor-creation +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-project-controller-servicemonitor-creation +subjects: + - kind: ServiceAccount + name: runai-project-controller + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/status-updater.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: status-updater-ro +subjects: + - kind: ServiceAccount + name: status-updater + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: status-updater-ro +--- +# Source: runai-cluster/charts/runai-engine/templates/operator/rbac/leader_election_role.yaml +# permissions to do leader election. +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: leader-election-role + namespace: runai +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: workload-controller-migration + namespace: runai +rules: + - apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - delete + - watch + - list + - get + - update + - patch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + namespace: runai + name: runai-public-config-viewer +rules: + - apiGroups: [""] + resources: ["configmaps"] + resourceNames: + - runai-public + verbs: ["get", "watch", "list"] +--- +# Source: runai-cluster/templates/clusterroles/node-scale-adjuster.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: node-scale-adjuster + namespace: runai-scale-adjust +rules: + - apiGroups: + - "" + resources: + - pods + verbs: + - create + - update + - delete + - patch +--- +# Source: runai-cluster/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: runai-operator + namespace: runai +rules: + - apiGroups: + - "" + - batch + - apps + - networking.k8s.io + - rbac.authorization.k8s.io + - monitoring.coreos.com + - run.ai + - route.openshift.io + resources: + - prometheuses + - prometheusrules + - pods + - services + - configmaps + - secrets + - serviceaccounts + - jobs + - deployments + - daemonsets + - replicasets + - statefulsets + - roles + - rolebindings + - ingresses + - runaiconfigs + - runaiconfigs/status + - runaiconfigs/finalizers + - interactivepolicies + - interactivepolicies/status + - interactiveworkloads + - interactiveworkloads/status + - trainingpolicies + - trainingpolicies/status + - trainingworkloads + - trainingworkloads/status + - inferencepolicies + - inferencepolicies/status + - inferenceworkloads + - inferenceworkloads/status + - distributedpolicies + - distributedpolicies/status + - distributedworkloads + - distributedworkloads/status + - servicemonitors + - podmonitors + - routes + - routes/custom-host + - validatingwebhookconfigurations + verbs: + - '*' + - apiGroups: + - "" + resources: + - events + verbs: + - create + - apiGroups: + - "" + resources: + - pods + verbs: + - deletecollection + - apiGroups: + - kubeflow.org + resources: + - mpijobs + - pytorchjobs + - tfjobs + - xgboostjobs + verbs: + - create +--- +# Source: runai-cluster/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + creationTimestamp: null + name: runai-operator + namespace: monitoring +rules: + - apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +--- +# Source: runai-cluster/charts/runai-engine/templates/operator/rbac/leader_election_role_binding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: leader-election-rolebinding + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: leader-election-role +subjects: +- kind: ServiceAccount + name: engine-operator + namespace: runai +--- +# Source: runai-cluster/charts/runai-engine/templates/resource-reservation-namespace.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-scheduler-rw-engine + namespace: runai-reservation +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-scheduler-rw-engine +subjects: + - kind: ServiceAccount + name: runai-scheduler + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/compute-resource-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-compute-resource-administrator-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-compute-resource-administrator-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/credentials-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-credentials-administrator-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-credentials-administrator-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/credentials-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-credentials-administrator-runai-cs + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-credentials-administrator-runai-cs +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/data-source-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-data-source-administrator-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-data-source-administrator-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/data-source-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-data-source-administrator-runai-cs + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-data-source-administrator-runai-cs +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-department-administrator-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-department-administrator-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-department-administrator-runai-cs + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-department-administrator-runai-cs +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-viewer.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-department-viewer-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-department-viewer-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/editor.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-editor-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-editor-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/editor.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-editor-runai-cs + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-editor-runai-cs +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/environment-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-environment-administrator-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-environment-administrator-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l1-researcher.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-l1-researcher-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-l1-researcher-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l1-researcher.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-l1-researcher-runai-cs + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-l1-researcher-runai-cs +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l2-researcher.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-l2-researcher-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-l2-researcher-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/ml-engineer.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-ml-engineer-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-ml-engineer-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/research-manager.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-research-manager-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-research-manager-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/research-manager.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-research-manager-runai-cs + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-research-manager-runai-cs +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/system-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-system-administrator-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-system-administrator-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/system-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-system-administrator-runai-cs + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-system-administrator-runai-cs +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/template-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-template-administrator-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-template-administrator-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/template-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-template-administrator-runai-cs + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-template-administrator-runai-cs +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/viewer.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-viewer-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-viewer-runai +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: workload-controller-migration + namespace: runai +subjects: + - kind: ServiceAccount + name: workload-controller + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: workload-controller-migration +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-public-config-viewer + namespace: runai +roleRef: + kind: Role + name: runai-public-config-viewer + apiGroup: rbac.authorization.k8s.io +subjects: + - kind: Group + name: system:authenticated + apiGroup: rbac.authorization.k8s.io + +# The following ClusterRole and ClusterRoleBinding are used +# by our private Prometheus instance +--- +# Source: runai-cluster/templates/clusterroles/node-scale-adjuster.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: node-scale-adjuster + namespace: runai-scale-adjust +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: node-scale-adjuster +subjects: + - kind: ServiceAccount + name: node-scale-adjuster + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/project-controller-rb-creation.yaml +# Do not remove the following RoleBinding! It is needed for feature RUN-7158 +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-project-controller-rolebinding-creation + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-project-controller-rolebinding-creation +subjects: + - kind: ServiceAccount + name: runai-project-controller + namespace: runai +--- +# Source: runai-cluster/templates/rbac.yaml +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-operator + namespace: runai +subjects: +- kind: ServiceAccount + name: runai-operator +roleRef: + kind: Role + name: runai-operator + apiGroup: rbac.authorization.k8s.io +--- +# Source: runai-cluster/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-operator + namespace: monitoring +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: runai-operator +subjects: + - kind: ServiceAccount + name: runai-operator + namespace: runai +--- +# Source: runai-cluster/charts/runai-engine/templates/operator/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: engine-operator + namespace: runai + labels: + app: engine-operator +spec: + selector: + matchLabels: + app: engine-operator + replicas: 1 + template: + metadata: + labels: + app: engine-operator + spec: + containers: + - command: + - /manager + image: gcr.io/run-ai-prod/engine-operator:2.16.79 + imagePullPolicy: Always + name: manager + env: + - name: MS_REPOSITORY + value: gcr.io/run-ai-prod + - name: MS_TAG + value: 2.16.79 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + resources: + + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 50m + memory: 256Mi + serviceAccountName: engine-operator + terminationGracePeriodSeconds: 10 + imagePullSecrets: + - name: image-registry-secret + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 1 + preference: + matchExpressions: + - key: node-role.kubernetes.io/runai-system + operator: Exists +--- +# Source: runai-cluster/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: runai-operator +spec: + replicas: 1 + selector: + matchLabels: + name: runai + template: + metadata: + labels: + name: runai + spec: + serviceAccountName: runai-operator + containers: + - name: runai-go-operator + image: gcr.io/run-ai-prod/go-operator:2.16.79 + imagePullPolicy: + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + resources: + + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 50m + memory: 256Mi + env: + - name: WATCH_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + imagePullSecrets: + - name: gcr-secret + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 1 + preference: + matchExpressions: + - key: node-role.kubernetes.io/runai-system + operator: Exists +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/definitions-and-readme.yaml +# "runai-researcher" ClusterRole (in base.yaml) - +# project-controller used to create 1 RoleBinding in each project's namespace, the subjects being all Permissions.Users+Groups of the project; +# it is now embedded as part of the ClusterRoles here, in the "$extraJobsDeploymentsReadNamespaced..." and "$extraJobsDeploymentsCRUDNamespaced...". +# "runai-storageclass-lister" ClusterRole + ClusterRoleBinding (in base.yaml) - +# agent used to update the ClusterRoleBinding, assigning the subjects to be all users and groups in the system that are "researcher"s. +# it is now embedded as part of the ClusterRoles here, in the "$extraJobsDeploymentsReadClustered...". +# "runai-cluster-viewer" ClusterRole + ClusterRoleBinding (in base.yaml) - +# agent used to update the ClusterRoleBinding, assigning the subjects to be all users and groups in the system. +# it is now embedded as part of the ClusterRoles here, in the "extraJobsDeployments...". //TODO: validate +# "runai-template-viewer" Role + RoleBinding in "runai" namespace (in base.yaml) - +# agent used to update the RoleBinding, assigning the subjects to be all users and groups in the system. +# it is now embedded as part of the ClusterRoles here, in the "$policies..." and "$templates..." ("$policiesAndTemplatesApiGroups..."). //TODO: do +# "runai-cli-index-map-editor" Role + RoleBinding in "runai" namespace (in base.yaml) - +# agent used to update the RoleBinding, assigning the subjects to be all users and groups in the system. +# it is now embedded as part of the ClusterRoles here, in the "$runaiCliIndexMapEditor...". //TODO: do +# "runai-research-manager" ClusterRoleBinding (that points to "runai-researcher" ClusterRole) (in base.yaml) - +# agent used to update the ClusterRoleBinding, assigning the subjects to be all users and groups in the system that are "researcher manager"s. +# it is now embedded as part of the ClusterRoles here. +# +# $extraJobsDeploymentsCRUDNamespaced ApiGroups and Resources -> for namespaced ClusterRoles that include CRUD on jobs and/or deployments +# $extraJobsDeploymentsReadNamespaced ApiGroups and Resources -> for namespaced ClusterRoles that include Read on jobs and/or deployments +# $extraJobsDeploymentsWatchNamespaced ApiGroups and Resources -> also for namespaced ClusterRoles that include Read on jobs and/or deployments; but those with "watch" verbs +# $extraJobsDeploymentsReadClustered ApiGroups and Resources -> for cluster-scoped ClusterRoles that include Read on jobs and/or deployments +# $runaiCliIndexMapEditor ApiGroups, Resources, ResourceNames and Verbs -> +# a specific configmap rule, to be placed in the Role (and RoleBinding..) of "runai" namespace, ONLY for roles that include CRUD on jobs and/or deployments. + + +################################ +# ClusterRoles Explanation: +# For each backend Role, we will have 3 or 4 ClusterRoles existing. +# And for each backend AccessRule, the following will occur: +# "runai-" - accessrule's subject should exist in same-named ClusterRoleBinding. +# "runai--ns" - accessrule's subject should exist in RoleBinding in each namespace of the scope. +# "runai--runai" - accessrule's subject should exist in RoleBinding in "runai" namespace. +# "runai--runai-cs" - only if the scope is CLUSTER_SCOPE - accessrule's subject should exist in RoleBinding in "runai" namespace. +# +# Note: when adding a new role: add it to the "resourceNames" in the "runai-accessrule-controller" ClusterRole (in accessrule_controller.yaml). +--- +# Source: runai-cluster/templates/grafana-secret.yaml +# consider moving this secret to be managed by the operator +--- +# Source: runai-cluster/templates/runaiconfig.yaml +apiVersion: run.ai/v1 +kind: RunaiConfig +metadata: + name: runai +spec: + init-ca: + enabled: true + project-controller: + clusterWidePvc: true + createServiceMonitors: true + prometheus: + spec: + remoteWrite: + - url: https://prometheus-blocks-prod-us-central1.grafana.net/api/prom/push + writeRelabelConfigs: + - action: keep + regex: + sourceLabels: + - __name__ +--- +# Source: runai-cluster/charts/runai-engine/templates/hooks/post-install-rbac.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: runai-engine-post-install + namespace: runai +--- +# Source: runai-cluster/templates/hooks/post-install-rbac.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: runai-post-install + namespace: runai + labels: + run.ai/hook: post-install +--- +# Source: runai-cluster/templates/hooks/post-upgrade-rbac.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: runai-post-upgrade + namespace: runai + labels: + run.ai/hook: post-upgrade +--- +# Source: runai-cluster/templates/hooks/pre-delete-rbac.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: runai-pre-delete + namespace: runai + labels: + run.ai/hook: pre-delete +--- +# Source: runai-cluster/templates/hooks/pre-install-rbac.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: runai-pre-install + namespace: runai + labels: + run.ai/hook: pre-install +--- +# Source: runai-cluster/templates/hooks/pre-upgrade-rbac.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: runai-pre-upgrade + namespace: runai + labels: + run.ai/hook: pre-upgrade +--- +# Source: runai-cluster/templates/hooks/upgrade_crds/rbac.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: crd-upgrader + namespace: runai +--- +# Source: runai-cluster/charts/runai-engine/templates/hooks/post-install-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-engine-post-install + annotations: +rules: + - apiGroups: + - engine.run.ai + resources: + - configs + verbs: + - create + - apiGroups: + - scheduling.run.ai + resources: + - queues + verbs: + - create + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get +--- +# Source: runai-cluster/templates/hooks/post-install-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-post-install + labels: + run.ai/hook: post-install +rules: + - apiGroups: + - config.openshift.io + resources: + - clusteroperators + verbs: + - get + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - apiGroups: + - "" + resources: + - nodes + verbs: + - list +--- +# Source: runai-cluster/templates/hooks/post-upgrade-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-post-upgrade + labels: + run.ai/hook: post-upgrade +rules: + - apiGroups: + - config.openshift.io + resources: + - clusteroperators + verbs: + - get + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - apiGroups: + - "" + resources: + - nodes + verbs: + - list +--- +# Source: runai-cluster/templates/hooks/pre-delete-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-pre-delete + labels: + run.ai/hook: pre-delete +rules: + - apiGroups: + - run.ai + resources: + - runaiconfigs + verbs: + - delete +--- +# Source: runai-cluster/templates/hooks/pre-install-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-pre-install + labels: + run.ai/hook: pre-install +rules: + - apiGroups: + - '' + - 'operator.openshift.io' + resources: + - namespaces + - ingresscontrollers + verbs: + - '*' + - apiGroups: + - management.cattle.io + resources: + - projects + verbs: + - updatepsa + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - apiGroups: + - "" + resources: + - nodes + verbs: + - list + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterrolebindings + resourceNames: + - runai-research-manager + verbs: + - get + - list + - delete +--- +# Source: runai-cluster/templates/hooks/pre-upgrade-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-pre-upgrade + labels: + run.ai/hook: pre-upgrade +rules: + - apiGroups: + - management.cattle.io + resources: + - projects + verbs: + - updatepsa + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - apiGroups: + - "" + resources: + - nodes + verbs: + - list + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - patch + resourceNames: + - runai + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterrolebindings + resourceNames: + - runai-research-manager + verbs: + - get + - list + - delete +--- +# Source: runai-cluster/templates/hooks/upgrade_crds/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-crd-upgrader + annotations: +rules: +- apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: ["get", "list", "update", "patch", "create"] +--- +# Source: runai-cluster/charts/runai-engine/templates/hooks/post-install-rbac.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-engine-post-install + namespace: runai + annotations: +subjects: + - kind: ServiceAccount + name: runai-engine-post-install + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-engine-post-install +--- +# Source: runai-cluster/templates/hooks/post-install-rbac.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-post-install + namespace: runai + labels: + run.ai/hook: post-install +subjects: + - kind: ServiceAccount + name: runai-post-install + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-post-install +--- +# Source: runai-cluster/templates/hooks/post-upgrade-rbac.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-post-upgrade + namespace: runai + labels: + run.ai/hook: post-upgrade +subjects: + - kind: ServiceAccount + name: runai-post-upgrade + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-post-upgrade +--- +# Source: runai-cluster/templates/hooks/pre-delete-rbac.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-pre-delete + labels: + run.ai/hook: pre-delete +subjects: + - kind: ServiceAccount + name: runai-pre-delete + namespace: runai +roleRef: + kind: ClusterRole + name: runai-pre-delete + apiGroup: rbac.authorization.k8s.io +--- +# Source: runai-cluster/templates/hooks/pre-install-rbac.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-pre-install + namespace: runai + labels: + run.ai/hook: pre-install +subjects: + - kind: ServiceAccount + name: runai-pre-install + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-pre-install +--- +# Source: runai-cluster/templates/hooks/pre-upgrade-rbac.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-pre-upgrade + labels: + run.ai/hook: pre-upgrade +subjects: + - kind: ServiceAccount + name: runai-pre-upgrade + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-pre-upgrade +--- +# Source: runai-cluster/templates/hooks/upgrade_crds/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-crd-upgrader + annotations: +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-crd-upgrader +subjects: +- kind: ServiceAccount + name: crd-upgrader + namespace: runai +--- +# Source: runai-cluster/templates/hooks/post-install-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: runai-post-install + namespace: runai + labels: + run.ai/hook: post-install +rules: + - apiGroups: + - run.ai + resources: + - runaiconfigs + verbs: + - get + - create + - update + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - create + - update +--- +# Source: runai-cluster/templates/hooks/post-install-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: runai-post-install + namespace: runai-scale-adjust + labels: + run.ai/hook: post-install +rules: + - apiGroups: + - run.ai + resources: + - runaiconfigs + verbs: + - get + - create + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - create + - update +--- +# Source: runai-cluster/templates/hooks/post-install-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: runai-post-install + namespace: runai-reservation + labels: + run.ai/hook: post-install +rules: + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - create + - update +--- +# Source: runai-cluster/templates/hooks/post-upgrade-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: runai-post-upgrade + namespace: runai + labels: + run.ai/hook: post-upgrade +rules: + - apiGroups: + - run.ai + resources: + - runaiconfigs + verbs: + - get + - create + - update + - apiGroups: + - '' + resources: + - configmaps + verbs: + - update + - get + - delete + - apiGroups: + - '' + resources: + - secrets + verbs: + - get + - create + - update +--- +# Source: runai-cluster/templates/hooks/post-upgrade-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: runai-post-upgrade + namespace: runai-reservation + labels: + run.ai/hook: post-upgrade +rules: + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - create + - update +--- +# Source: runai-cluster/templates/hooks/post-upgrade-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: runai-post-upgrade + namespace: runai-scale-adjust + labels: + run.ai/hook: post-upgrade +rules: + - apiGroups: + - run.ai + resources: + - runaiconfigs + verbs: + - get + - create + - update + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - create + - update +--- +# Source: runai-cluster/templates/hooks/pre-install-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: runai-pre-install + namespace: runai + labels: + run.ai/hook: pre-install +rules: + - apiGroups: + - '' + resources: + - configmaps + - secrets + verbs: + - get + - delete + - create +--- +# Source: runai-cluster/templates/hooks/pre-upgrade-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: runai-pre-upgrade + namespace: runai + labels: + run.ai/hook: pre-upgrade +rules: + - apiGroups: + - run.ai + resources: + - runaiconfigs + verbs: + - get + - apiGroups: + - '' + resources: + - configmaps + - secrets + verbs: + - get + - create + - delete +--- +# Source: runai-cluster/templates/hooks/post-install-rbac.yaml +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-post-install + namespace: runai + labels: + run.ai/hook: post-install +subjects: + - kind: ServiceAccount + name: runai-post-install + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: runai-post-install +--- +# Source: runai-cluster/templates/hooks/post-install-rbac.yaml +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-post-install + namespace: runai-scale-adjust + labels: + run.ai/hook: post-install +subjects: + - kind: ServiceAccount + name: runai-post-install + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: runai-post-install +--- +# Source: runai-cluster/templates/hooks/post-install-rbac.yaml +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-post-install + namespace: runai-reservation + labels: + run.ai/hook: post-install +subjects: + - kind: ServiceAccount + name: runai-post-install + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: runai-post-install +--- +# Source: runai-cluster/templates/hooks/post-upgrade-rbac.yaml +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-post-upgrade + namespace: runai + labels: + run.ai/hook: post-upgrade +subjects: + - kind: ServiceAccount + name: runai-post-upgrade + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: runai-post-upgrade +--- +# Source: runai-cluster/templates/hooks/post-upgrade-rbac.yaml +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-post-upgrade + namespace: runai-reservation + labels: + run.ai/hook: post-upgrade +subjects: + - kind: ServiceAccount + name: runai-post-upgrade + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: runai-post-upgrade +--- +# Source: runai-cluster/templates/hooks/post-upgrade-rbac.yaml +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-post-upgrade + namespace: runai-scale-adjust + labels: + run.ai/hook: post-upgrade +subjects: + - kind: ServiceAccount + name: runai-post-upgrade + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: runai-post-upgrade +--- +# Source: runai-cluster/templates/hooks/pre-install-rbac.yaml +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-pre-install + namespace: runai + labels: + run.ai/hook: pre-install +subjects: + - kind: ServiceAccount + name: runai-pre-install + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: runai-pre-install +--- +# Source: runai-cluster/templates/hooks/pre-upgrade-rbac.yaml +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-pre-upgrade + namespace: runai + labels: + run.ai/hook: pre-upgrade +subjects: + - kind: ServiceAccount + name: runai-pre-upgrade + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: runai-pre-upgrade +--- +# Source: runai-cluster/templates/hooks/post-install-job.yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: post-install + namespace: runai + labels: + run.ai/hook: post-install +spec: + backoffLimit: 0 + template: + metadata: + labels: + run.ai/hook: post-install + spec: + serviceAccountName: runai-post-install + restartPolicy: Never + containers: + - name: post-install + image: gcr.io/run-ai-prod/go-operator:2.16.79 + imagePullPolicy: + args: + - --post-install + - --control-plane-url= + - --control-plane-client-id= + - --control-plane-client-secret= + - --cluster-uid= + - --cluster-url= + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + resources: + + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 50m + memory: 256Mi + imagePullSecrets: + - name: gcr-secret + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 1 + preference: + matchExpressions: + - key: node-role.kubernetes.io/runai-system + operator: Exists +--- +# Source: runai-cluster/templates/hooks/post-upgrade-job.yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: post-upgrade + namespace: runai + labels: + run.ai/hook: post-upgrade +spec: + backoffLimit: 0 + template: + metadata: + labels: + run.ai/hook: post-upgrade + spec: + serviceAccountName: runai-post-upgrade + restartPolicy: Never + containers: + - name: post-upgrade + image: gcr.io/run-ai-prod/go-operator:2.16.79 + imagePullPolicy: + args: + - --post-upgrade + - --control-plane-url= + - --control-plane-client-id= + - --control-plane-client-secret= + - --cluster-uid= + - --cluster-url= + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + resources: + + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 50m + memory: 256Mi + imagePullSecrets: + - name: gcr-secret + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 1 + preference: + matchExpressions: + - key: node-role.kubernetes.io/runai-system + operator: Exists +--- +# Source: runai-cluster/templates/hooks/pre-delete-job.yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: pre-delete + namespace: runai + labels: + run.ai/hook: pre-delete +spec: + backoffLimit: 0 + template: + metadata: + labels: + run.ai/hook: pre-delete + spec: + serviceAccountName: runai-pre-delete + restartPolicy: Never + containers: + - name: pre-delete + image: gcr.io/run-ai-prod/go-operator:2.16.79 + imagePullPolicy: + args: + - --pre-delete + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + resources: + + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 50m + memory: 256Mi + imagePullSecrets: + - name: gcr-secret + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 1 + preference: + matchExpressions: + - key: node-role.kubernetes.io/runai-system + operator: Exists +--- +# Source: runai-cluster/templates/hooks/pre-install-job.yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: pre-install + namespace: runai + labels: + run.ai/hook: pre-install +spec: + backoffLimit: 0 + template: + metadata: + labels: + run.ai/hook: pre-install + spec: + serviceAccountName: runai-pre-install + restartPolicy: Never + containers: + - name: pre-install + image: gcr.io/run-ai-prod/go-operator:2.16.79 + imagePullPolicy: + args: + - --pre-install + - --control-plane-url= + - --control-plane-client-id= + - --control-plane-client-secret= + - --cluster-uid= + - --cluster-url= + - --custom-ca-enabled=false + - --custom-ca-secret-name=runai-ca-cert + - --custom-ca-secret-key=runai-ca.pem + - --custom-ca-secret-optional=true + - --image-registry= + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + resources: + + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 50m + memory: 256Mi + imagePullSecrets: + - name: gcr-secret + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 1 + preference: + matchExpressions: + - key: node-role.kubernetes.io/runai-system + operator: Exists +--- +# Source: runai-cluster/templates/hooks/pre-upgrade-job.yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: pre-upgrade + namespace: runai + labels: + run.ai/hook: pre-upgrade +spec: + backoffLimit: 0 + template: + metadata: + labels: + run.ai/hook: pre-upgrade + spec: + serviceAccountName: runai-pre-upgrade + restartPolicy: Never + containers: + - name: pre-upgrade + image: gcr.io/run-ai-prod/go-operator:2.16.79 + imagePullPolicy: + args: + - --pre-upgrade + - --control-plane-url= + - --control-plane-client-id= + - --control-plane-client-secret= + - --cluster-uid= + - --cluster-url= + - --custom-ca-enabled=false + - --custom-ca-secret-name=runai-ca-cert + - --custom-ca-secret-key=runai-ca.pem + - --custom-ca-secret-optional=true + - --image-registry= + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + resources: + + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 50m + memory: 256Mi + imagePullSecrets: + - name: gcr-secret + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 1 + preference: + matchExpressions: + - key: node-role.kubernetes.io/runai-system + operator: Exists +--- +# Source: runai-cluster/templates/hooks/upgrade_crds/job.yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: crd-upgrader + namespace: runai + annotations: +spec: + template: + metadata: + name: crd-upgrader + spec: + serviceAccountName: crd-upgrader + containers: + - name: crd-upgrader + image: gcr.io/run-ai-prod/crd-upgrader:2.16.79 + imagePullPolicy: Always + resources: + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 50m + memory: 256Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + restartPolicy: OnFailure + imagePullSecrets: + - name: gcr-secret + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 1 + preference: + matchExpressions: + - key: node-role.kubernetes.io/runai-system + operator: Exists + diff --git a/gitops-catalog/runai/static/prereqs/namespaces.yaml b/gitops-catalog/runai/static/prereqs/namespaces.yaml new file mode 100644 index 0000000..6c50141 --- /dev/null +++ b/gitops-catalog/runai/static/prereqs/namespaces.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: runai +--- +apiVersion: v1 +kind: Namespace +metadata: + name: monitoring +--- +apiVersion: v1 +kind: Namespace +metadata: + name: runai-scale-adjust +--- +apiVersion: v1 +kind: Namespace +metadata: + name: runai-reservation diff --git a/gitops-catalog/runai/templates/application.yaml b/gitops-catalog/runai/templates/application.yaml new file mode 100644 index 0000000..f612dff --- /dev/null +++ b/gitops-catalog/runai/templates/application.yaml @@ -0,0 +1,26 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-runai + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: runai + kubefirst.konstruct.io/source: catalog-templates + argocd.argoproj.io/sync-wave: '47' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.argocdAppNamespace }} + name: in-cluster + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/environments/runai/{{ .Values.clusterName }} + targetRevision: HEAD + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/runai/templates/manifests-application.yaml b/gitops-catalog/runai/templates/manifests-application.yaml new file mode 100644 index 0000000..8eb9b56 --- /dev/null +++ b/gitops-catalog/runai/templates/manifests-application.yaml @@ -0,0 +1,27 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: runai-cluster-{{ .Values.clusterName }} + namespace: {{ .Values.argocdAppNamespace }} + annotations: + argocd.argoproj.io/sync-wave: "50" + kubefirst.konstruct.io/application-name: runai + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + name: {{ .Values.clusterDestination }} + namespace: runai + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/environments/runai/{{ .Values.clusterName }}/manifests + targetRevision: HEAD + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/gitops-catalog/runai/templates/prereqs-application.yaml b/gitops-catalog/runai/templates/prereqs-application.yaml new file mode 100644 index 0000000..bf93c8d --- /dev/null +++ b/gitops-catalog/runai/templates/prereqs-application.yaml @@ -0,0 +1,25 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: runai-prereqs-{{ .Values.clusterName }} + namespace: {{ .Values.argocdAppNamespace }} + annotations: + argocd.argoproj.io/sync-wave: "49" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + name: {{ .Values.clusterDestination }} + namespace: runai + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/environments/runai/{{ .Values.clusterName }}/prereqs + targetRevision: HEAD + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/gitops-catalog/runai/values.yaml b/gitops-catalog/runai/values.yaml new file mode 100644 index 0000000..64ebf5b --- /dev/null +++ b/gitops-catalog/runai/values.yaml @@ -0,0 +1,51 @@ +# Run.ai GPU Orchestration Platform Configuration +# Deploys Run.ai cluster agent via pre-rendered manifests (hook annotations +# stripped for ArgoCD compatibility). Prereqs app creates required namespaces +# at sync-wave 49, manifests app deploys Run.ai at sync-wave 50. + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: civo-gpu +clusterName: civo-gpu + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/civonetes/demo-organization-gitops.git +gitopsRepoUrl: https://github.com/civonetes/demo-organization-gitops.git + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: civo-gpu +clusterDestination: civo-gpu + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: civo-gpu +project: civo-gpu + +# @input.type: string +# @input.description: ArgoCD Application namespace (where app-of-apps lives) +# @input.required: true +# @input.default: civo-gpu-environment +argocdAppNamespace: civo-gpu-environment + +# ============================================================================= +# RUN.AI CLUSTER CONFIGURATION +# These values are used as token replacements in the rendered manifests. +# ============================================================================= + +# @input.type: string +# @input.description: Run.ai control plane URL (provided by Run.ai after account setup) +# @input.required: true +# @input.default: https://placeholder.runai.ai +clusterUrl: https://placeholder.runai.ai + +# @input.type: string +# @input.description: Cluster UID (provided by Run.ai onboarding wizard) +# @input.required: true +# @input.default: demo-cluster-uid +clusterUid: demo-cluster-uid diff --git a/gitops-catalog/vault/Chart.yaml b/gitops-catalog/vault/Chart.yaml new file mode 100644 index 0000000..d65f510 --- /dev/null +++ b/gitops-catalog/vault/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: vault +description: A Helm chart for deploying HashiCorp Vault with ArgoCD for secrets management, encryption, and identity-based access (last fully OSS release before BSL relicensing) +type: application +version: 0.1.0 +appVersion: "0.27.0" diff --git a/gitops-catalog/vault/templates/application.yaml b/gitops-catalog/vault/templates/application.yaml new file mode 100644 index 0000000..728ff8e --- /dev/null +++ b/gitops-catalog/vault/templates/application.yaml @@ -0,0 +1,50 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-vault + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: vault + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + chart: vault + repoURL: https://helm.releases.hashicorp.com + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: vault + values: | + server: + dev: + enabled: {{ .Values.devMode }} + ha: + enabled: {{ .Values.haEnabled }} + {{- if .Values.haEnabled }} + raft: + enabled: true + replicas: {{ .Values.replicas }} + {{- end }} + {{- if not .Values.haEnabled }} + standalone: + enabled: true + {{- end }} + dataStorage: + size: {{ .Values.dataStorageSize }} + ui: + enabled: {{ .Values.uiEnabled }} + injector: + enabled: {{ .Values.injectorEnabled }} + ui: + enabled: {{ .Values.uiEnabled }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/vault/values.yaml b/gitops-catalog/vault/values.yaml new file mode 100644 index 0000000..c2dbd83 --- /dev/null +++ b/gitops-catalog/vault/values.yaml @@ -0,0 +1,89 @@ +# HashiCorp Vault Configuration +# This values file contains all configurable parameters for deploying Vault via ArgoCD +# Note: Chart version 0.27.0 is the last fully OSS release before BSL relicensing + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for Vault deployment +# @input.required: true +# @input.default: vault +namespace: vault + +# @input.type: string +# @input.description: Vault Helm chart version (0.27.0 is last fully OSS release) +# @input.required: true +# @input.default: 0.27.0 +chartVersion: 0.27.0 + +# ============================================================================= +# VAULT CONFIGURATION +# ============================================================================= + +# @input.type: enum +# @input.description: Run Vault in dev mode (in-memory storage, auto-unsealed, NOT for production) +# @input.options: true,false +# @input.required: true +# @input.default: false +devMode: false + +# @input.type: number +# @input.description: Number of Vault server replicas (use 3+ for HA with Raft) +# @input.required: true +# @input.default: 1 +replicas: 1 + +# @input.type: enum +# @input.description: Enable Vault HA mode with Raft integrated storage +# @input.options: true,false +# @input.required: true +# @input.default: false +haEnabled: false + +# @input.type: enum +# @input.description: Enable Vault UI +# @input.options: true,false +# @input.required: true +# @input.default: true +uiEnabled: true + +# @input.type: enum +# @input.description: Enable Vault Agent Injector for automatic sidecar injection +# @input.options: true,false +# @input.required: true +# @input.default: true +injectorEnabled: true + +# @input.type: string +# @input.description: Storage size for Vault data (PVC) +# @input.required: true +# @input.default: 10Gi +dataStorageSize: 10Gi diff --git a/templates/workload-project-cluster/0-providerconfig.yaml b/templates/aws/project-cluster/0-providerconfig.yaml similarity index 100% rename from templates/workload-project-cluster/0-providerconfig.yaml rename to templates/aws/project-cluster/0-providerconfig.yaml diff --git a/templates/workload-project-cluster/10-infrastructure.yaml b/templates/aws/project-cluster/10-infrastructure.yaml similarity index 100% rename from templates/workload-project-cluster/10-infrastructure.yaml rename to templates/aws/project-cluster/10-infrastructure.yaml diff --git a/templates/workload-project-cluster/15-infrastructure-bootstrap.yaml b/templates/aws/project-cluster/15-infrastructure-bootstrap.yaml similarity index 100% rename from templates/workload-project-cluster/15-infrastructure-bootstrap.yaml rename to templates/aws/project-cluster/15-infrastructure-bootstrap.yaml diff --git a/templates/workload-project-cluster/20-argocd-connection.yaml b/templates/aws/project-cluster/20-argocd-connection.yaml similarity index 100% rename from templates/workload-project-cluster/20-argocd-connection.yaml rename to templates/aws/project-cluster/20-argocd-connection.yaml diff --git a/templates/workload-project-cluster/30-argocd.yaml b/templates/aws/project-cluster/30-argocd.yaml similarity index 100% rename from templates/workload-project-cluster/30-argocd.yaml rename to templates/aws/project-cluster/30-argocd.yaml diff --git a/templates/workload-project-cluster/30-cert-manager.yaml b/templates/aws/project-cluster/30-cert-manager.yaml similarity index 100% rename from templates/workload-project-cluster/30-cert-manager.yaml rename to templates/aws/project-cluster/30-cert-manager.yaml diff --git a/templates/workload-project-cluster/30-crossplane.yaml b/templates/aws/project-cluster/30-crossplane.yaml similarity index 100% rename from templates/workload-project-cluster/30-crossplane.yaml rename to templates/aws/project-cluster/30-crossplane.yaml diff --git a/templates/workload-project-cluster/30-external-dns.yaml b/templates/aws/project-cluster/30-external-dns.yaml similarity index 100% rename from templates/workload-project-cluster/30-external-dns.yaml rename to templates/aws/project-cluster/30-external-dns.yaml diff --git a/templates/workload-project-cluster/30-external-secrets-operator.yaml b/templates/aws/project-cluster/30-external-secrets-operator.yaml similarity index 100% rename from templates/workload-project-cluster/30-external-secrets-operator.yaml rename to templates/aws/project-cluster/30-external-secrets-operator.yaml diff --git a/templates/workload-project-cluster/30-ingress-nginx.yaml b/templates/aws/project-cluster/30-ingress-nginx.yaml similarity index 100% rename from templates/workload-project-cluster/30-ingress-nginx.yaml rename to templates/aws/project-cluster/30-ingress-nginx.yaml diff --git a/templates/workload-project-cluster/30-reloader.yaml b/templates/aws/project-cluster/30-reloader.yaml similarity index 100% rename from templates/workload-project-cluster/30-reloader.yaml rename to templates/aws/project-cluster/30-reloader.yaml diff --git a/templates/workload-project-cluster/35-clustersecretstore.yaml b/templates/aws/project-cluster/35-clustersecretstore.yaml similarity index 100% rename from templates/workload-project-cluster/35-clustersecretstore.yaml rename to templates/aws/project-cluster/35-clustersecretstore.yaml diff --git a/templates/workload-project-cluster/40-clusterissuers.yaml b/templates/aws/project-cluster/40-clusterissuers.yaml similarity index 100% rename from templates/workload-project-cluster/40-clusterissuers.yaml rename to templates/aws/project-cluster/40-clusterissuers.yaml diff --git a/templates/workload-project-cluster/40-crossplane-components.yaml b/templates/aws/project-cluster/40-crossplane-components.yaml similarity index 100% rename from templates/workload-project-cluster/40-crossplane-components.yaml rename to templates/aws/project-cluster/40-crossplane-components.yaml diff --git a/templates/workload-project-cluster/40-secret.yaml b/templates/aws/project-cluster/40-secret.yaml similarity index 100% rename from templates/workload-project-cluster/40-secret.yaml rename to templates/aws/project-cluster/40-secret.yaml diff --git a/templates/workload-project-cluster/45-environment.yaml b/templates/aws/project-cluster/45-environment.yaml similarity index 100% rename from templates/workload-project-cluster/45-environment.yaml rename to templates/aws/project-cluster/45-environment.yaml diff --git a/templates/workload-project-cluster/50-actions-runner-controller.yaml b/templates/aws/project-cluster/50-actions-runner-controller.yaml similarity index 100% rename from templates/workload-project-cluster/50-actions-runner-controller.yaml rename to templates/aws/project-cluster/50-actions-runner-controller.yaml diff --git a/templates/workload-project-cluster/51-actions-runner-application.yaml b/templates/aws/project-cluster/51-actions-runner-application.yaml similarity index 100% rename from templates/workload-project-cluster/51-actions-runner-application.yaml rename to templates/aws/project-cluster/51-actions-runner-application.yaml diff --git a/templates/workload-project-cluster/actions-runner-controller/51-actions-runner-externalsecret.yaml b/templates/aws/project-cluster/actions-runner-controller/51-actions-runner-externalsecret.yaml similarity index 100% rename from templates/workload-project-cluster/actions-runner-controller/51-actions-runner-externalsecret.yaml rename to templates/aws/project-cluster/actions-runner-controller/51-actions-runner-externalsecret.yaml diff --git a/templates/workload-project-cluster/actions-runner-controller/51-actions-runner-runnerdeployment.yaml b/templates/aws/project-cluster/actions-runner-controller/51-actions-runner-runnerdeployment.yaml similarity index 100% rename from templates/workload-project-cluster/actions-runner-controller/51-actions-runner-runnerdeployment.yaml rename to templates/aws/project-cluster/actions-runner-controller/51-actions-runner-runnerdeployment.yaml diff --git a/templates/workload-project-cluster/actions-runner-controller/51-actions-runner-serviceaccount.yaml b/templates/aws/project-cluster/actions-runner-controller/51-actions-runner-serviceaccount.yaml similarity index 100% rename from templates/workload-project-cluster/actions-runner-controller/51-actions-runner-serviceaccount.yaml rename to templates/aws/project-cluster/actions-runner-controller/51-actions-runner-serviceaccount.yaml diff --git a/templates/workload-project-cluster/actions-runner-controller/51-actions-runner-wait.yaml b/templates/aws/project-cluster/actions-runner-controller/51-actions-runner-wait.yaml similarity index 100% rename from templates/workload-project-cluster/actions-runner-controller/51-actions-runner-wait.yaml rename to templates/aws/project-cluster/actions-runner-controller/51-actions-runner-wait.yaml diff --git a/templates/workload-project-cluster/appproject-workload-cluster.yaml b/templates/aws/project-cluster/appproject-workload-cluster.yaml similarity index 100% rename from templates/workload-project-cluster/appproject-workload-cluster.yaml rename to templates/aws/project-cluster/appproject-workload-cluster.yaml diff --git a/templates/workload-project-cluster/argocd/.DS_Store b/templates/aws/project-cluster/argocd/.DS_Store similarity index 100% rename from templates/workload-project-cluster/argocd/.DS_Store rename to templates/aws/project-cluster/argocd/.DS_Store diff --git a/templates/workload-project-cluster/argocd/application.yaml b/templates/aws/project-cluster/argocd/application.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/application.yaml rename to templates/aws/project-cluster/argocd/application.yaml diff --git a/templates/workload-project-cluster/argocd/argocd-application-controller-sa.yaml b/templates/aws/project-cluster/argocd/argocd-application-controller-sa.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/argocd-application-controller-sa.yaml rename to templates/aws/project-cluster/argocd/argocd-application-controller-sa.yaml diff --git a/templates/workload-project-cluster/argocd/argocd-application-controller-statefulset.yaml b/templates/aws/project-cluster/argocd/argocd-application-controller-statefulset.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/argocd-application-controller-statefulset.yaml rename to templates/aws/project-cluster/argocd/argocd-application-controller-statefulset.yaml diff --git a/templates/workload-project-cluster/argocd/argocd-applicationset-controller-sa.yaml b/templates/aws/project-cluster/argocd/argocd-applicationset-controller-sa.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/argocd-applicationset-controller-sa.yaml rename to templates/aws/project-cluster/argocd/argocd-applicationset-controller-sa.yaml diff --git a/templates/workload-project-cluster/argocd/argocd-cm.yaml b/templates/aws/project-cluster/argocd/argocd-cm.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/argocd-cm.yaml rename to templates/aws/project-cluster/argocd/argocd-cm.yaml diff --git a/templates/workload-project-cluster/argocd/argocd-cmd-params-cm.yaml b/templates/aws/project-cluster/argocd/argocd-cmd-params-cm.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/argocd-cmd-params-cm.yaml rename to templates/aws/project-cluster/argocd/argocd-cmd-params-cm.yaml diff --git a/templates/workload-project-cluster/argocd/argocd-repo-server-deployment.yaml b/templates/aws/project-cluster/argocd/argocd-repo-server-deployment.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/argocd-repo-server-deployment.yaml rename to templates/aws/project-cluster/argocd/argocd-repo-server-deployment.yaml diff --git a/templates/workload-project-cluster/argocd/argocd-server-deployment.yaml b/templates/aws/project-cluster/argocd/argocd-server-deployment.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/argocd-server-deployment.yaml rename to templates/aws/project-cluster/argocd/argocd-server-deployment.yaml diff --git a/templates/workload-project-cluster/argocd/argocd-server-sa.yaml b/templates/aws/project-cluster/argocd/argocd-server-sa.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/argocd-server-sa.yaml rename to templates/aws/project-cluster/argocd/argocd-server-sa.yaml diff --git a/templates/workload-project-cluster/argocd/argocd-ui-ingress.yaml b/templates/aws/project-cluster/argocd/argocd-ui-ingress.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/argocd-ui-ingress.yaml rename to templates/aws/project-cluster/argocd/argocd-ui-ingress.yaml diff --git a/templates/workload-project-cluster/argocd/kustomization.yaml b/templates/aws/project-cluster/argocd/kustomization.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/kustomization.yaml rename to templates/aws/project-cluster/argocd/kustomization.yaml diff --git a/templates/workload-project-cluster/argocd/rbac.yaml b/templates/aws/project-cluster/argocd/rbac.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/rbac.yaml rename to templates/aws/project-cluster/argocd/rbac.yaml diff --git a/templates/workload-project-cluster/cert-issuers/clusterissuers.yaml b/templates/aws/project-cluster/cert-issuers/clusterissuers.yaml similarity index 100% rename from templates/workload-project-cluster/cert-issuers/clusterissuers.yaml rename to templates/aws/project-cluster/cert-issuers/clusterissuers.yaml diff --git a/templates/workload-project-cluster/cluster-secret-store/clustersecretstore.yaml b/templates/aws/project-cluster/cluster-secret-store/clustersecretstore.yaml similarity index 100% rename from templates/workload-project-cluster/cluster-secret-store/clustersecretstore.yaml rename to templates/aws/project-cluster/cluster-secret-store/clustersecretstore.yaml diff --git a/templates/workload-project-cluster/crossplane-components/controllerconfig.yaml b/templates/aws/project-cluster/crossplane-components/controllerconfig.yaml similarity index 100% rename from templates/workload-project-cluster/crossplane-components/controllerconfig.yaml rename to templates/aws/project-cluster/crossplane-components/controllerconfig.yaml diff --git a/templates/workload-project-cluster/crossplane-components/crossplane-secrets.yaml b/templates/aws/project-cluster/crossplane-components/crossplane-secrets.yaml similarity index 100% rename from templates/workload-project-cluster/crossplane-components/crossplane-secrets.yaml rename to templates/aws/project-cluster/crossplane-components/crossplane-secrets.yaml diff --git a/templates/workload-project-cluster/crossplane-components/svc.yaml b/templates/aws/project-cluster/crossplane-components/svc.yaml similarity index 100% rename from templates/workload-project-cluster/crossplane-components/svc.yaml rename to templates/aws/project-cluster/crossplane-components/svc.yaml diff --git a/templates/workload-project-cluster/crossplane-components/terraform-provider.yaml b/templates/aws/project-cluster/crossplane-components/terraform-provider.yaml similarity index 100% rename from templates/workload-project-cluster/crossplane-components/terraform-provider.yaml rename to templates/aws/project-cluster/crossplane-components/terraform-provider.yaml diff --git a/templates/workload-downstream-cluster/infrastructure-bootstrap/wait.yaml b/templates/aws/project-cluster/infrastructure-bootstrap/wait.yaml similarity index 100% rename from templates/workload-downstream-cluster/infrastructure-bootstrap/wait.yaml rename to templates/aws/project-cluster/infrastructure-bootstrap/wait.yaml diff --git a/templates/workload-downstream-cluster/infrastructure-bootstrap/workspace.yaml b/templates/aws/project-cluster/infrastructure-bootstrap/workspace.yaml similarity index 100% rename from templates/workload-downstream-cluster/infrastructure-bootstrap/workspace.yaml rename to templates/aws/project-cluster/infrastructure-bootstrap/workspace.yaml diff --git a/templates/civo-workload-cluster/infrastructure/wait.yaml b/templates/aws/project-cluster/infrastructure/wait.yaml similarity index 100% rename from templates/civo-workload-cluster/infrastructure/wait.yaml rename to templates/aws/project-cluster/infrastructure/wait.yaml diff --git a/templates/workload-project-cluster/infrastructure/workspace.yaml b/templates/aws/project-cluster/infrastructure/workspace.yaml similarity index 100% rename from templates/workload-project-cluster/infrastructure/workspace.yaml rename to templates/aws/project-cluster/infrastructure/workspace.yaml diff --git a/templates/workload-downstream-cluster/kubefirst.yaml b/templates/aws/project-cluster/kubefirst.yaml similarity index 100% rename from templates/workload-downstream-cluster/kubefirst.yaml rename to templates/aws/project-cluster/kubefirst.yaml diff --git a/templates/workload-project-cluster/provider-config/providerconfig.yaml b/templates/aws/project-cluster/provider-config/providerconfig.yaml similarity index 100% rename from templates/workload-project-cluster/provider-config/providerconfig.yaml rename to templates/aws/project-cluster/provider-config/providerconfig.yaml diff --git a/templates/workload-project-cluster/registry-workload-cluster.yaml b/templates/aws/project-cluster/registry-workload-cluster.yaml similarity index 100% rename from templates/workload-project-cluster/registry-workload-cluster.yaml rename to templates/aws/project-cluster/registry-workload-cluster.yaml diff --git a/templates/workload-project-cluster/secrets/ecr-secrets.yaml b/templates/aws/project-cluster/secrets/ecr-secrets.yaml similarity index 100% rename from templates/workload-project-cluster/secrets/ecr-secrets.yaml rename to templates/aws/project-cluster/secrets/ecr-secrets.yaml diff --git a/templates/workload-project-cluster/secrets/secret.yaml b/templates/aws/project-cluster/secrets/secret.yaml similarity index 100% rename from templates/workload-project-cluster/secrets/secret.yaml rename to templates/aws/project-cluster/secrets/secret.yaml diff --git a/templates/civo-workload-cluster/0-providerconfig.yaml b/templates/aws/workload-cluster/0-providerconfig.yaml similarity index 100% rename from templates/civo-workload-cluster/0-providerconfig.yaml rename to templates/aws/workload-cluster/0-providerconfig.yaml diff --git a/templates/workload-downstream-cluster/10-infrastructure.yaml b/templates/aws/workload-cluster/10-infrastructure.yaml similarity index 100% rename from templates/workload-downstream-cluster/10-infrastructure.yaml rename to templates/aws/workload-cluster/10-infrastructure.yaml diff --git a/templates/workload-downstream-cluster/15-infrastructure-bootstrap.yaml b/templates/aws/workload-cluster/15-infrastructure-bootstrap.yaml similarity index 100% rename from templates/workload-downstream-cluster/15-infrastructure-bootstrap.yaml rename to templates/aws/workload-cluster/15-infrastructure-bootstrap.yaml diff --git a/templates/workload-downstream-cluster/20-argocd-connection.yaml b/templates/aws/workload-cluster/20-argocd-connection.yaml similarity index 100% rename from templates/workload-downstream-cluster/20-argocd-connection.yaml rename to templates/aws/workload-cluster/20-argocd-connection.yaml diff --git a/templates/workload-downstream-cluster/30-cert-manager.yaml b/templates/aws/workload-cluster/30-cert-manager.yaml similarity index 100% rename from templates/workload-downstream-cluster/30-cert-manager.yaml rename to templates/aws/workload-cluster/30-cert-manager.yaml diff --git a/templates/workload-downstream-cluster/30-external-dns.yaml b/templates/aws/workload-cluster/30-external-dns.yaml similarity index 100% rename from templates/workload-downstream-cluster/30-external-dns.yaml rename to templates/aws/workload-cluster/30-external-dns.yaml diff --git a/templates/workload-downstream-cluster/30-external-secrets-operator.yaml b/templates/aws/workload-cluster/30-external-secrets-operator.yaml similarity index 100% rename from templates/workload-downstream-cluster/30-external-secrets-operator.yaml rename to templates/aws/workload-cluster/30-external-secrets-operator.yaml diff --git a/templates/workload-downstream-cluster/30-ingress-nginx.yaml b/templates/aws/workload-cluster/30-ingress-nginx.yaml similarity index 100% rename from templates/workload-downstream-cluster/30-ingress-nginx.yaml rename to templates/aws/workload-cluster/30-ingress-nginx.yaml diff --git a/templates/workload-downstream-cluster/30-reloader.yaml b/templates/aws/workload-cluster/30-reloader.yaml similarity index 100% rename from templates/workload-downstream-cluster/30-reloader.yaml rename to templates/aws/workload-cluster/30-reloader.yaml diff --git a/templates/workload-downstream-cluster/40-clusterissuers.yaml b/templates/aws/workload-cluster/40-clusterissuers.yaml similarity index 100% rename from templates/workload-downstream-cluster/40-clusterissuers.yaml rename to templates/aws/workload-cluster/40-clusterissuers.yaml diff --git a/templates/workload-downstream-cluster/40-clustersecretstore.yaml b/templates/aws/workload-cluster/40-clustersecretstore.yaml similarity index 100% rename from templates/workload-downstream-cluster/40-clustersecretstore.yaml rename to templates/aws/workload-cluster/40-clustersecretstore.yaml diff --git a/templates/workload-downstream-cluster/40-rbac.yaml b/templates/aws/workload-cluster/40-rbac.yaml similarity index 100% rename from templates/workload-downstream-cluster/40-rbac.yaml rename to templates/aws/workload-cluster/40-rbac.yaml diff --git a/templates/workload-downstream-cluster/40-secret.yaml b/templates/aws/workload-cluster/40-secret.yaml similarity index 100% rename from templates/workload-downstream-cluster/40-secret.yaml rename to templates/aws/workload-cluster/40-secret.yaml diff --git a/templates/civo-workload-cluster/45-environment.yaml b/templates/aws/workload-cluster/45-environment.yaml similarity index 100% rename from templates/civo-workload-cluster/45-environment.yaml rename to templates/aws/workload-cluster/45-environment.yaml diff --git a/templates/workload-downstream-cluster/cert-issuers/clusterissuers.yaml b/templates/aws/workload-cluster/cert-issuers/clusterissuers.yaml similarity index 100% rename from templates/workload-downstream-cluster/cert-issuers/clusterissuers.yaml rename to templates/aws/workload-cluster/cert-issuers/clusterissuers.yaml diff --git a/templates/workload-downstream-cluster/cluster-secret-store/clustersecretstore.yaml b/templates/aws/workload-cluster/cluster-secret-store/clustersecretstore.yaml similarity index 100% rename from templates/workload-downstream-cluster/cluster-secret-store/clustersecretstore.yaml rename to templates/aws/workload-cluster/cluster-secret-store/clustersecretstore.yaml diff --git a/templates/workload-project-cluster/infrastructure-bootstrap/wait.yaml b/templates/aws/workload-cluster/infrastructure-bootstrap/wait.yaml similarity index 100% rename from templates/workload-project-cluster/infrastructure-bootstrap/wait.yaml rename to templates/aws/workload-cluster/infrastructure-bootstrap/wait.yaml diff --git a/templates/workload-project-cluster/infrastructure-bootstrap/workspace.yaml b/templates/aws/workload-cluster/infrastructure-bootstrap/workspace.yaml similarity index 100% rename from templates/workload-project-cluster/infrastructure-bootstrap/workspace.yaml rename to templates/aws/workload-cluster/infrastructure-bootstrap/workspace.yaml diff --git a/templates/workload-downstream-cluster/infrastructure/wait.yaml b/templates/aws/workload-cluster/infrastructure/wait.yaml similarity index 100% rename from templates/workload-downstream-cluster/infrastructure/wait.yaml rename to templates/aws/workload-cluster/infrastructure/wait.yaml diff --git a/templates/workload-downstream-cluster/infrastructure/workspace.yaml b/templates/aws/workload-cluster/infrastructure/workspace.yaml similarity index 100% rename from templates/workload-downstream-cluster/infrastructure/workspace.yaml rename to templates/aws/workload-cluster/infrastructure/workspace.yaml diff --git a/templates/workload-project-cluster/kubefirst.yaml b/templates/aws/workload-cluster/kubefirst.yaml similarity index 100% rename from templates/workload-project-cluster/kubefirst.yaml rename to templates/aws/workload-cluster/kubefirst.yaml diff --git a/templates/workload-downstream-cluster/provider-config/providerconfig.yaml b/templates/aws/workload-cluster/provider-config/providerconfig.yaml similarity index 100% rename from templates/workload-downstream-cluster/provider-config/providerconfig.yaml rename to templates/aws/workload-cluster/provider-config/providerconfig.yaml diff --git a/templates/workload-downstream-cluster/rbac/cluster-role-binding.yaml b/templates/aws/workload-cluster/rbac/cluster-role-binding.yaml similarity index 100% rename from templates/workload-downstream-cluster/rbac/cluster-role-binding.yaml rename to templates/aws/workload-cluster/rbac/cluster-role-binding.yaml diff --git a/templates/workload-downstream-cluster/rbac/cluster-role.yaml b/templates/aws/workload-cluster/rbac/cluster-role.yaml similarity index 100% rename from templates/workload-downstream-cluster/rbac/cluster-role.yaml rename to templates/aws/workload-cluster/rbac/cluster-role.yaml diff --git a/templates/civo-workload-cluster/registry-workload-cluster.yaml b/templates/aws/workload-cluster/registry-workload-cluster.yaml similarity index 100% rename from templates/civo-workload-cluster/registry-workload-cluster.yaml rename to templates/aws/workload-cluster/registry-workload-cluster.yaml diff --git a/templates/workload-downstream-cluster/secrets/ecr.yaml b/templates/aws/workload-cluster/secrets/ecr.yaml similarity index 100% rename from templates/workload-downstream-cluster/secrets/ecr.yaml rename to templates/aws/workload-cluster/secrets/ecr.yaml diff --git a/templates/civo-workload-cluster/workloadcluster-environment-project.yaml b/templates/aws/workload-cluster/workloadcluster-environment-project.yaml similarity index 100% rename from templates/civo-workload-cluster/workloadcluster-environment-project.yaml rename to templates/aws/workload-cluster/workloadcluster-environment-project.yaml diff --git a/templates/workload-downstream-cluster/workloadcluster-platform-project.yaml b/templates/aws/workload-cluster/workloadcluster-platform-project.yaml similarity index 100% rename from templates/workload-downstream-cluster/workloadcluster-platform-project.yaml rename to templates/aws/workload-cluster/workloadcluster-platform-project.yaml diff --git a/templates/civo-workload-cluster/workloadcluster-project.yaml b/templates/aws/workload-cluster/workloadcluster-project.yaml similarity index 100% rename from templates/civo-workload-cluster/workloadcluster-project.yaml rename to templates/aws/workload-cluster/workloadcluster-project.yaml diff --git a/templates/workload-downstream-cluster/0-providerconfig.yaml b/templates/aws/workload-vcluster/0-providerconfig.yaml similarity index 100% rename from templates/workload-downstream-cluster/0-providerconfig.yaml rename to templates/aws/workload-vcluster/0-providerconfig.yaml diff --git a/templates/workload-downstream-host-vcluster/10-infrastructure.yaml b/templates/aws/workload-vcluster/10-infrastructure.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/10-infrastructure.yaml rename to templates/aws/workload-vcluster/10-infrastructure.yaml diff --git a/templates/workload-downstream-host-vcluster/15-bootstrap.yaml b/templates/aws/workload-vcluster/15-bootstrap.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/15-bootstrap.yaml rename to templates/aws/workload-vcluster/15-bootstrap.yaml diff --git a/templates/civo-workload-cluster/20-argocd-connection.yaml b/templates/aws/workload-vcluster/20-argocd-connection.yaml similarity index 100% rename from templates/civo-workload-cluster/20-argocd-connection.yaml rename to templates/aws/workload-vcluster/20-argocd-connection.yaml diff --git a/templates/civo-workload-cluster/30-cert-manager.yaml b/templates/aws/workload-vcluster/30-cert-manager.yaml similarity index 100% rename from templates/civo-workload-cluster/30-cert-manager.yaml rename to templates/aws/workload-vcluster/30-cert-manager.yaml diff --git a/templates/workload-downstream-host-vcluster/30-external-dns.yaml b/templates/aws/workload-vcluster/30-external-dns.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/30-external-dns.yaml rename to templates/aws/workload-vcluster/30-external-dns.yaml diff --git a/templates/workload-downstream-host-vcluster/30-external-secrets-operator.yaml b/templates/aws/workload-vcluster/30-external-secrets-operator.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/30-external-secrets-operator.yaml rename to templates/aws/workload-vcluster/30-external-secrets-operator.yaml diff --git a/templates/workload-downstream-host-vcluster/30-ingress-nginx.yaml b/templates/aws/workload-vcluster/30-ingress-nginx.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/30-ingress-nginx.yaml rename to templates/aws/workload-vcluster/30-ingress-nginx.yaml diff --git a/templates/civo-workload-cluster/30-reloader.yaml b/templates/aws/workload-vcluster/30-reloader.yaml similarity index 100% rename from templates/civo-workload-cluster/30-reloader.yaml rename to templates/aws/workload-vcluster/30-reloader.yaml diff --git a/templates/workload-downstream-host-vcluster/40-clusterissuers.yaml b/templates/aws/workload-vcluster/40-clusterissuers.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/40-clusterissuers.yaml rename to templates/aws/workload-vcluster/40-clusterissuers.yaml diff --git a/templates/workload-downstream-host-vcluster/40-clustersecretstore.yaml b/templates/aws/workload-vcluster/40-clustersecretstore.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/40-clustersecretstore.yaml rename to templates/aws/workload-vcluster/40-clustersecretstore.yaml diff --git a/templates/workload-downstream-host-vcluster/40-rbac.yaml b/templates/aws/workload-vcluster/40-rbac.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/40-rbac.yaml rename to templates/aws/workload-vcluster/40-rbac.yaml diff --git a/templates/workload-downstream-host-vcluster/45-environment.yaml b/templates/aws/workload-vcluster/45-environment.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/45-environment.yaml rename to templates/aws/workload-vcluster/45-environment.yaml diff --git a/templates/workload-downstream-host-vcluster/bootstrap/workspace.yaml b/templates/aws/workload-vcluster/bootstrap/workspace.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/bootstrap/workspace.yaml rename to templates/aws/workload-vcluster/bootstrap/workspace.yaml diff --git a/templates/workload-downstream-host-vcluster/cert-issuers/clusterissuers.yaml b/templates/aws/workload-vcluster/cert-issuers/clusterissuers.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/cert-issuers/clusterissuers.yaml rename to templates/aws/workload-vcluster/cert-issuers/clusterissuers.yaml diff --git a/templates/workload-downstream-host-vcluster/cluster-secret-store/clustersecretstore.yaml b/templates/aws/workload-vcluster/cluster-secret-store/clustersecretstore.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/cluster-secret-store/clustersecretstore.yaml rename to templates/aws/workload-vcluster/cluster-secret-store/clustersecretstore.yaml diff --git a/templates/workload-downstream-host-vcluster/infrastructure/wait.yaml b/templates/aws/workload-vcluster/infrastructure/wait.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/infrastructure/wait.yaml rename to templates/aws/workload-vcluster/infrastructure/wait.yaml diff --git a/templates/workload-downstream-host-vcluster/infrastructure/workspace.yaml b/templates/aws/workload-vcluster/infrastructure/workspace.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/infrastructure/workspace.yaml rename to templates/aws/workload-vcluster/infrastructure/workspace.yaml diff --git a/templates/workload-downstream-host-vcluster/kubefirst.yaml b/templates/aws/workload-vcluster/kubefirst.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/kubefirst.yaml rename to templates/aws/workload-vcluster/kubefirst.yaml diff --git a/templates/workload-downstream-host-vcluster/provider-config/providerconfig.yaml b/templates/aws/workload-vcluster/provider-config/providerconfig.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/provider-config/providerconfig.yaml rename to templates/aws/workload-vcluster/provider-config/providerconfig.yaml diff --git a/templates/workload-downstream-host-vcluster/rbac/cluster-role-binding.yaml b/templates/aws/workload-vcluster/rbac/cluster-role-binding.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/rbac/cluster-role-binding.yaml rename to templates/aws/workload-vcluster/rbac/cluster-role-binding.yaml diff --git a/templates/workload-downstream-host-vcluster/rbac/cluster-role.yaml b/templates/aws/workload-vcluster/rbac/cluster-role.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/rbac/cluster-role.yaml rename to templates/aws/workload-vcluster/rbac/cluster-role.yaml diff --git a/templates/workload-downstream-host-vcluster/registry-workload-cluster.yaml b/templates/aws/workload-vcluster/registry-workload-cluster.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/registry-workload-cluster.yaml rename to templates/aws/workload-vcluster/registry-workload-cluster.yaml diff --git a/templates/workload-downstream-cluster/workloadcluster-environment-project.yaml b/templates/aws/workload-vcluster/workloadcluster-environment-project.yaml similarity index 100% rename from templates/workload-downstream-cluster/workloadcluster-environment-project.yaml rename to templates/aws/workload-vcluster/workloadcluster-environment-project.yaml diff --git a/templates/workload-downstream-host-vcluster/workloadcluster-platform-project.yaml b/templates/aws/workload-vcluster/workloadcluster-platform-project.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/workloadcluster-platform-project.yaml rename to templates/aws/workload-vcluster/workloadcluster-platform-project.yaml diff --git a/templates/workload-downstream-cluster/workloadcluster-project.yaml b/templates/aws/workload-vcluster/workloadcluster-project.yaml similarity index 100% rename from templates/workload-downstream-cluster/workloadcluster-project.yaml rename to templates/aws/workload-vcluster/workloadcluster-project.yaml diff --git a/templates/civo-workload-cluster/30-ingress-nginx.yaml b/templates/civo-workload-cluster/30-ingress-nginx.yaml deleted file mode 100644 index b75fcda..0000000 --- a/templates/civo-workload-cluster/30-ingress-nginx.yaml +++ /dev/null @@ -1,32 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: -ingress-nginx - namespace: argocd - finalizers: - - resources-finalizer.argocd.argoproj.io - annotations: - argocd.argoproj.io/sync-wave: '30' -spec: - project: -platform - source: - repoURL: https://kubernetes.github.io/ingress-nginx - targetRevision: 4.12.1 - helm: - values: |- - controller: - ingressClass: nginx - publishService: - enabled: true - extraArgs: - enable-ssl-passthrough: true - chart: ingress-nginx - destination: - name: - namespace: ingress-nginx - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/templates/civo-workload-cluster/infrastructure/workspace.yaml b/templates/civo-workload-cluster/infrastructure/workspace.yaml deleted file mode 100644 index 3956fc7..0000000 --- a/templates/civo-workload-cluster/infrastructure/workspace.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: tf.upbound.io/v1beta1 -kind: Workspace -metadata: - name: -infrastructure -spec: - providerConfigRef: - name: - forProvider: - source: Remote - module: - vars: - - key: cluster_name - value: - - key: cluster_region - value: - - key: environment - value: - - key: node_count - value: "" - - key: node_type - value: - - key: is_gpu - value: "false" diff --git a/templates/civo-workload-cluster/kubefirst.yaml b/templates/civo-workload-cluster/kubefirst.yaml deleted file mode 100644 index 8b13789..0000000 --- a/templates/civo-workload-cluster/kubefirst.yaml +++ /dev/null @@ -1 +0,0 @@ - diff --git a/templates/civo-workload-cluster/provider-config/providerconfig.yaml b/templates/civo-workload-cluster/provider-config/providerconfig.yaml deleted file mode 100644 index 31263d9..0000000 --- a/templates/civo-workload-cluster/provider-config/providerconfig.yaml +++ /dev/null @@ -1,53 +0,0 @@ -apiVersion: tf.upbound.io/v1beta1 -kind: ProviderConfig -metadata: - name: - annotations: - argocd.argoproj.io/sync-wave: "-1" -spec: - configuration: | - terraform { - backend "s3" { - bucket = "" - key = "registry/clusters//infrastructure/provider-config/terraform.tfstate" - region = "" - encrypt = true - } - required_providers { - civo = { - source = "civo/civo" - version = "= 1.1.0" - } - aws = { - source = "hashicorp/aws" - version = ">= 5.30.0, < 6.0.0" - } - } - } - provider "aws" { - alias = "PROJECT_REGION" - region = "" - allowed_account_ids = [""] - assume_role_with_web_identity { - session_name = "kubefirst-pro" - role_arn = "" - web_identity_token_file = "/var/run/secrets/eks.amazonaws.com/serviceaccount/token" - } - } - provider "civo" { - credentials_file = "civo.json" - region = "" - } - credentials: - - filename: civo.json - source: Secret - secretRef: - namespace: crossplane-system - name: -civo-creds - key: config.json - - filename: .git-credentials - source: Secret - secretRef: - namespace: crossplane-system - name: git-credentials - key: creds diff --git a/templates/civo/project-cluster/Chart.yaml b/templates/civo/project-cluster/Chart.yaml new file mode 100644 index 0000000..47baa1c --- /dev/null +++ b/templates/civo/project-cluster/Chart.yaml @@ -0,0 +1,15 @@ +apiVersion: v2 +name: civo-project-cluster +description: "Civo project cluster template for Konstruct with ArgoCD Applications, Crossplane infrastructure, and core platform services" +type: application +version: 2.0.0 +appVersion: "2.0" +keywords: + - argocd + - project-cluster + - gitops + - crossplane + - terraform + - civo +maintainers: + - name: Konstruct diff --git a/templates/workload-downstream-cluster/45-environment.yaml b/templates/civo/project-cluster/templates/0-providerconfig.yaml similarity index 55% rename from templates/workload-downstream-cluster/45-environment.yaml rename to templates/civo/project-cluster/templates/0-providerconfig.yaml index 683b7c5..6f4d623 100644 --- a/templates/workload-downstream-cluster/45-environment.yaml +++ b/templates/civo/project-cluster/templates/0-providerconfig.yaml @@ -1,21 +1,21 @@ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: - + name: {{ .Values.workloadClusterName }}-provider-config namespace: argocd finalizers: - resources-finalizer.argocd.argoproj.io annotations: - argocd.argoproj.io/sync-wave: '45' + argocd.argoproj.io/sync-wave: '0' spec: - project: -environment + project: default source: - repoURL: - path: registry/environments// + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/provider-config targetRevision: HEAD destination: name: in-cluster - namespace: -environment + namespace: crossplane-system syncPolicy: automated: prune: true diff --git a/templates/civo/project-cluster/templates/10-infrastructure.yaml b/templates/civo/project-cluster/templates/10-infrastructure.yaml new file mode 100644 index 0000000..c8e5576 --- /dev/null +++ b/templates/civo/project-cluster/templates/10-infrastructure.yaml @@ -0,0 +1,29 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-infrastructure + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/infrastructure + targetRevision: HEAD + destination: + name: in-cluster + namespace: {{ .Values.workloadClusterName }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 30 + backoff: + duration: 1m + factor: 1 diff --git a/templates/workload-downstream-host-vcluster/20-argocd-connection.yaml b/templates/civo/project-cluster/templates/20-argocd-connection.yaml similarity index 59% rename from templates/workload-downstream-host-vcluster/20-argocd-connection.yaml rename to templates/civo/project-cluster/templates/20-argocd-connection.yaml index fe735a7..51a1f83 100644 --- a/templates/workload-downstream-host-vcluster/20-argocd-connection.yaml +++ b/templates/civo/project-cluster/templates/20-argocd-connection.yaml @@ -1,62 +1,62 @@ apiVersion: "external-secrets.io/v1" kind: ExternalSecret metadata: - name: + name: {{ .Values.workloadClusterName }} annotations: argocd.argoproj.io/sync-wave: '20' labels: app.kubernetes.io/part-of: argocd spec: target: - name: + name: {{ .Values.workloadClusterName }} template: metadata: labels: argocd.argoproj.io/secret-type: cluster engineVersion: v2 data: - name: "{{ .cluster_name }}" - server: "{{ .host }}" + name: {{`"{{ .cluster_name }}"`}} + server: {{`"{{ .host }}"`}} clusterResources: "true" config: | { - "bearerToken": "{{ .argocd_manager_sa_token }}", + "bearerToken": {{`"{{ .argocd_manager_sa_token }}"`}}, "tlsClientConfig": { - "caData": "{{ .cluster_ca_certificate | b64enc }}", - "certData": "{{ .client_certificate | b64enc }}", + "caData": {{`"{{ .cluster_ca_certificate | b64enc }}"`}}, + "certData": {{`"{{ .client_certificate | b64enc }}"`}}, "insecure": false, - "keyData": "{{ .client_key | b64enc }}" + "keyData": {{`"{{ .client_key | b64enc }}"`}} } } secretStoreRef: kind: ClusterSecretStore - name: -aws-ssm + name: vault-kv-secret refreshInterval: 10s data: - remoteRef: - key: /clusters/ + key: clusters/{{ .Values.workloadClusterName }} property: argocd_manager_sa_token secretKey: argocd_manager_sa_token - remoteRef: - key: /clusters/ + key: clusters/{{ .Values.workloadClusterName }} property: host secretKey: host - remoteRef: - key: /clusters/ + key: clusters/{{ .Values.workloadClusterName }} property: cluster_name secretKey: cluster_name - remoteRef: - key: /clusters/ + key: clusters/{{ .Values.workloadClusterName }} property: cluster_ca_certificate conversionStrategy: Default secretKey: cluster_ca_certificate - remoteRef: - key: /clusters/ + key: clusters/{{ .Values.workloadClusterName }} property: client_certificate conversionStrategy: Default secretKey: client_certificate - remoteRef: - key: /clusters/ + key: clusters/{{ .Values.workloadClusterName }} property: client_key conversionStrategy: Default secretKey: client_key diff --git a/templates/workload-downstream-host-vcluster/30-cert-manager.yaml b/templates/civo/project-cluster/templates/30-cert-manager.yaml similarity index 71% rename from templates/workload-downstream-host-vcluster/30-cert-manager.yaml rename to templates/civo/project-cluster/templates/30-cert-manager.yaml index a4a6472..ca1ab45 100644 --- a/templates/workload-downstream-host-vcluster/30-cert-manager.yaml +++ b/templates/civo/project-cluster/templates/30-cert-manager.yaml @@ -1,26 +1,28 @@ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: -cert-manager + name: {{ .Values.workloadClusterName }}-cert-manager namespace: argocd finalizers: - resources-finalizer.argocd.argoproj.io annotations: argocd.argoproj.io/sync-wave: '30' spec: - project: -platform + project: {{ .Values.workloadClusterName }} source: repoURL: https://charts.jetstack.io - targetRevision: v1.14.4 + targetRevision: v1.20.1 helm: values: |- serviceAccount: create: true name: cert-manager installCRDs: true + extraArgs: + - --enable-gateway-api chart: cert-manager destination: - name: + name: {{ .Values.workloadClusterName }} namespace: cert-manager syncPolicy: automated: diff --git a/templates/civo/project-cluster/templates/30-clusterissuers.yaml b/templates/civo/project-cluster/templates/30-clusterissuers.yaml new file mode 100644 index 0000000..fea3279 --- /dev/null +++ b/templates/civo/project-cluster/templates/30-clusterissuers.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-cert-issuers + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '40' +spec: + project: {{ .Values.workloadClusterName }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/cert-issuers + targetRevision: HEAD + destination: + name: {{ .Values.workloadClusterName }} + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/civo/project-cluster/templates/30-envoy-gateway.yaml b/templates/civo/project-cluster/templates/30-envoy-gateway.yaml new file mode 100644 index 0000000..6a49300 --- /dev/null +++ b/templates/civo/project-cluster/templates/30-envoy-gateway.yaml @@ -0,0 +1,61 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-envoy-gateway + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: {{ .Values.workloadClusterName }} + source: + repoURL: docker.io/envoyproxy + chart: gateway-helm + targetRevision: v1.7.0 + helm: + valuesObject: + config: + envoyGateway: + logging: + level: + default: info + gateway: + controllerName: gateway.envoyproxy.io/gatewayclass-controller + podDisruptionBudget: + minAvailable: 1 + deployment: + replicas: 1 + envoyGateway: + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: 500m + memory: 512Mi + pod: + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: kubernetes.io/hostname + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: + control-plane: envoy-gateway + destination: + name: {{ .Values.workloadClusterName }} + namespace: envoy-gateway-system + syncPolicy: + automated: + prune: true + selfHeal: true + allowEmpty: false + syncOptions: + - CreateNamespace=true + - ServerSideApply=true + retry: + limit: 5 + backoff: + duration: 5s + factor: 2 + maxDuration: 3m diff --git a/templates/civo/project-cluster/templates/30-external-dns.yaml b/templates/civo/project-cluster/templates/30-external-dns.yaml new file mode 100644 index 0000000..a9c6b3f --- /dev/null +++ b/templates/civo/project-cluster/templates/30-external-dns.yaml @@ -0,0 +1,67 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-external-dns + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: {{ .Values.workloadClusterName }} + source: + repoURL: https://kubernetes-sigs.github.io/external-dns + targetRevision: 1.20.0 + helm: + releaseName: external-dns + values: | + serviceAccount: + create: true + name: external-dns + provider: {{ .Values.externalDnsProviderName }} + sources: + - service + - gateway-httproute + - gateway-tlsroute + - gateway-tcproute + - gateway-udproute + domainFilters: + - {{ .Values.domain }} + env: + - name: {{ .Values.externalDnsProviderTokenEnvName }} + valueFrom: + secretKeyRef: + name: external-dns-secrets + key: token + chart: external-dns + destination: + name: {{ .Values.workloadClusterName }} + namespace: external-dns + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: external-dns-gateway-{{ .Values.workloadClusterName }} +rules: + - apiGroups: ["gateway.networking.k8s.io"] + resources: ["gateways", "httproutes", "grpcroutes", "tlsroutes"] + verbs: ["get", "list", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: external-dns-gateway-{{ .Values.workloadClusterName }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: external-dns-gateway +subjects: + - kind: ServiceAccount + name: external-dns + namespace: external-dns diff --git a/templates/civo/project-cluster/templates/30-external-secrets-operator.yaml b/templates/civo/project-cluster/templates/30-external-secrets-operator.yaml new file mode 100644 index 0000000..cacd679 --- /dev/null +++ b/templates/civo/project-cluster/templates/30-external-secrets-operator.yaml @@ -0,0 +1,73 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-external-secrets-operator + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: {{ .Values.workloadClusterName }} + source: + repoURL: https://charts.external-secrets.io + targetRevision: 0.19.2 + helm: + values: |- + serviceAccount: + create: true + name: external-secrets + chart: external-secrets + destination: + name: {{ .Values.workloadClusterName }} + namespace: external-secrets-operator + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - RespectIgnoreDifferences=true + - ServerSideApply=true + - ServerSideApplyForce=true + ignoreDifferences: + - group: apiextensions.k8s.io + kind: CustomResourceDefinition + jqPathExpressions: + - .spec.conversion.webhook.clientConfig.caBundle + - .spec.conversion.webhook.clientConfig.service.name + - .spec.conversion.webhook.clientConfig.service.namespace + - group: admissionregistration.k8s.io + kind: ValidatingWebhookConfiguration + jqPathExpressions: + - .webhooks[]?.clientConfig.caBundle +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ .Values.workloadClusterName }}-eso-kubernetes-external-secrets-auth + annotations: + argocd.argoproj.io/sync-wave: '40' +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: 'system:auth-delegator' +subjects: + - kind: ServiceAccount + name: external-secrets + namespace: external-secrets-operator +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ .Values.workloadClusterName }}-eso-kubernetes-external-secrets-auth2 + annotations: + argocd.argoproj.io/sync-wave: '40' +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: 'cluster-admin' +subjects: + - kind: ServiceAccount + name: external-secrets + namespace: external-secrets-operator diff --git a/templates/civo/project-cluster/templates/30-reloader.yaml b/templates/civo/project-cluster/templates/30-reloader.yaml new file mode 100644 index 0000000..cfb9074 --- /dev/null +++ b/templates/civo/project-cluster/templates/30-reloader.yaml @@ -0,0 +1,33 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-reloader + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: {{ .Values.workloadClusterName }} + source: + repoURL: 'https://stakater.github.io/stakater-charts' + targetRevision: 2.2.8 + chart: reloader + helm: + values: |- + ignoreSecrets: false + destination: + name: {{ .Values.workloadClusterName }} + namespace: reloader + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/templates/civo/project-cluster/templates/35-crossplane.yaml b/templates/civo/project-cluster/templates/35-crossplane.yaml new file mode 100644 index 0000000..b856f8b --- /dev/null +++ b/templates/civo/project-cluster/templates/35-crossplane.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-crossplane + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "35" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: {{ .Values.workloadClusterName }} + destination: + name: {{ .Values.workloadClusterName }} + namespace: crossplane-system + source: + repoURL: https://charts.crossplane.io/stable + chart: crossplane + targetRevision: 1.17.0 + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/civo/project-cluster/templates/35-envoy-gateway-components.yaml b/templates/civo/project-cluster/templates/35-envoy-gateway-components.yaml new file mode 100644 index 0000000..6fd354c --- /dev/null +++ b/templates/civo/project-cluster/templates/35-envoy-gateway-components.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-envoy-gateway-components + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '35' +spec: + project: {{ .Values.workloadClusterName }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/envoy-gateway + targetRevision: HEAD + destination: + name: {{ .Values.workloadClusterName }} + namespace: envoy-gateway-system + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/civo/project-cluster/templates/40-argocd.yaml b/templates/civo/project-cluster/templates/40-argocd.yaml new file mode 100644 index 0000000..068a8fa --- /dev/null +++ b/templates/civo/project-cluster/templates/40-argocd.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-argocd + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '40' +spec: + project: {{ .Values.workloadClusterName }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/argocd + targetRevision: HEAD + destination: + name: {{ .Values.workloadClusterName }} + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/civo/project-cluster/templates/40-crossplane-components.yaml b/templates/civo/project-cluster/templates/40-crossplane-components.yaml new file mode 100644 index 0000000..9088f94 --- /dev/null +++ b/templates/civo/project-cluster/templates/40-crossplane-components.yaml @@ -0,0 +1,25 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-crossplane-components + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '40' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: {{ .Values.workloadClusterName }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/crossplane-components + targetRevision: HEAD + destination: + name: {{ .Values.workloadClusterName }} + namespace: crossplane-system + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - Replace=true diff --git a/templates/civo-workload-cluster/workloadcluster-platform-project.yaml b/templates/civo/project-cluster/templates/appproject-workload-cluster.yaml similarity index 57% rename from templates/civo-workload-cluster/workloadcluster-platform-project.yaml rename to templates/civo/project-cluster/templates/appproject-workload-cluster.yaml index b23d7d5..889f44f 100644 --- a/templates/civo-workload-cluster/workloadcluster-platform-project.yaml +++ b/templates/civo/project-cluster/templates/appproject-workload-cluster.yaml @@ -1,16 +1,16 @@ apiVersion: argoproj.io/v1alpha1 kind: AppProject metadata: - name: -platform + name: {{ .Values.workloadClusterName }} namespace: argocd annotations: argocd.argoproj.io/sync-wave: "-1" finalizers: - resources-finalizer.argocd.argoproj.io spec: - description: description + description: {{ .Values.workloadClusterName }} description sourceRepos: - - '*' + - '*' destinations: - namespace: '*' server: '*' @@ -18,9 +18,9 @@ spec: - group: '*' kind: '*' roles: - - description: -admin-role + - description: {{ .Values.workloadClusterName }}-admin-role groups: - admins name: admin-role policies: - - p, proj::admin-role, applications, *, /*, allow + - p, proj:{{ .Values.workloadClusterName }}:admin-role, applications, *, {{ .Values.workloadClusterName }}/*, allow diff --git a/templates/civo/project-cluster/templates/argocd/application.yaml b/templates/civo/project-cluster/templates/argocd/application.yaml new file mode 100644 index 0000000..551c824 --- /dev/null +++ b/templates/civo/project-cluster/templates/argocd/application.yaml @@ -0,0 +1,89 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: argocd-application-creator + namespace: argocd +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: argocd-application-creator + namespace: argocd +rules: +- apiGroups: ["argoproj.io"] + resources: ["applications"] + verbs: ["create", "get", "update", "patch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: argocd-application-creator + namespace: argocd +subjects: +- kind: ServiceAccount + name: argocd-application-creator + namespace: argocd +roleRef: + kind: Role + name: argocd-application-creator + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: apply-argocd-clusters-app + namespace: argocd + annotations: + helm.sh/hook: post-install,post-upgrade + helm.sh/hook-delete-policy: before-hook-creation +spec: + template: + spec: + serviceAccountName: argocd-application-creator + restartPolicy: OnFailure + containers: + - name: kubectl + image: {{ .Values.waitJobImage }} + env: + - name: ORG_NAME + value: "{{ .Values.orgName }}" + - name: REPO_NAME + value: "{{ .Values.repoName }}" + - name: CLUSTER_NAME + value: "{{ .Values.workloadClusterName }}" + command: + - /bin/sh + - -c + - | + cat </dev/null; then + echo "Secret exists, patching password..." + kubectl patch secret github-repo-creds -n argocd \ + --type='json' \ + -p="[{\"op\": \"replace\", \"path\": \"/data/password\", \"value\": \"${ENCODED}\"}]" + kubectl label secret github-repo-creds -n argocd \ + argocd.argoproj.io/secret-type=repository --overwrite + echo "Secret patched successfully." + else + echo "Secret not found, creating..." + kubectl create secret generic github-repo-creds -n argocd \ + --from-literal=type=git \ + --from-literal=url="${GITHUB_REPO_URL}" \ + --from-literal=username=x-access-token \ + --from-literal=password="${RESPONSE}" + kubectl label secret github-repo-creds -n argocd \ + argocd.argoproj.io/secret-type=repository + echo "Secret created successfully." + fi + + echo "=== VERIFYING SECRET ===" + kubectl get secret github-repo-creds -n argocd -o jsonpath='{.metadata.labels}' && echo "" + + echo "Done." + restartPolicy: OnFailure +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: github-token-refresher-init + namespace: argocd + annotations: + helm.sh/hook: post-install,post-upgrade + helm.sh/hook-delete-policy: before-hook-creation +spec: + template: + spec: + serviceAccountName: github-token-refresher + containers: + - name: refresher + image: {{ .Values.waitJobImage }} + env: + - name: VENDING_URL + value: "https://konstruct.{{ .Values.domain }}/api/v1/github-token" + - name: TOKEN + valueFrom: + secretKeyRef: + name: platform-cluster-identity + key: token + - name: ORG_ID + valueFrom: + secretKeyRef: + name: platform-cluster-identity + key: org_id + - name: ORG_NAME + value: "{{ .Values.orgName }}" + - name: REPO_NAME + value: "{{ .Values.repoName }}" + command: + - /bin/bash + - -c + - | + set -e + + echo "=== ENV CHECK ===" + echo "VENDING_URL: ${VENDING_URL}" + echo "ORG_ID: ${ORG_ID}" + echo "GITHUB_REPO_URL: https://github.com/${ORG_NAME}/${REPO_NAME}.git" + echo "TOKEN length: ${#TOKEN}" + + echo "=== REQUESTING TOKEN ===" + HTTP_CODE=$(curl -s -o /tmp/response.txt -w "%{http_code}" \ + -X GET "${VENDING_URL}/${ORG_ID}" \ + -H "Authorization: Bearer ${TOKEN}" \ + -H "Content-Type: application/json") + + echo "HTTP status: ${HTTP_CODE}" + + if [ "$HTTP_CODE" != "200" ]; then + echo "Error: non-200 response from vending service" + cat /tmp/response.txt + exit 1 + fi + + RESPONSE=$(cat /tmp/response.txt) + if [ -z "$RESPONSE" ]; then + echo "Error: empty response body" + exit 1 + fi + + echo "=== PATCHING SECRET ===" + GITHUB_REPO_URL="https://github.com/${ORG_NAME}/${REPO_NAME}.git" + ENCODED=$(echo -n "$RESPONSE" | base64 | tr -d '\n') + + if kubectl get secret github-repo-creds -n argocd &>/dev/null; then + echo "Secret exists, patching password..." + kubectl patch secret github-repo-creds -n argocd \ + --type='json' \ + -p="[{\"op\": \"replace\", \"path\": \"/data/password\", \"value\": \"${ENCODED}\"}]" + kubectl label secret github-repo-creds -n argocd \ + argocd.argoproj.io/secret-type=repository --overwrite + echo "Secret patched successfully." + else + echo "Secret not found, creating..." + kubectl create secret generic github-repo-creds -n argocd \ + --from-literal=type=git \ + --from-literal=url="${GITHUB_REPO_URL}" \ + --from-literal=username=x-access-token \ + --from-literal=password="${RESPONSE}" + kubectl label secret github-repo-creds -n argocd \ + argocd.argoproj.io/secret-type=repository + echo "Secret created successfully." + fi + + echo "=== VERIFYING SECRET ===" + kubectl get secret github-repo-creds -n argocd -o jsonpath='{.metadata.labels}' && echo "" + + echo "Done." + restartPolicy: OnFailure diff --git a/templates/civo/project-cluster/templates/argocd/kustomization.yaml b/templates/civo/project-cluster/templates/argocd/kustomization.yaml new file mode 100644 index 0000000..e79db3c --- /dev/null +++ b/templates/civo/project-cluster/templates/argocd/kustomization.yaml @@ -0,0 +1,24 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: argocd + +# To upgrade ArgoCD, increment the version here +# https://github.com/argoproj/argo-cd/tags +resources: + - github.com:konstructio/manifests.git/argocd/cloud?ref=jokestax-patch-2 + - argocd-ui-httproute.yaml + - application.yaml + - rbac.yaml + - github-token-refresher.yaml + +patchesStrategicMerge: + - argocd-cmd-params-cm.yaml + - argocd-server-sa.yaml + - argocd-application-controller-sa.yaml + - argocd-applicationset-controller-sa.yaml + - argocd-server-deployment.yaml + - argocd-application-controller-statefulset.yaml + - argocd-repo-server-deployment.yaml + +generatorOptions: + disableNameSuffixHash: true diff --git a/templates/civo/project-cluster/templates/argocd/rbac.yaml b/templates/civo/project-cluster/templates/argocd/rbac.yaml new file mode 100644 index 0000000..fe19d30 --- /dev/null +++ b/templates/civo/project-cluster/templates/argocd/rbac.yaml @@ -0,0 +1,37 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: argocd-crossplane-viewer +rules: +- apiGroups: + - tf.upbound.io + resources: + - workspaces + - providerconfigs + verbs: + - get + - list + - watch +- apiGroups: + - tf.upbound.io + resources: + - workspaces/status + - providerconfigs/status + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: argocd-crossplane-viewer +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: argocd-crossplane-viewer +subjects: +- kind: ServiceAccount + name: argocd-server + namespace: argocd +- kind: ServiceAccount + name: argocd-application-controller + namespace: argocd diff --git a/templates/civo/project-cluster/templates/cert-issuers/clusterissuers.yaml b/templates/civo/project-cluster/templates/cert-issuers/clusterissuers.yaml new file mode 100644 index 0000000..a4a1cca --- /dev/null +++ b/templates/civo/project-cluster/templates/cert-issuers/clusterissuers.yaml @@ -0,0 +1,35 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-staging +spec: + acme: + server: https://acme-staging-v02.api.letsencrypt.org/directory + email: {{ .Values.email }} + privateKeySecretRef: + name: letsencrypt-staging + solvers: + - http01: + gatewayHTTPRoute: + parentRefs: + - name: eg + namespace: default + kind: Gateway +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-prod +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + email: {{ .Values.email }} + privateKeySecretRef: + name: letsencrypt-prod + solvers: + - http01: + gatewayHTTPRoute: + parentRefs: + - name: eg + namespace: default + kind: Gateway diff --git a/templates/civo/project-cluster/templates/crossplane-components/controllerconfig.yaml b/templates/civo/project-cluster/templates/crossplane-components/controllerconfig.yaml new file mode 100644 index 0000000..a46fb1a --- /dev/null +++ b/templates/civo/project-cluster/templates/crossplane-components/controllerconfig.yaml @@ -0,0 +1,62 @@ +apiVersion: pkg.crossplane.io/v1beta1 +kind: DeploymentRuntimeConfig +metadata: + name: terraform-config + labels: + app: crossplane-provider-terraform + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + serviceAccountTemplate: + metadata: + name: crossplane-provider-terraform-{{ .Values.workloadClusterName }} + deploymentTemplate: + metadata: + spec: + selector: + matchLabels: + pkg.crossplane.io/provider: terraform + template: + metadata: + labels: + pkg.crossplane.io/provider: terraform + spec: + securityContext: + fsGroup: 65532 + containers: + - name: package-runtime + image: ghcr.io/konstructio/provider-terraform:v0.0.1 + args: + - -d + - --poll=4m + - --max-reconcile-rate=10 + envFrom: + - secretRef: + name: crossplane-secrets + volumeMounts: + - mountPath: /.cache + name: helmcache + - mountPath: /logs + name: shared-logs + - name: log-streamer + imagePullPolicy: Always + image: ghcr.io/konstructio/logs-streamer:v0.0.10 + ports: + - containerPort: 9090 + name: http + protocol: TCP + env: + - name: PORT + value: "9090" + - name: LOG_DIR + value: "/logs" + volumeMounts: + - mountPath: /logs + name: shared-logs + readOnly: true + volumes: + - name: helmcache + emptyDir: + sizeLimit: 500Mi + - name: shared-logs + emptyDir: {} diff --git a/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml b/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml new file mode 100644 index 0000000..1f1fccd --- /dev/null +++ b/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml @@ -0,0 +1,185 @@ +apiVersion: batch/v1 +kind: CronJob +metadata: + name: github-token-refresher + namespace: crossplane-system +spec: + schedule: "*/45 * * * *" + jobTemplate: + spec: + template: + spec: + serviceAccountName: github-token-refresher + containers: + - name: refresher + image: {{ .Values.waitJobImage }} + env: + - name: VENDING_URL + value: "https://konstruct.{{ .Values.domain }}/api/v1/github-token" + - name: TOKEN + valueFrom: + secretKeyRef: + name: platform-cluster-identity + key: token + - name: ORG_ID + valueFrom: + secretKeyRef: + name: platform-cluster-identity + key: org_id + command: + - /bin/bash + - -c + - | + set -e + + echo "=== ENV CHECK ===" + echo "VENDING_URL: ${VENDING_URL}" + echo "ORG_ID: ${ORG_ID}" + echo "TOKEN length: ${#TOKEN}" + + echo "=== REQUESTING TOKEN ===" + HTTP_CODE=$(curl -s -o /tmp/response.txt -w "%{http_code}" \ + -X GET "${VENDING_URL}/${ORG_ID}" \ + -H "Authorization: Bearer ${TOKEN}" \ + -H "Content-Type: application/json") + + echo "HTTP status: ${HTTP_CODE}" + + if [ "$HTTP_CODE" != "200" ]; then + echo "Error: non-200 response from vending service" + exit 1 + fi + + RESPONSE=$(cat /tmp/response.txt) + if [ -z "$RESPONSE" ]; then + echo "Error: empty response body" + exit 1 + fi + + echo "=== PATCHING SECRET ===" + CREDS="https://x-access-token:${RESPONSE}@github.com" + + if kubectl get secret git-credentials -n crossplane-system &>/dev/null; then + echo "Secret exists, patching..." + ENCODED=$(echo -n "$CREDS" | base64 | tr -d '\n') + kubectl patch secret git-credentials -n crossplane-system \ + --type='json' \ + -p="[{\"op\": \"replace\", \"path\": \"/data/creds\", \"value\": \"${ENCODED}\"}]" + else + echo "Secret not found, creating..." + kubectl create secret generic git-credentials -n crossplane-system \ + --from-literal=creds="${CREDS}" + fi + + echo "Done." + restartPolicy: OnFailure +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: github-token-refresher + namespace: crossplane-system +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: github-token-refresher +subjects: +- kind: ServiceAccount + name: github-token-refresher + namespace: crossplane-system +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: github-token-refresher-init + namespace: crossplane-system + annotations: + helm.sh/hook: post-install,post-upgrade + helm.sh/hook-delete-policy: before-hook-creation +spec: + template: + spec: + serviceAccountName: github-token-refresher + containers: + - name: refresher + image: {{ .Values.waitJobImage}} + env: + - name: VENDING_URL + value: "https://konstruct.{{ .Values.domain }}/api/v1/github-token" + - name: TOKEN + valueFrom: + secretKeyRef: + name: platform-cluster-identity + key: token + - name: ORG_ID + valueFrom: + secretKeyRef: + name: platform-cluster-identity + key: org_id + command: + - /bin/bash + - -c + - | + set -e + + echo "=== ENV CHECK ===" + echo "VENDING_URL: ${VENDING_URL}" + echo "ORG_ID: ${ORG_ID}" + echo "TOKEN length: ${#TOKEN}" + + echo "=== REQUESTING TOKEN ===" + HTTP_CODE=$(curl -s -o /tmp/response.txt -w "%{http_code}" \ + -X GET "${VENDING_URL}/${ORG_ID}" \ + -H "Authorization: Bearer ${TOKEN}" \ + -H "Content-Type: application/json") + + echo "HTTP status: ${HTTP_CODE}" + + if [ "$HTTP_CODE" != "200" ]; then + echo "Error: non-200 response from vending service" + exit 1 + fi + + RESPONSE=$(cat /tmp/response.txt) + if [ -z "$RESPONSE" ]; then + echo "Error: empty response body" + exit 1 + fi + + echo "=== PATCHING SECRET ===" + CREDS="https://x-access-token:${RESPONSE}@github.com" + + if kubectl get secret git-credentials -n crossplane-system &>/dev/null; then + echo "Secret exists, patching..." + ENCODED=$(echo -n "$CREDS" | base64 | tr -d '\n') + kubectl patch secret git-credentials -n crossplane-system \ + --type='json' \ + -p="[{\"op\": \"replace\", \"path\": \"/data/creds\", \"value\": \"${ENCODED}\"}]" + else + echo "Secret not found, creating..." + kubectl create secret generic git-credentials -n crossplane-system \ + --from-literal=creds="${CREDS}" + fi + + echo "Done." + restartPolicy: OnFailure +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: github-token-refresher + namespace: crossplane-system +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: github-token-refresher + namespace: crossplane-system +rules: +- apiGroups: [""] + resources: ["secrets"] + resourceNames: ["git-credentials"] + verbs: ["get", "patch"] +- apiGroups: [""] + resources: ["secrets"] + verbs: ["create"] diff --git a/templates/civo/project-cluster/templates/crossplane-components/svc.yaml b/templates/civo/project-cluster/templates/crossplane-components/svc.yaml new file mode 100644 index 0000000..d140871 --- /dev/null +++ b/templates/civo/project-cluster/templates/crossplane-components/svc.yaml @@ -0,0 +1,53 @@ +apiVersion: v1 +kind: Service +metadata: + name: log-streamer-service + labels: + app: log-streamer +spec: + ports: + - port: 9090 + targetPort: 9090 + protocol: TCP + name: http + selector: + pkg.crossplane.io/provider: provider-terraform + pkg.crossplane.io/revision: crossplane-provider-terraform-6fe8d52ff0a1 +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: log-streamer + namespace: crossplane-system +spec: + parentRefs: + - name: eg + namespace: default + sectionName: https-logs + hostnames: + - logs-{{ .Values.workloadClusterName }}.{{ .Values.domain }} + rules: + - matches: + - path: + type: PathPrefix + value: / + backendRefs: + - name: log-streamer-service + port: 9090 +--- +apiVersion: gateway.envoyproxy.io/v1alpha1 +kind: BackendTrafficPolicy +metadata: + name: log-streamer-timeout + namespace: crossplane-system +spec: + targetRefs: + - group: gateway.networking.k8s.io + kind: HTTPRoute + name: log-streamer + timeout: + http: + requestTimeout: "3600s" + idleTimeout: "3600s" + tcp: + connectTimeout: "30s" diff --git a/templates/civo/project-cluster/templates/crossplane-components/terraform-provider.yaml b/templates/civo/project-cluster/templates/crossplane-components/terraform-provider.yaml new file mode 100644 index 0000000..8ad0079 --- /dev/null +++ b/templates/civo/project-cluster/templates/crossplane-components/terraform-provider.yaml @@ -0,0 +1,16 @@ +apiVersion: pkg.crossplane.io/v1 +kind: Provider +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: crossplane-provider-terraform +spec: + runtimeConfigRef: + name: terraform-config + ignoreCrossplaneConstraints: false + package: xpkg.upbound.io/upbound/provider-terraform:v0.20.0 + packagePullPolicy: IfNotPresent + revisionActivationPolicy: Automatic + revisionHistoryLimit: 1 + skipDependencyResolution: false + diff --git a/templates/civo/project-cluster/templates/envoy-gateway/envoy-proxy.yaml b/templates/civo/project-cluster/templates/envoy-gateway/envoy-proxy.yaml new file mode 100644 index 0000000..c5f7d89 --- /dev/null +++ b/templates/civo/project-cluster/templates/envoy-gateway/envoy-proxy.yaml @@ -0,0 +1,33 @@ +apiVersion: gateway.envoyproxy.io/v1alpha1 +kind: EnvoyProxy +metadata: + name: proxy-config + namespace: envoy-gateway-system + annotations: + argocd.argoproj.io/sync-wave: "30" +spec: + provider: + type: Kubernetes + kubernetes: + envoyDeployment: + replicas: 3 + pod: + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: kubernetes.io/hostname + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: + app.kubernetes.io/component: proxy + container: + resources: + requests: + cpu: 200m + memory: 256Mi + limits: + cpu: "1" + memory: 512Mi + concurrency: 0 + shutdown: + drainTimeout: 30s + minDrainDuration: 5s diff --git a/templates/civo/project-cluster/templates/envoy-gateway/gateway-class.yaml b/templates/civo/project-cluster/templates/envoy-gateway/gateway-class.yaml new file mode 100644 index 0000000..f852ba6 --- /dev/null +++ b/templates/civo/project-cluster/templates/envoy-gateway/gateway-class.yaml @@ -0,0 +1,13 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: GatewayClass +metadata: + name: eg + annotations: + argocd.argoproj.io/sync-wave: "30" +spec: + controllerName: gateway.envoyproxy.io/gatewayclass-controller + parametersRef: + group: gateway.envoyproxy.io + kind: EnvoyProxy + name: proxy-config + namespace: envoy-gateway-system diff --git a/templates/civo/project-cluster/templates/envoy-gateway/gateway.yaml b/templates/civo/project-cluster/templates/envoy-gateway/gateway.yaml new file mode 100644 index 0000000..87c371e --- /dev/null +++ b/templates/civo/project-cluster/templates/envoy-gateway/gateway.yaml @@ -0,0 +1,56 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: Gateway +metadata: + name: eg + namespace: default + annotations: + argocd.argoproj.io/sync-wave: "35" + cert-manager.io/cluster-issuer: "letsencrypt-prod" +spec: + gatewayClassName: eg + listeners: + - name: http + protocol: HTTP + port: 80 + allowedRoutes: + namespaces: + from: All + + - name: https-argocd + hostname: argocd-{{ .Values.workloadClusterName }}.{{ .Values.domain }} + protocol: HTTPS + port: 443 + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: argocd-ingress-http + allowedRoutes: + namespaces: + from: All + + - name: https-grpc-argocd + hostname: grpc-{{ .Values.workloadClusterName }}.argocd.{{ .Values.domain }} + protocol: HTTPS + port: 443 + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: argocd-ingress-grpc + allowedRoutes: + namespaces: + from: All + + - name: https-logs + hostname: logs-{{ .Values.workloadClusterName }}.{{ .Values.domain }} + protocol: HTTPS + port: 443 + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: logs-mgmt-cluster + allowedRoutes: + namespaces: + from: All diff --git a/templates/civo/project-cluster/templates/envoy-gateway/http-redirect.yaml b/templates/civo/project-cluster/templates/envoy-gateway/http-redirect.yaml new file mode 100644 index 0000000..0302ccf --- /dev/null +++ b/templates/civo/project-cluster/templates/envoy-gateway/http-redirect.yaml @@ -0,0 +1,18 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: http-to-https-redirect + namespace: default + annotations: + argocd.argoproj.io/sync-wave: "35" +spec: + parentRefs: + - name: eg + namespace: default + sectionName: http + rules: + - filters: + - type: RequestRedirect + requestRedirect: + scheme: https + statusCode: 301 diff --git a/templates/civo/project-cluster/templates/envoy-gateway/wait.yaml b/templates/civo/project-cluster/templates/envoy-gateway/wait.yaml new file mode 100644 index 0000000..13c099e --- /dev/null +++ b/templates/civo/project-cluster/templates/envoy-gateway/wait.yaml @@ -0,0 +1,59 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-toolkit-envoy-gateway + namespace: envoy-gateway-system +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: k8s-toolkit-envoy-gateway + namespace: envoy-gateway-system +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: k8s-toolkit-envoy-gateway + namespace: envoy-gateway-system +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: k8s-toolkit-envoy-gateway +subjects: + - kind: ServiceAccount + name: k8s-toolkit-envoy-gateway + namespace: envoy-gateway-system +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-envoy-gateway + namespace: envoy-gateway-system +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - envoy-gateway-system + - --label + - app.kubernetes.io/name=gateway-helm + image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-envoy-gateway diff --git a/templates/workload-project-cluster/infrastructure/wait.yaml b/templates/civo/project-cluster/templates/infrastructure/wait.yaml similarity index 61% rename from templates/workload-project-cluster/infrastructure/wait.yaml rename to templates/civo/project-cluster/templates/infrastructure/wait.yaml index c39c293..8238d93 100644 --- a/templates/workload-project-cluster/infrastructure/wait.yaml +++ b/templates/civo/project-cluster/templates/infrastructure/wait.yaml @@ -1,7 +1,7 @@ apiVersion: batch/v1 kind: Job metadata: - name: -infrastructure-wait + name: {{ .Values.workloadClusterName }}-infrastructure-wait namespace: argocd annotations: argocd.argoproj.io/sync-wave: "20" @@ -11,14 +11,11 @@ spec: serviceAccountName: argocd-server containers: - name: wait - image: dtzar/helm-kubectl:3.19.0 + image: {{ .Values.waitJobImage }} command: - /bin/sh - -c - | - while ! kubectl wait --for=jsonpath='{.status.conditions[0].status}'='True' workspace/-infrastructure; do echo "waiting for cluster to provision"; sleep 5; done + while ! kubectl wait --for=jsonpath='{.status.conditions[0].status}'='True' workspace/{{ .Values.workloadClusterName }}-infrastructure; do echo "waiting for cluster to provision"; sleep 5; done restartPolicy: Never backoffLimit: 1 - - - diff --git a/templates/civo/project-cluster/templates/infrastructure/workspace.yaml b/templates/civo/project-cluster/templates/infrastructure/workspace.yaml new file mode 100644 index 0000000..bc90aa5 --- /dev/null +++ b/templates/civo/project-cluster/templates/infrastructure/workspace.yaml @@ -0,0 +1,22 @@ +apiVersion: tf.upbound.io/v1beta1 +kind: Workspace +metadata: + name: {{ .Values.workloadClusterName }}-infrastructure +spec: + providerConfigRef: + name: {{ .Values.workloadClusterName }} + forProvider: + source: Remote + module: {{ .Values.workloadClusterTerraformModuleUrl }} + enableTerraformCLILogging: true + vars: + - key: cluster_name + value: "{{ .Values.workloadClusterName }}" + - key: cluster_region + value: "{{ .Values.workloadClusterRegion }}" + - key: node_count + value: "{{ .Values.workloadNodeCount }}" + - key: node_type + value: "{{ .Values.workloadNodeType }}" + - key: project_name + value: "{{ .Values.workloadClusterProjectName }}" diff --git a/templates/civo/project-cluster/templates/provider-config/providerconfig.yaml b/templates/civo/project-cluster/templates/provider-config/providerconfig.yaml new file mode 100644 index 0000000..099aee4 --- /dev/null +++ b/templates/civo/project-cluster/templates/provider-config/providerconfig.yaml @@ -0,0 +1,56 @@ +apiVersion: tf.upbound.io/v1beta1 +kind: ProviderConfig +metadata: + name: {{ .Values.workloadClusterName }} + annotations: + argocd.argoproj.io/sync-wave: "-1" +spec: + configuration: | + terraform { + backend "s3" { + bucket = "{{ .Values.kubefirstStateStoreBucket }}" + key = "registry/konstruct-clusters/{{ .Values.workloadClusterName }}/infrastructure/provider-config/terraform.tfstate" + region = "{{ .Values.mainMgmtcloudRegion }}" + endpoint = "https://objectstore.{{ .Values.mainMgmtcloudRegion }}.civo.com" + + skip_credentials_validation = true + skip_metadata_api_check = true + skip_region_validation = true + force_path_style = true + } + required_providers { + civo = { + source = "civo/civo" + version = "= 1.1.0" + } + } + } + provider "civo" { + credentials_file = "projectcluster-civo.json" + region = "{{ .Values.workloadClusterRegion }}" + } + provider "civo" { + alias = "kubefirst_mgmt_s3_bucket_region" + credentials_file = "civo.json" + region = "{{ .Values.mainMgmtcloudRegion }}" + } + pluginCache: false + credentials: + - filename: projectcluster-civo.json + source: Secret + secretRef: + namespace: crossplane-system + name: {{ .Values.workloadClusterName }}-civo-creds + key: config.json + - filename: civo.json + source: Secret + secretRef: + namespace: crossplane-system + name: civo-creds + key: config.json + - filename: .git-credentials + source: Secret + secretRef: + namespace: crossplane-system + name: git-credentials + key: creds diff --git a/templates/civo/project-cluster/templates/registry-workload-cluster.yaml b/templates/civo/project-cluster/templates/registry-workload-cluster.yaml new file mode 100644 index 0000000..ae80f4c --- /dev/null +++ b/templates/civo/project-cluster/templates/registry-workload-cluster.yaml @@ -0,0 +1,30 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: registry-{{ .Values.workloadClusterName }} + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '100' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: default + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/konstruct-clusters/{{ .Values.workloadClusterName }} + targetRevision: HEAD + destination: + server: https://kubernetes.default.svc + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 5 + backoff: + duration: 1m + maxDuration: 15m0s + factor: 2 diff --git a/templates/civo/project-cluster/values.yaml b/templates/civo/project-cluster/values.yaml new file mode 100644 index 0000000..a134ccd --- /dev/null +++ b/templates/civo/project-cluster/values.yaml @@ -0,0 +1,16 @@ +workloadClusterTerraformModuleUrl: "git::https://github.com/konstructio/konstruct-templates.git//terraform/civo/modules/project-cluster?ref=saas-rishi" + +# @input.type: string +# @input.description: Alert email address for cert-manager notifications +# @input.required: false +email: 123@gmail.com + +# Wait Job Configuration +waitJobImage: "dtzar/helm-kubectl:3.19.0" + + +domain: saas.konstruct.io + +externalDnsProviderName: cloudflare + +externalDnsProviderTokenEnvName: CF_API_TOKEN diff --git a/templates/civo/workload-cluster/Chart.yaml b/templates/civo/workload-cluster/Chart.yaml new file mode 100644 index 0000000..b5ea525 --- /dev/null +++ b/templates/civo/workload-cluster/Chart.yaml @@ -0,0 +1,15 @@ +apiVersion: v2 +name: civo-workload-cluster +description: "Civo workload cluster template for Konstruct with ArgoCD Applications and core platform services" +type: application +version: 2.0.0 +appVersion: "2.0" +keywords: + - argocd + - workload-cluster + - gitops + - crossplane + - terraform + - civo +maintainers: + - name: Konstruct diff --git a/templates/workload-downstream-host-vcluster/0-providerconfig.yaml b/templates/civo/workload-cluster/templates/0-providerconfig.yaml similarity index 71% rename from templates/workload-downstream-host-vcluster/0-providerconfig.yaml rename to templates/civo/workload-cluster/templates/0-providerconfig.yaml index cac4df0..9093291 100644 --- a/templates/workload-downstream-host-vcluster/0-providerconfig.yaml +++ b/templates/civo/workload-cluster/templates/0-providerconfig.yaml @@ -1,7 +1,7 @@ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: -provider-config + name: {{ .Values.workloadClusterName }}-provider-config namespace: argocd finalizers: - resources-finalizer.argocd.argoproj.io @@ -10,8 +10,8 @@ metadata: spec: project: default source: - repoURL: - path: registry/clusters//provider-config + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.workloadClusterName }}/provider-config targetRevision: HEAD destination: name: in-cluster diff --git a/templates/civo-workload-cluster/10-infrastructure.yaml b/templates/civo/workload-cluster/templates/10-infrastructure.yaml similarity index 64% rename from templates/civo-workload-cluster/10-infrastructure.yaml rename to templates/civo/workload-cluster/templates/10-infrastructure.yaml index 5e2a0de..47c45de 100644 --- a/templates/civo-workload-cluster/10-infrastructure.yaml +++ b/templates/civo/workload-cluster/templates/10-infrastructure.yaml @@ -1,7 +1,7 @@ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: -infrastructure + name: {{ .Values.workloadClusterName }}-infrastructure namespace: argocd finalizers: - resources-finalizer.argocd.argoproj.io @@ -10,12 +10,12 @@ metadata: spec: project: default source: - repoURL: - path: registry/clusters//infrastructure + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.workloadClusterName }}/infrastructure targetRevision: HEAD destination: name: in-cluster - namespace: + namespace: {{ .Values.workloadClusterName }} syncPolicy: automated: prune: true diff --git a/templates/civo/workload-cluster/templates/30-cert-manager.yaml b/templates/civo/workload-cluster/templates/30-cert-manager.yaml new file mode 100644 index 0000000..18eedad --- /dev/null +++ b/templates/civo/workload-cluster/templates/30-cert-manager.yaml @@ -0,0 +1,35 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-cert-manager + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: {{ .Values.workloadClusterName }}-platform + source: + repoURL: https://charts.jetstack.io + targetRevision: v1.16.5 + helm: + values: |- + serviceAccount: + create: true + name: cert-manager + installCRDs: true + startupapicheck: + enabled: false + extraArgs: + - --enable-gateway-api + chart: cert-manager + destination: + name: {{ .Values.workloadClusterName }} + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/templates/civo/workload-cluster/templates/30-envoy-gateway.yaml b/templates/civo/workload-cluster/templates/30-envoy-gateway.yaml new file mode 100644 index 0000000..558132f --- /dev/null +++ b/templates/civo/workload-cluster/templates/30-envoy-gateway.yaml @@ -0,0 +1,61 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-envoy-gateway + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: {{ .Values.workloadClusterName }}-platform + source: + repoURL: docker.io/envoyproxy + chart: gateway-helm + targetRevision: v1.7.0 + helm: + valuesObject: + config: + envoyGateway: + logging: + level: + default: info + gateway: + controllerName: gateway.envoyproxy.io/gatewayclass-controller + podDisruptionBudget: + minAvailable: 1 + deployment: + replicas: 1 + envoyGateway: + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: 500m + memory: 512Mi + pod: + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: kubernetes.io/hostname + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: + control-plane: envoy-gateway + destination: + name: {{ .Values.workloadClusterName }} + namespace: envoy-gateway-system + syncPolicy: + automated: + prune: true + selfHeal: true + allowEmpty: false + syncOptions: + - CreateNamespace=true + - ServerSideApply=true + retry: + limit: 5 + backoff: + duration: 5s + factor: 2 + maxDuration: 3m diff --git a/templates/workload-downstream-host-vcluster/30-reloader.yaml b/templates/civo/workload-cluster/templates/30-reloader.yaml similarity index 79% rename from templates/workload-downstream-host-vcluster/30-reloader.yaml rename to templates/civo/workload-cluster/templates/30-reloader.yaml index 3bf9dd4..f6dd120 100644 --- a/templates/workload-downstream-host-vcluster/30-reloader.yaml +++ b/templates/civo/workload-cluster/templates/30-reloader.yaml @@ -1,12 +1,12 @@ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: -reloader + name: {{ .Values.workloadClusterName }}-reloader namespace: argocd annotations: argocd.argoproj.io/sync-wave: '30' spec: - project: -platform + project: {{ .Values.workloadClusterName }}-platform source: repoURL: 'https://stakater.github.io/stakater-charts' targetRevision: v1.0.10 @@ -15,7 +15,7 @@ spec: values: |- ignoreSecrets: false destination: - name: + name: {{ .Values.workloadClusterName }} namespace: reloader syncPolicy: automated: diff --git a/templates/civo/workload-cluster/templates/45-environment.yaml b/templates/civo/workload-cluster/templates/45-environment.yaml new file mode 100644 index 0000000..16146b0 --- /dev/null +++ b/templates/civo/workload-cluster/templates/45-environment.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-{{ .Values.envName }} + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '45' +spec: + project: {{ .Values.workloadClusterName }}-environment + source: + repoURL: {{ .Values.teamGitopsRepoUrl }} + path: registry/environments/{{ .Values.envName }}/{{ .Values.workloadClusterName }} + targetRevision: HEAD + destination: + name: in-cluster + namespace: {{ .Values.workloadClusterName }}-environment + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/civo/workload-cluster/templates/infrastructure/wait.yaml b/templates/civo/workload-cluster/templates/infrastructure/wait.yaml new file mode 100644 index 0000000..8238d93 --- /dev/null +++ b/templates/civo/workload-cluster/templates/infrastructure/wait.yaml @@ -0,0 +1,21 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ .Values.workloadClusterName }}-infrastructure-wait + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "20" +spec: + template: + spec: + serviceAccountName: argocd-server + containers: + - name: wait + image: {{ .Values.waitJobImage }} + command: + - /bin/sh + - -c + - | + while ! kubectl wait --for=jsonpath='{.status.conditions[0].status}'='True' workspace/{{ .Values.workloadClusterName }}-infrastructure; do echo "waiting for cluster to provision"; sleep 5; done + restartPolicy: Never + backoffLimit: 1 diff --git a/templates/civo/workload-cluster/templates/infrastructure/workspace.yaml b/templates/civo/workload-cluster/templates/infrastructure/workspace.yaml new file mode 100644 index 0000000..6e77647 --- /dev/null +++ b/templates/civo/workload-cluster/templates/infrastructure/workspace.yaml @@ -0,0 +1,22 @@ +apiVersion: tf.upbound.io/v1beta1 +kind: Workspace +metadata: + name: {{ .Values.workloadClusterName }}-infrastructure +spec: + providerConfigRef: + name: {{ .Values.workloadClusterName }} + forProvider: + source: Remote + module: {{ .Values.workloadClusterTerraformModuleUrl }} + vars: + - key: cluster_name + value: {{ .Values.workloadClusterName }} + - key: cluster_region + value: {{ .Values.workloadClusterRegion }} + - key: environment + value: {{ .Values.workloadClusterName }} + - key: node_count + value: "{{ .Values.workloadNodeCount }}" + - key: node_type + value: {{ .Values.workloadNodeType }} + diff --git a/templates/civo/workload-cluster/templates/provider-config/providerconfig.yaml b/templates/civo/workload-cluster/templates/provider-config/providerconfig.yaml new file mode 100644 index 0000000..46c0185 --- /dev/null +++ b/templates/civo/workload-cluster/templates/provider-config/providerconfig.yaml @@ -0,0 +1,45 @@ +apiVersion: tf.upbound.io/v1beta1 +kind: ProviderConfig +metadata: + name: {{ .Values.workloadClusterName }} + annotations: + argocd.argoproj.io/sync-wave: "-1" +spec: + configuration: | + terraform { + backend "s3" { + key = "registry/konstruct-clusters/{{ .Values.workloadClusterName }}/infrastructure/provider-config/terraform.tfstate" + bucket = "{{ .Values.projectStateStoreBucket }}" + region = "{{ .Values.projectRegion }}" + endpoint = "https://objectstore.{{ .Values.projectRegion }}.civo.com" + + skip_credentials_validation = true + skip_metadata_api_check = true + skip_region_validation = true + force_path_style = true + } + required_providers { + civo = { + source = "civo/civo" + version = "= 1.1.0" + } + } + } + provider "civo" { + credentials_file = "civo.json" + region = "{{ .Values.workloadClusterRegion }}" + } + pluginCache: false + credentials: + - filename: civo.json + source: Secret + secretRef: + namespace: crossplane-system + name: {{ .Values.cloudAccountName }}-civo-creds + key: config.json + - filename: .git-credentials + source: Secret + secretRef: + namespace: crossplane-system + name: git-credentials + key: creds diff --git a/templates/workload-downstream-cluster/registry-workload-cluster.yaml b/templates/civo/workload-cluster/templates/registry-workload-cluster.yaml similarity index 78% rename from templates/workload-downstream-cluster/registry-workload-cluster.yaml rename to templates/civo/workload-cluster/templates/registry-workload-cluster.yaml index 941b9e7..0136813 100644 --- a/templates/workload-downstream-cluster/registry-workload-cluster.yaml +++ b/templates/civo/workload-cluster/templates/registry-workload-cluster.yaml @@ -1,7 +1,7 @@ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: registry- + name: registry-{{ .Values.workloadClusterName }} namespace: argocd annotations: argocd.argoproj.io/sync-wave: '100' @@ -10,8 +10,8 @@ metadata: spec: project: default source: - repoURL: - path: registry/clusters/ + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.workloadClusterName }} targetRevision: HEAD destination: server: https://kubernetes.default.svc @@ -28,4 +28,3 @@ spec: duration: 1m maxDuration: 15m0s factor: 2 - diff --git a/templates/civo/workload-cluster/templates/workloadcluster-environment-project.yaml b/templates/civo/workload-cluster/templates/workloadcluster-environment-project.yaml new file mode 100644 index 0000000..56ac444 --- /dev/null +++ b/templates/civo/workload-cluster/templates/workloadcluster-environment-project.yaml @@ -0,0 +1,26 @@ +apiVersion: argoproj.io/v1alpha1 +kind: AppProject +metadata: + name: {{ .Values.workloadClusterName }}-environment + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "-1" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + description: {{ .Values.workloadClusterName }} description + sourceRepos: + - '{{ .Values.gitopsRepoUrl }}' + destinations: + - name: in-cluster + namespace: {{ .Values.workloadClusterName }}-environment + clusterResourceWhitelist: + - group: '*' + kind: '*' + roles: + - description: {{ .Values.workloadClusterName }}-admin-role + groups: + - admins + name: admin-role + policies: + - p, proj:{{ .Values.workloadClusterName }}:admin-role, applications, *, {{ .Values.workloadClusterName }}/*, allow diff --git a/templates/workload-downstream-host-vcluster/workloadcluster-environment-project.yaml b/templates/civo/workload-cluster/templates/workloadcluster-platform-project.yaml similarity index 50% rename from templates/workload-downstream-host-vcluster/workloadcluster-environment-project.yaml rename to templates/civo/workload-cluster/templates/workloadcluster-platform-project.yaml index ca7d2aa..7a63f6d 100644 --- a/templates/workload-downstream-host-vcluster/workloadcluster-environment-project.yaml +++ b/templates/civo/workload-cluster/templates/workloadcluster-platform-project.yaml @@ -1,26 +1,26 @@ apiVersion: argoproj.io/v1alpha1 kind: AppProject metadata: - name: -environment + name: {{ .Values.workloadClusterName }}-platform namespace: argocd annotations: argocd.argoproj.io/sync-wave: "-1" finalizers: - resources-finalizer.argocd.argoproj.io spec: - description: description + description: {{ .Values.workloadClusterName }} description sourceRepos: - - '' + - '*' destinations: - - name: in-cluster - namespace: -environment + - namespace: '*' + server: '*' clusterResourceWhitelist: - group: '*' kind: '*' roles: - - description: -admin-role + - description: {{ .Values.workloadClusterName }}-admin-role groups: - admins name: admin-role policies: - - p, proj::admin-role, applications, *, /*, allow + - p, proj:{{ .Values.workloadClusterName }}:admin-role, applications, *, {{ .Values.workloadClusterName }}/*, allow diff --git a/templates/civo/workload-cluster/templates/workloadcluster-project.yaml b/templates/civo/workload-cluster/templates/workloadcluster-project.yaml new file mode 100644 index 0000000..b9d63c1 --- /dev/null +++ b/templates/civo/workload-cluster/templates/workloadcluster-project.yaml @@ -0,0 +1,27 @@ +apiVersion: argoproj.io/v1alpha1 +kind: AppProject +metadata: + name: {{ .Values.workloadClusterName }} + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "-1" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + description: {{ .Values.workloadClusterName }} description + sourceNamespaces: ["{{ .Values.workloadClusterName }}-environment"] + sourceRepos: + - '*' + destinations: + - name: {{ .Values.workloadClusterName }} + namespace: '*' + clusterResourceWhitelist: + - group: '*' + kind: '*' + roles: + - description: {{ .Values.workloadClusterName }}-admin-role + groups: + - admins + name: admin-role + policies: + - p, proj:{{ .Values.workloadClusterName }}:admin-role, applications, *, {{ .Values.workloadClusterName }}/*, allow diff --git a/templates/civo/workload-cluster/values.yaml b/templates/civo/workload-cluster/values.yaml new file mode 100644 index 0000000..f3240d9 --- /dev/null +++ b/templates/civo/workload-cluster/values.yaml @@ -0,0 +1,8 @@ +# Terraform Module Configuration +# @input.type: string +# @input.description: the complete URL for the Terraform module for infrastructure provisioning +# @input.required: true +workloadClusterTerraformModuleUrl: "git::https://github.com/konstructio/konstruct-templates.git//civo-github/terraform/civo/modules/workload-cluster?ref=main" + +# Wait Job Configuration +waitJobImage: "dtzar/helm-kubectl:3.19.0" diff --git a/templates/workflows/deploy.yaml b/templates/workflows/deploy.yaml index 238552d..57a604a 100644 --- a/templates/workflows/deploy.yaml +++ b/templates/workflows/deploy.yaml @@ -8,7 +8,7 @@ on: required: true type: choice options: - - + - app_version: description: 'Application version to deploy' required: true @@ -24,10 +24,19 @@ jobs: trigger-update: runs-on: ubuntu-latest steps: + - name: Generate GitHub App token + id: app-token + uses: actions/create-github-app-token@v1 + with: + app-id: ${{ secrets.APP_ID }} + private-key: ${{ secrets.APP_PRIVATE_KEY }} + owner: + repositories: + - name: Trigger workflow uses: actions/github-script@v7 with: - github-token: ${{ secrets.WORKFLOW_TRIGGER_TOKEN }} + github-token: ${{ steps.app-token.outputs.token }} script: | await github.rest.actions.createWorkflowDispatch({ owner: '', @@ -44,7 +53,6 @@ jobs: }); console.log('✅ Triggered update workflow'); - # Stage 3: Notify notify: runs-on: ubuntu-latest needs: trigger-update diff --git a/templates/workflows/publish.yaml b/templates/workflows/publish.yaml index 6edfc7d..50641b3 100644 --- a/templates/workflows/publish.yaml +++ b/templates/workflows/publish.yaml @@ -1,4 +1,4 @@ -name: Publish image and helm chart to ECR +name: Publish image and helm chart to GHCR on: workflow_dispatch: push: @@ -6,12 +6,8 @@ on: - main permissions: - id-token: write contents: read - -env: - AWS_REGION: - ASSUME_ROLE_ARN: + packages: write jobs: publish: @@ -38,26 +34,26 @@ jobs: sudo mv linux-amd64/helm /usr/local/bin/helm helm version - - name: configure aws credentials - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 + - name: Login to GitHub Container Registry + uses: docker/login-action@v3 with: - role-to-assume: ${{ env.ASSUME_ROLE_ARN }} - aws-region: ${{ env.AWS_REGION }} - - - name: Login to Amazon ECR - id: login-ecr - uses: aws-actions/amazon-ecr-login@v2 + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} - - name: Build, tag, and push image to Amazon ECR + - name: Build, tag, and push image to GHCR env: - ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }} + REGISTRY: ghcr.io ECR_REPOSITORY: ${{ steps.extract-repo-name.outputs.repo_name }} REPO_OWNER: ${{ github.repository_owner }} SHORT_SHA: ${{ steps.get-sha.outputs.SHORT_SHA }} run: | - docker build -t $ECR_REGISTRY/$REPO_OWNER/$ECR_REPOSITORY:$SHORT_SHA . - docker push $ECR_REGISTRY/$REPO_OWNER/$ECR_REPOSITORY:$SHORT_SHA - echo "Pushed image: $ECR_REGISTRY/$REPO_OWNER/$ECR_REPOSITORY:$SHORT_SHA" + IMAGE="$REGISTRY/$REPO_OWNER/$ECR_REPOSITORY:$SHORT_SHA" + # GHCR requires lowercase image names + IMAGE=$(echo "$IMAGE" | tr '[:upper:]' '[:lower:]') + docker build -t "$IMAGE" . + docker push "$IMAGE" + echo "Pushed image: $IMAGE" - name: Update Chart.yaml env: @@ -66,35 +62,37 @@ jobs: SHORT_SHA: ${{ steps.get-sha.outputs.SHORT_SHA }} run: | cd charts/$REPO_OWNER/$ECR_REPOSITORY - + CURRENT_VERSION=$(grep '^version:' Chart.yaml | awk '{print $2}') BASE_VERSION=${CURRENT_VERSION%-rc.*} NEW_VERSION="${BASE_VERSION}-rc.${SHORT_SHA}" - + sed -i "s/^version: .*$/version: ${NEW_VERSION}/" Chart.yaml sed -i "s/^appVersion: .*$/appVersion: \"${SHORT_SHA}\"/" Chart.yaml - + echo "📝 Updated Chart.yaml:" grep -E '^(version|appVersion):' Chart.yaml - - name: push-chart-to-ecr + - name: Push chart to GHCR id: publish-chart env: - ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }} + REGISTRY: ghcr.io ECR_REPOSITORY: ${{ steps.extract-repo-name.outputs.repo_name }} REPO_OWNER: ${{ github.repository_owner }} SHORT_SHA: ${{ steps.get-sha.outputs.SHORT_SHA }} run: | cd charts/$REPO_OWNER/$ECR_REPOSITORY - + helm package . - + CHART_NAME=$(grep "^name:" Chart.yaml | awk '{print $2}') CHART_VERSION=$(grep "^version:" Chart.yaml | awk '{print $2}') CHART_ARCHIVE_FILE="${CHART_NAME}-${CHART_VERSION}.tgz" - - helm push "$CHART_ARCHIVE_FILE" "oci://$ECR_REGISTRY/$REPO_OWNER/charts" - + + # Helm OCI push to GHCR (must be lowercase) + OCI_REF="oci://$REGISTRY/$(echo $REPO_OWNER | tr '[:upper:]' '[:lower:]')/charts" + helm push "$CHART_ARCHIVE_FILE" "$OCI_REF" + echo "✅ Pushed chart: $CHART_ARCHIVE_FILE" echo "chart_version=$CHART_VERSION" >> $GITHUB_OUTPUT echo "chart_name=$CHART_NAME" >> $GITHUB_OUTPUT @@ -103,6 +101,6 @@ jobs: run: | echo "### 🚀 Deployment Summary" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY - echo "**Image**: \`${{ steps.login-ecr.outputs.registry }}/${{ github.repository_owner }}/${{ steps.extract-repo-name.outputs.repo_name }}:${{ steps.get-sha.outputs.SHORT_SHA }}\`" >> $GITHUB_STEP_SUMMARY + echo "**Image**: \`ghcr.io/${{ github.repository_owner }}/${{ steps.extract-repo-name.outputs.repo_name }}:${{ steps.get-sha.outputs.SHORT_SHA }}\`" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "**Chart**: \`${{ steps.publish-chart.outputs.chart_name }}:${{ steps.publish-chart.outputs.chart_version }}\`" >> $GITHUB_STEP_SUMMARY diff --git a/templates/workload-downstream-host-vcluster/workloadcluster-project.yaml b/templates/workload-downstream-host-vcluster/workloadcluster-project.yaml deleted file mode 100644 index d4c5cff..0000000 --- a/templates/workload-downstream-host-vcluster/workloadcluster-project.yaml +++ /dev/null @@ -1,27 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: AppProject -metadata: - name: - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: "-1" - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - description: description - sourceNamespaces: ["-environment"] - sourceRepos: - - '' - destinations: - - name: - namespace: '*' - clusterResourceWhitelist: - - group: '*' - kind: '*' - roles: - - description: -admin-role - groups: - - admins - name: admin-role - policies: - - p, proj::admin-role, applications, *, /*, allow diff --git a/terraform/civo/modules/project-cluster/main.tf b/terraform/civo/modules/project-cluster/main.tf new file mode 100644 index 0000000..cd71d65 --- /dev/null +++ b/terraform/civo/modules/project-cluster/main.tf @@ -0,0 +1,222 @@ +# S3 Bucket + +resource "civo_object_store" "backup" { + name = "k1-project-${var.cluster_name}" + max_size_gb = 500 + region = var.cluster_region +} + +# If you create the bucket without credentials, you can read the credentials in this way +data "civo_object_store_credential" "backup" { + id = civo_object_store.backup.access_key_id +} + +# Project Cluster + +resource "civo_network" "project-cluster" { + label = var.cluster_name +} + +resource "civo_firewall" "project-cluster" { + name = var.cluster_name + network_id = civo_network.project-cluster.id + create_default_rules = true +} + +resource "civo_kubernetes_cluster" "project-cluster" { + name = var.cluster_name + network_id = civo_network.project-cluster.id + firewall_id = civo_firewall.project-cluster.id + write_kubeconfig = true + cluster_type = "k3s" + kubernetes_version = "1.35.0-k3s1" + pools { + label = var.cluster_name + size = var.node_type + node_count = var.node_count + } +} + +resource "vault_generic_secret" "clusters" { + path = "secret/clusters/${var.cluster_name}" + + data_json = jsonencode( + { + kubeconfig = civo_kubernetes_cluster.project-cluster.kubeconfig + client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.project-cluster.kubeconfig).users[0].user.client-certificate-data) + client_key = base64decode(yamldecode(civo_kubernetes_cluster.project-cluster.kubeconfig).users[0].user.client-key-data) + cluster_ca_certificate = base64decode(yamldecode(civo_kubernetes_cluster.project-cluster.kubeconfig).clusters[0].cluster.certificate-authority-data) + host = civo_kubernetes_cluster.project-cluster.api_endpoint + cluster_name = var.cluster_name + argocd_manager_sa_token = kubernetes_secret_v1.argocd_manager.data.token + } + ) +} + +provider "kubernetes" { + host = civo_kubernetes_cluster.project-cluster.api_endpoint + client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.project-cluster.kubeconfig).users[0].user.client-certificate-data) + client_key = base64decode(yamldecode(civo_kubernetes_cluster.project-cluster.kubeconfig).users[0].user.client-key-data) + cluster_ca_certificate = base64decode(yamldecode(civo_kubernetes_cluster.project-cluster.kubeconfig).clusters[0].cluster.certificate-authority-data) +} + +provider "helm" { + repository_config_path = "${path.module}/.helm/repositories.yaml" + repository_cache = "${path.module}/.helm" + kubernetes = { + host = civo_kubernetes_cluster.project-cluster.api_endpoint + client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.project-cluster.kubeconfig).users[0].user.client-certificate-data) + client_key = base64decode(yamldecode(civo_kubernetes_cluster.project-cluster.kubeconfig).users[0].user.client-key-data) + cluster_ca_certificate = base64decode(yamldecode(civo_kubernetes_cluster.project-cluster.kubeconfig).clusters[0].cluster.certificate-authority-data) + } +} + +resource "kubernetes_cluster_role_v1" "argocd_manager" { + metadata { + name = "argocd-manager-role" + } + + rule { + api_groups = ["*"] + resources = ["*"] + verbs = ["*"] + } + rule { + non_resource_urls = ["*"] + verbs = ["*"] + } +} + + +resource "kubernetes_cluster_role_binding_v1" "argocd_manager" { + metadata { + name = "argocd-manager-role-binding" + } + role_ref { + api_group = "rbac.authorization.k8s.io" + kind = "ClusterRole" + name = kubernetes_cluster_role_v1.argocd_manager.metadata.0.name + } + subject { + kind = "ServiceAccount" + name = kubernetes_service_account_v1.argocd_manager.metadata.0.name + namespace = "kube-system" + } +} + +resource "kubernetes_service_account_v1" "argocd_manager" { + metadata { + name = "argocd-manager" + namespace = "kube-system" + } + secret { + name = "argocd-manager-token" + } +} + +resource "kubernetes_secret_v1" "argocd_manager" { + metadata { + name = "argocd-manager-token" + namespace = "kube-system" + annotations = { + "kubernetes.io/service-account.name" = "argocd-manager" + } + } + type = "kubernetes.io/service-account-token" + depends_on = [kubernetes_service_account_v1.argocd_manager] +} + +resource "kubernetes_namespace_v1" "external_dns" { + metadata { + name = "external-dns" + } +} + +data "vault_generic_secret" "external_dns" { + path = "secret/external-dns" +} + +resource "kubernetes_secret_v1" "external_dns" { + metadata { + name = "external-dns-secrets" + namespace = kubernetes_namespace_v1.external_dns.metadata.0.name + } + data = { + token = data.vault_generic_secret.external_dns.data["token"] + } + type = "Opaque" +} + +# ────────────────────────────────────────────── +# 1. Crossplane Secrets (extract all keys from /crossplane) +# ────────────────────────────────────────────── + +resource "kubernetes_namespace_v1" "crossplane_system" { + metadata { + name = "crossplane-system" + } +} + +resource "kubernetes_secret_v1" "crossplane_secrets" { + metadata { + name = "crossplane-secrets" + namespace = kubernetes_namespace_v1.crossplane_system.metadata.0.name + } + + data = { + AWS_ACCESS_KEY_ID = data.civo_object_store_credential.backup.access_key_id + AWS_SECRET_ACCESS_KEY = data.civo_object_store_credential.backup.secret_access_key + } + + type = "Opaque" +} + +resource "random_password" "cluster_token" { + length = 32 + special = false +} + +provider "kubernetes" { + alias = "incluster" +} + +resource "kubernetes_secret_v1" "preshared_token_mgmt" { + provider = kubernetes.incluster + metadata { + name = "pre-shared-token" + namespace = var.project_name + } + data = { + token = random_password.cluster_token.result + } +} + +resource "kubernetes_namespace_v1" "argocd" { + metadata { + name = "argocd" + } +} + +resource "kubernetes_secret_v1" "preshared_token_argocd" { + depends_on = [civo_kubernetes_cluster.project-cluster] + metadata { + name = "platform-cluster-identity" + namespace = kubernetes_namespace_v1.argocd.metadata.0.name + } + data = { + token = random_password.cluster_token.result + org_id = var.project_name + } +} + +resource "kubernetes_secret_v1" "preshared_token_crossplane" { + depends_on = [civo_kubernetes_cluster.project-cluster] + metadata { + name = "platform-cluster-identity" + namespace = kubernetes_namespace_v1.crossplane_system.metadata.0.name + } + data = { + token = random_password.cluster_token.result + org_id = var.project_name + } +} diff --git a/terraform/civo/modules/project-cluster/variables.tf b/terraform/civo/modules/project-cluster/variables.tf new file mode 100644 index 0000000..924dc95 --- /dev/null +++ b/terraform/civo/modules/project-cluster/variables.tf @@ -0,0 +1,19 @@ +variable "cluster_name" { + type = string +} + +variable "cluster_region" { + type = string +} + +variable "node_count" { + type = number +} + +variable "node_type" { + type = string +} + +variable "project_name" { + type = string +} diff --git a/terraform/civo/modules/workload-cluster/gpu.tf b/terraform/civo/modules/workload-cluster/gpu.tf index e0babcf..2c1ad0a 100644 --- a/terraform/civo/modules/workload-cluster/gpu.tf +++ b/terraform/civo/modules/workload-cluster/gpu.tf @@ -1,9 +1,13 @@ -# Configuration used to install the GPU operator - locals { - gpu_node_sizes = [for i in data.civo_size.gpu.sizes : i.name] - gpu_prefixes = ["g4g.", "an."] # Civo GPU sizes start with these prefixes - ensure to end with "." to avoid false positives - is_gpu = contains(local.gpu_node_sizes, var.node_type) && var.is_gpu + gpu_node_sizes = [for i in data.civo_size.gpu.sizes : i.name] + gpu_prefixes = ["g4g.", "an."] # Civo GPU sizes start with these prefixes - ensure to end with "." to avoid false positives + deploy_gpu_operator = contains(local.gpu_node_sizes, var.node_type) + + # Single-H100 node pools need NVLink disabled at driver load, since there is + # no peer GPU for NVLink to attach to. On multi-H100 or non-H100 nodes this + # workaround must not be applied — it reduces peer-to-peer bandwidth. + gpu_is_single_h100 = lower(var.node_type) == "an.g1.h100.kube.x1" + } # Get all the GPU node types @@ -19,272 +23,55 @@ data "civo_size" "gpu" { } } -# Create labels for the GPU operator namespace -resource "kubernetes_namespace_v1" "gpu_operator_labels" { - count = local.is_gpu ? 1 : 0 +resource "kubernetes_namespace_v1" "gpu_operator" { + count = local.deploy_gpu_operator ? 1 : 0 + metadata { name = "gpu-operator" - labels = { - "pod-security.kubernetes.io/enforce" = "privileged" - } } -} - -# Helm release configuration for the Nvidia GPU operator -resource "helm_release" "gpu_operator" { - count = local.is_gpu ? 1 : 0 - name = "gpu-operator" - repository = "https://helm.ngc.nvidia.com/nvidia" - chart = "gpu-operator" - namespace = kubernetes_namespace_v1.gpu_operator_labels[count.index].metadata[0].name - version = "v24.6.0" - atomic = true - cleanup_on_fail = true - reset_values = true - wait = true - # Values taken from Civo GPU operator - # @link https://github.com/civo-learn/civo-gpu-operator-tf/blob/cdb5bc6ac3d278e3a0285178c4960611639bf196/infra/tf/values/gpu-operator-values.yaml - values = [ - yamlencode({ - # set replica false as feature discovery remains pending - wait = true - - ## Node Feature Discovery enabled/disable configuration. - nfd = { - enabled = true - } - - # GPU Feature Discovery configuration. - gfd = { - enabled = true - } - - # Operator configuration. - operator = { - upgradeCRD = true - cleanupCRD = true - resources = { - requests = { - cpu = "10m" - memory = "100Mi" - } - limits = { - cpu = "50m" - memory = "300Mi" - } - } - } - # Node Feature Discovery configuration. - node-feature-discovery = { - enableNodeFeatureApi = true - master = { - resources = { - requests = { - cpu = "10m" - memory = "200Mi" - } - } - } - worker = { - resources = { - requests = { - cpu = "10m" - memory = "100Mi" - } - limits = { - cpu = "50m" - memory = "300Mi" - } - } - affinity = { - nodeAffinity = { - requiredDuringSchedulingIgnoredDuringExecution = { - nodeSelectorTerms = [ - { - matchExpressions = [ - { - key = "node.kubernetes.io/instance-type" - operator = "In" - values = local.gpu_node_sizes - } - ] - } - ] - } - } - } - tolerations = [ - { - key = "nvidia.com/gpu" - operator = "Exists" - effect = "NoSchedule" - } - ] - } - gc = { - enable = false - interval = "30m" - resources = { - requests = { - cpu = "10m" - memory = "100Mi" - } - } - affinity = { - nodeAffinity = { - requiredDuringSchedulingIgnoredDuringExecution = { - nodeSelectorTerms = [ - { - matchExpressions = [ - { - key = "node.kubernetes.io/instance-type" - operator = "NotIn" - values = local.gpu_node_sizes - } - ] - } - ] - } - } - } - tolerations = [ - { - key = "nvidia.com/gpu" - operator = "Exists" - effect = "NoSchedule" - } - ] - } - } + depends_on = [civo_kubernetes_cluster.kubefirst] +} - # Driver configuration - driver = { - enabled = false - } +resource "kubernetes_config_map" "nvidia_kernel_config" { + count = local.deploy_gpu_operator && local.gpu_is_single_h100 ? 1 : 0 - # Toolkit configuration. - toolkit = { - enabled = false - } + metadata { + name = "nvidia-kernel-config" + namespace = kubernetes_namespace_v1.gpu_operator[0].metadata[0].name + } - # Device Plugin configuration. - devicePlugin = { - enabled = true - version = "v0.14.5" - env = [ - { - name = "FAIL_ON_INIT_ERROR" - value = "false" - } - ] - } + data = { + "nvidia.conf" = "options nvidia NVreg_NvLinkDisable=1" + } +} - # DCGM configuration - dcgm = { - # enable with monitoring - enabled = false - resources = { - requests = { - cpu = "10m" - memory = "100Mi" - } - limits = { - cpu = "50m" - memory = "400Mi" - } - } - } +resource "helm_release" "gpu_operator" { + count = local.deploy_gpu_operator ? 1 : 0 + name = "gpu-operator" + repository = "https://helm.ngc.nvidia.com/nvidia" + chart = "gpu-operator" + version = "v25.10.1" + namespace = kubernetes_namespace_v1.gpu_operator[0].metadata[0].name + timeout = 900 + wait = true - # DCGM Exporter configuration. - dcgmExporter = { - # enable with monitoring - enabled = false - } + values = [yamlencode({ + driver = merge( + { enabled = true }, + local.gpu_is_single_h100 ? { + kernelModuleConfig = { name = "nvidia-kernel-config" } + } : {} + ) + toolkit = { enabled = false } + devicePlugin = { enabled = true } + gfd = { enabled = true } + operator = { defaultRuntime = "containerd" } + validator = { cuda = { runtimeClassName = "nvidia" } } + })] - # MIG Manager configuration. - migManager = { - # @skip civo-talos-gpu-operator.migManager.enabled - enabled = false - } - validator = { - enabled = false - } - }) + depends_on = [ + kubernetes_config_map.nvidia_kernel_config, + kubernetes_namespace_v1.gpu_operator, ] } -# as the host driver and the nvidia container toolkit are provided within Talos as Shims, -# we need to create a daemonset that forces these to be marked as ready for the GPU operator -# TODO: "productionise" this -resource "kubernetes_daemonset" "fake_toolkit_ready" { - count = local.is_gpu ? 1 : 0 - metadata { - name = "fake-toolkit-ready" - namespace = kubernetes_namespace_v1.gpu_operator_labels[count.index].metadata[0].name - } - spec { - selector { - match_labels = { - "k8s-app" = "fake-toolkit-ready" - } - } - template { - metadata { - labels = { - name = "fake-toolkit-ready" - "k8s-app" = "fake-toolkit-ready" - } - } - spec { - volume { - name = "run-nvidia" - host_path { - path = "/run/nvidia/validations/" - } - } - container { - name = "main" - image = "alpine:3.19" - command = ["sh", "-c"] - args = [ - <<-EOF - set -ex; - touch /run/nvidia/validations/host-driver-ready; - touch /run/nvidia/validations/toolkit-ready; - touch /run/nvidia/validations/.driver-ctr-ready; - touch /run/nvidia/validations/driver-ready - sleep infinity - EOF - ] - volume_mount { - name = "run-nvidia" - mount_path = "/run/nvidia/validations/" - mount_propagation = "HostToContainer" - } - image_pull_policy = "IfNotPresent" - } - restart_policy = "Always" - affinity { - node_affinity { - required_during_scheduling_ignored_during_execution { - node_selector_term { - match_expressions { - key = "node.kubernetes.io/instance-type" - operator = "In" - values = local.gpu_node_sizes - } - } - } - } - } - toleration { - key = "nvidia.com/gpu" - operator = "Exists" - effect = "NoSchedule" - } - priority_class_name = "system-node-critical" - } - } - } - depends_on = [helm_release.gpu_operator] -} diff --git a/terraform/civo/modules/workload-cluster/main.tf b/terraform/civo/modules/workload-cluster/main.tf index e56162d..e91a834 100644 --- a/terraform/civo/modules/workload-cluster/main.tf +++ b/terraform/civo/modules/workload-cluster/main.tf @@ -13,35 +13,15 @@ resource "civo_kubernetes_cluster" "kubefirst" { network_id = civo_network.kubefirst.id firewall_id = civo_firewall.kubefirst.id write_kubeconfig = true - cluster_type = local.is_gpu ? "talos" : "k3s" # k3s doesn't support GPU - kubernetes_version = local.is_gpu ? "1.27.0" : "1.32.5-k3s1" + cluster_type = "k3s" + kubernetes_version = "1.35.0-k3s1" pools { label = var.cluster_name size = var.node_type node_count = var.node_count - labels = local.is_gpu ? { - "nvidia.com/gpu.deploy.operator-validator" = "false" - } : {} } } -resource "aws_ssm_parameter" "clusters" { - provider = aws.PROJECT_REGION - name = "/clusters/${var.cluster_name}" - description = "Cluster configuration for ${var.cluster_name}" - type = "String" - tier = "Advanced" - value = jsonencode({ - kubeconfig = civo_kubernetes_cluster.kubefirst.kubeconfig - client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-certificate-data) - client_key = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-key-data) - cluster_ca_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).clusters[0].cluster.certificate-authority-data) - host = civo_kubernetes_cluster.kubefirst.api_endpoint - cluster_name = var.cluster_name - argocd_manager_sa_token = kubernetes_secret_v1.argocd_manager.data.token - }) -} - provider "kubernetes" { host = civo_kubernetes_cluster.kubefirst.api_endpoint client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-certificate-data) @@ -115,21 +95,31 @@ resource "kubernetes_secret_v1" "argocd_manager" { depends_on = [kubernetes_service_account_v1.argocd_manager] } -resource "kubernetes_namespace_v1" "external_dns" { - metadata { - name = "external-dns" - } +provider "kubernetes" { + alias = "incluster" } -resource "kubernetes_namespace_v1" "external_secrets_operator" { +resource "kubernetes_secret_v1" "kubeconfig_secret" { + provider = kubernetes.incluster metadata { - name = "external-secrets-operator" + name = var.cluster_name + namespace = "argocd" + labels = { + "argocd.argoproj.io/secret-type" = "cluster" + } } -} -resource "kubernetes_namespace_v1" "environment" { - metadata { - name = var.cluster_name + data = { + name = var.cluster_name + server = civo_kubernetes_cluster.kubefirst.api_endpoint + config = jsonencode({ + bearerToken = kubernetes_secret_v1.argocd_manager.data["token"] + tlsClientConfig = { + insecure = false + caData = yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).clusters[0].cluster.certificate-authority-data + certData = yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-certificate-data + keyData = yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-key-data + } + }) } } - diff --git a/terraform/civo/modules/workload-cluster/variables.tf b/terraform/civo/modules/workload-cluster/variables.tf index bd67e3f..67564a1 100644 --- a/terraform/civo/modules/workload-cluster/variables.tf +++ b/terraform/civo/modules/workload-cluster/variables.tf @@ -18,7 +18,3 @@ variable "node_type" { type = string } -variable "is_gpu" { - type = bool - default = false -}