From f7f58862400d48b85562ae7b20edf261d9d6bb91 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Thu, 19 Feb 2026 15:22:51 +0530 Subject: [PATCH 01/77] feat: add Civo Project cluster template --- .../project-cluster}/0-providerconfig.yaml | 0 .../project-cluster}/10-infrastructure.yaml | 0 .../15-infrastructure-bootstrap.yaml | 0 .../20-argocd-connection.yaml | 0 .../project-cluster}/30-argocd.yaml | 0 .../project-cluster}/30-cert-manager.yaml | 0 .../project-cluster}/30-crossplane.yaml | 0 .../project-cluster}/30-external-dns.yaml | 0 .../30-external-secrets-operator.yaml | 0 .../project-cluster}/30-ingress-nginx.yaml | 0 .../project-cluster}/30-reloader.yaml | 0 .../35-clustersecretstore.yaml | 0 .../project-cluster}/40-clusterissuers.yaml | 0 .../40-crossplane-components.yaml | 0 .../project-cluster}/40-secret.yaml | 0 .../project-cluster}/45-environment.yaml | 0 .../50-actions-runner-controller.yaml | 0 .../51-actions-runner-application.yaml | 0 .../51-actions-runner-externalsecret.yaml | 0 .../51-actions-runner-runnerdeployment.yaml | 0 .../51-actions-runner-serviceaccount.yaml | 0 .../51-actions-runner-wait.yaml | 0 .../appproject-workload-cluster.yaml | 0 .../project-cluster}/argocd/.DS_Store | Bin .../project-cluster}/argocd/application.yaml | 0 .../argocd-application-controller-sa.yaml | 0 ...cd-application-controller-statefulset.yaml | 0 .../argocd-applicationset-controller-sa.yaml | 0 .../project-cluster}/argocd/argocd-cm.yaml | 0 .../argocd/argocd-cmd-params-cm.yaml | 0 .../argocd/argocd-repo-server-deployment.yaml | 0 .../argocd/argocd-server-deployment.yaml | 0 .../argocd/argocd-server-sa.yaml | 0 .../argocd/argocd-ui-ingress.yaml | 0 .../argocd/kustomization.yaml | 0 .../project-cluster}/argocd/rbac.yaml | 0 .../cert-issuers/clusterissuers.yaml | 0 .../clustersecretstore.yaml | 0 .../controllerconfig.yaml | 0 .../crossplane-secrets.yaml | 0 .../crossplane-components/svc.yaml | 0 .../terraform-provider.yaml | 0 .../infrastructure-bootstrap/wait.yaml | 0 .../infrastructure-bootstrap/workspace.yaml | 0 .../project-cluster}/infrastructure/wait.yaml | 0 .../infrastructure/workspace.yaml | 0 .../project-cluster}/kubefirst.yaml | 0 .../provider-config/providerconfig.yaml | 0 .../registry-workload-cluster.yaml | 0 .../project-cluster}/secrets/ecr-secrets.yaml | 0 .../project-cluster}/secrets/secret.yaml | 0 .../workload-cluster}/0-providerconfig.yaml | 0 .../workload-cluster}/10-infrastructure.yaml | 0 .../15-infrastructure-bootstrap.yaml | 0 .../20-argocd-connection.yaml | 0 .../workload-cluster}/30-cert-manager.yaml | 0 .../workload-cluster}/30-external-dns.yaml | 0 .../30-external-secrets-operator.yaml | 0 .../workload-cluster}/30-ingress-nginx.yaml | 0 .../workload-cluster}/30-reloader.yaml | 0 .../workload-cluster}/40-clusterissuers.yaml | 0 .../40-clustersecretstore.yaml | 0 .../workload-cluster}/40-rbac.yaml | 0 .../workload-cluster}/40-secret.yaml | 0 .../workload-cluster}/45-environment.yaml | 0 .../cert-issuers/clusterissuers.yaml | 0 .../clustersecretstore.yaml | 0 .../infrastructure-bootstrap/wait.yaml | 0 .../infrastructure-bootstrap/workspace.yaml | 0 .../infrastructure/wait.yaml | 0 .../infrastructure/workspace.yaml | 0 .../workload-cluster}/kubefirst.yaml | 0 .../provider-config/providerconfig.yaml | 0 .../rbac/cluster-role-binding.yaml | 0 .../workload-cluster}/rbac/cluster-role.yaml | 0 .../registry-workload-cluster.yaml | 0 .../workload-cluster}/secrets/ecr.yaml | 0 .../workloadcluster-environment-project.yaml | 0 .../workloadcluster-platform-project.yaml | 0 .../workloadcluster-project.yaml | 0 .../workload-vcluster}/0-providerconfig.yaml | 0 .../workload-vcluster}/10-infrastructure.yaml | 0 .../workload-vcluster}/15-bootstrap.yaml | 0 .../20-argocd-connection.yaml | 0 .../workload-vcluster}/30-cert-manager.yaml | 0 .../workload-vcluster}/30-external-dns.yaml | 0 .../30-external-secrets-operator.yaml | 0 .../workload-vcluster}/30-ingress-nginx.yaml | 0 .../workload-vcluster}/30-reloader.yaml | 0 .../workload-vcluster}/40-clusterissuers.yaml | 0 .../40-clustersecretstore.yaml | 0 .../workload-vcluster}/40-rbac.yaml | 0 .../workload-vcluster}/45-environment.yaml | 0 .../bootstrap/workspace.yaml | 0 .../cert-issuers/clusterissuers.yaml | 0 .../clustersecretstore.yaml | 0 .../infrastructure/wait.yaml | 0 .../infrastructure/workspace.yaml | 0 .../workload-vcluster}/kubefirst.yaml | 0 .../provider-config/providerconfig.yaml | 0 .../rbac/cluster-role-binding.yaml | 0 .../workload-vcluster}/rbac/cluster-role.yaml | 0 .../registry-workload-cluster.yaml | 0 .../workloadcluster-environment-project.yaml | 0 .../workloadcluster-platform-project.yaml | 0 .../workloadcluster-project.yaml | 0 .../infrastructure/workspace.yaml | 23 --- .../civo-workload-cluster/kubefirst.yaml | 1 - templates/civo/project-cluster/Chart.yaml | 15 ++ .../templates/0-providerconfig.yaml} | 12 +- .../templates/10-infrastructure.yaml | 29 ++++ .../15-infrastructure-bootstrap.yaml | 29 ++++ .../templates}/20-argocd-connection.yaml | 20 +-- .../project-cluster/templates/30-argocd.yaml | 24 +++ .../templates/30-crossplane.yaml | 24 +++ .../templates/30-external-dns.yaml | 44 +++++ .../30-external-secrets-operator.yaml | 73 ++++++++ .../templates/30-reloader.yaml | 33 ++++ .../templates/35-clustersecretstore.yaml | 24 +++ .../templates/40-crossplane-components.yaml | 25 +++ .../project-cluster/templates/40-secret.yaml | 24 +++ .../appproject-workload-cluster.yaml} | 10 +- .../templates/argocd/application.yaml | 87 ++++++++++ .../argocd-application-controller-sa.yaml | 9 + ...cd-application-controller-statefulset.yaml | 11 ++ .../argocd-applicationset-controller-sa.yaml | 9 + .../argocd/argocd-cmd-params-cm.yaml | 12 ++ .../argocd/argocd-repo-server-deployment.yaml | 11 ++ .../argocd/argocd-server-deployment.yaml | 13 ++ .../templates/argocd/argocd-server-sa.yaml | 9 + .../templates/argocd/argocd-ui-ingress.yaml | 74 ++++++++ .../templates/argocd/kustomization.yaml | 23 +++ .../templates/argocd/rbac.yaml | 37 ++++ .../clustersecretstore.yaml | 34 ++++ .../controllerconfig.yaml | 62 +++++++ .../crossplane-secrets.yaml | 51 ++++++ .../templates/crossplane-components/svc.yaml | 44 +++++ .../terraform-provider.yaml | 16 ++ .../templates}/infrastructure/wait.yaml | 9 +- .../templates/infrastructure/workspace.yaml | 20 +++ .../provider-config/providerconfig.yaml | 57 +++++++ .../templates/registry-workload-cluster.yaml | 30 ++++ .../templates/secrets/secret.yaml | 69 ++++++++ templates/civo/project-cluster/values.yaml | 161 ++++++++++++++++++ templates/civo/workload-cluster/Chart.yaml | 15 ++ .../templates}/0-providerconfig.yaml | 6 +- .../templates}/10-infrastructure.yaml | 8 +- .../templates/20-argocd-connection.yaml | 62 +++++++ .../templates}/30-cert-manager.yaml | 6 +- .../templates}/30-ingress-nginx.yaml | 6 +- .../templates}/30-reloader.yaml | 6 +- .../templates/45-environment.yaml | 24 +++ .../templates/infrastructure/wait.yaml | 21 +++ .../templates/infrastructure/workspace.yaml | 23 +++ .../provider-config/providerconfig.yaml | 18 +- .../templates}/registry-workload-cluster.yaml | 7 +- .../workloadcluster-environment-project.yaml | 26 +++ .../workloadcluster-platform-project.yaml} | 14 +- .../templates/workloadcluster-project.yaml | 27 +++ templates/civo/workload-cluster/values.yaml | 79 +++++++++ .../workloadcluster-project.yaml | 27 --- .../civo/modules/project-cluster/main.tf | 118 +++++++++++++ .../civo/modules/project-cluster/variables.tf | 15 ++ 163 files changed, 1652 insertions(+), 114 deletions(-) rename templates/{workload-project-cluster => aws/project-cluster}/0-providerconfig.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/10-infrastructure.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/15-infrastructure-bootstrap.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/20-argocd-connection.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/30-argocd.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/30-cert-manager.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/30-crossplane.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/30-external-dns.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/30-external-secrets-operator.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/30-ingress-nginx.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/30-reloader.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/35-clustersecretstore.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/40-clusterissuers.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/40-crossplane-components.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/40-secret.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/45-environment.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/50-actions-runner-controller.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/51-actions-runner-application.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/actions-runner-controller/51-actions-runner-externalsecret.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/actions-runner-controller/51-actions-runner-runnerdeployment.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/actions-runner-controller/51-actions-runner-serviceaccount.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/actions-runner-controller/51-actions-runner-wait.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/appproject-workload-cluster.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/argocd/.DS_Store (100%) rename templates/{workload-project-cluster => aws/project-cluster}/argocd/application.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/argocd/argocd-application-controller-sa.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/argocd/argocd-application-controller-statefulset.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/argocd/argocd-applicationset-controller-sa.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/argocd/argocd-cm.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/argocd/argocd-cmd-params-cm.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/argocd/argocd-repo-server-deployment.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/argocd/argocd-server-deployment.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/argocd/argocd-server-sa.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/argocd/argocd-ui-ingress.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/argocd/kustomization.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/argocd/rbac.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/cert-issuers/clusterissuers.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/cluster-secret-store/clustersecretstore.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/crossplane-components/controllerconfig.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/crossplane-components/crossplane-secrets.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/crossplane-components/svc.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/crossplane-components/terraform-provider.yaml (100%) rename templates/{workload-downstream-cluster => aws/project-cluster}/infrastructure-bootstrap/wait.yaml (100%) rename templates/{workload-downstream-cluster => aws/project-cluster}/infrastructure-bootstrap/workspace.yaml (100%) rename templates/{civo-workload-cluster => aws/project-cluster}/infrastructure/wait.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/infrastructure/workspace.yaml (100%) rename templates/{workload-downstream-cluster => aws/project-cluster}/kubefirst.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/provider-config/providerconfig.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/registry-workload-cluster.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/secrets/ecr-secrets.yaml (100%) rename templates/{workload-project-cluster => aws/project-cluster}/secrets/secret.yaml (100%) rename templates/{civo-workload-cluster => aws/workload-cluster}/0-providerconfig.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-cluster}/10-infrastructure.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-cluster}/15-infrastructure-bootstrap.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-cluster}/20-argocd-connection.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-cluster}/30-cert-manager.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-cluster}/30-external-dns.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-cluster}/30-external-secrets-operator.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-cluster}/30-ingress-nginx.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-cluster}/30-reloader.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-cluster}/40-clusterissuers.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-cluster}/40-clustersecretstore.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-cluster}/40-rbac.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-cluster}/40-secret.yaml (100%) rename templates/{civo-workload-cluster => aws/workload-cluster}/45-environment.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-cluster}/cert-issuers/clusterissuers.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-cluster}/cluster-secret-store/clustersecretstore.yaml (100%) rename templates/{workload-project-cluster => aws/workload-cluster}/infrastructure-bootstrap/wait.yaml (100%) rename templates/{workload-project-cluster => aws/workload-cluster}/infrastructure-bootstrap/workspace.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-cluster}/infrastructure/wait.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-cluster}/infrastructure/workspace.yaml (100%) rename templates/{workload-project-cluster => aws/workload-cluster}/kubefirst.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-cluster}/provider-config/providerconfig.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-cluster}/rbac/cluster-role-binding.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-cluster}/rbac/cluster-role.yaml (100%) rename templates/{civo-workload-cluster => aws/workload-cluster}/registry-workload-cluster.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-cluster}/secrets/ecr.yaml (100%) rename templates/{civo-workload-cluster => aws/workload-cluster}/workloadcluster-environment-project.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-cluster}/workloadcluster-platform-project.yaml (100%) rename templates/{civo-workload-cluster => aws/workload-cluster}/workloadcluster-project.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-vcluster}/0-providerconfig.yaml (100%) rename templates/{workload-downstream-host-vcluster => aws/workload-vcluster}/10-infrastructure.yaml (100%) rename templates/{workload-downstream-host-vcluster => aws/workload-vcluster}/15-bootstrap.yaml (100%) rename templates/{civo-workload-cluster => aws/workload-vcluster}/20-argocd-connection.yaml (100%) rename templates/{civo-workload-cluster => aws/workload-vcluster}/30-cert-manager.yaml (100%) rename templates/{workload-downstream-host-vcluster => aws/workload-vcluster}/30-external-dns.yaml (100%) rename templates/{workload-downstream-host-vcluster => aws/workload-vcluster}/30-external-secrets-operator.yaml (100%) rename templates/{workload-downstream-host-vcluster => aws/workload-vcluster}/30-ingress-nginx.yaml (100%) rename templates/{civo-workload-cluster => aws/workload-vcluster}/30-reloader.yaml (100%) rename templates/{workload-downstream-host-vcluster => aws/workload-vcluster}/40-clusterissuers.yaml (100%) rename templates/{workload-downstream-host-vcluster => aws/workload-vcluster}/40-clustersecretstore.yaml (100%) rename templates/{workload-downstream-host-vcluster => aws/workload-vcluster}/40-rbac.yaml (100%) rename templates/{workload-downstream-host-vcluster => aws/workload-vcluster}/45-environment.yaml (100%) rename templates/{workload-downstream-host-vcluster => aws/workload-vcluster}/bootstrap/workspace.yaml (100%) rename templates/{workload-downstream-host-vcluster => aws/workload-vcluster}/cert-issuers/clusterissuers.yaml (100%) rename templates/{workload-downstream-host-vcluster => aws/workload-vcluster}/cluster-secret-store/clustersecretstore.yaml (100%) rename templates/{workload-downstream-host-vcluster => aws/workload-vcluster}/infrastructure/wait.yaml (100%) rename templates/{workload-downstream-host-vcluster => aws/workload-vcluster}/infrastructure/workspace.yaml (100%) rename templates/{workload-downstream-host-vcluster => aws/workload-vcluster}/kubefirst.yaml (100%) rename templates/{workload-downstream-host-vcluster => aws/workload-vcluster}/provider-config/providerconfig.yaml (100%) rename templates/{workload-downstream-host-vcluster => aws/workload-vcluster}/rbac/cluster-role-binding.yaml (100%) rename templates/{workload-downstream-host-vcluster => aws/workload-vcluster}/rbac/cluster-role.yaml (100%) rename templates/{workload-downstream-host-vcluster => aws/workload-vcluster}/registry-workload-cluster.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-vcluster}/workloadcluster-environment-project.yaml (100%) rename templates/{workload-downstream-host-vcluster => aws/workload-vcluster}/workloadcluster-platform-project.yaml (100%) rename templates/{workload-downstream-cluster => aws/workload-vcluster}/workloadcluster-project.yaml (100%) delete mode 100644 templates/civo-workload-cluster/infrastructure/workspace.yaml delete mode 100644 templates/civo-workload-cluster/kubefirst.yaml create mode 100644 templates/civo/project-cluster/Chart.yaml rename templates/{workload-downstream-cluster/45-environment.yaml => civo/project-cluster/templates/0-providerconfig.yaml} (55%) create mode 100644 templates/civo/project-cluster/templates/10-infrastructure.yaml create mode 100644 templates/civo/project-cluster/templates/15-infrastructure-bootstrap.yaml rename templates/{workload-downstream-host-vcluster => civo/project-cluster/templates}/20-argocd-connection.yaml (74%) create mode 100644 templates/civo/project-cluster/templates/30-argocd.yaml create mode 100644 templates/civo/project-cluster/templates/30-crossplane.yaml create mode 100644 templates/civo/project-cluster/templates/30-external-dns.yaml create mode 100644 templates/civo/project-cluster/templates/30-external-secrets-operator.yaml create mode 100644 templates/civo/project-cluster/templates/30-reloader.yaml create mode 100644 templates/civo/project-cluster/templates/35-clustersecretstore.yaml create mode 100644 templates/civo/project-cluster/templates/40-crossplane-components.yaml create mode 100644 templates/civo/project-cluster/templates/40-secret.yaml rename templates/{civo-workload-cluster/workloadcluster-platform-project.yaml => civo/project-cluster/templates/appproject-workload-cluster.yaml} (57%) create mode 100644 templates/civo/project-cluster/templates/argocd/application.yaml create mode 100644 templates/civo/project-cluster/templates/argocd/argocd-application-controller-sa.yaml create mode 100644 templates/civo/project-cluster/templates/argocd/argocd-application-controller-statefulset.yaml create mode 100644 templates/civo/project-cluster/templates/argocd/argocd-applicationset-controller-sa.yaml create mode 100644 templates/civo/project-cluster/templates/argocd/argocd-cmd-params-cm.yaml create mode 100644 templates/civo/project-cluster/templates/argocd/argocd-repo-server-deployment.yaml create mode 100644 templates/civo/project-cluster/templates/argocd/argocd-server-deployment.yaml create mode 100644 templates/civo/project-cluster/templates/argocd/argocd-server-sa.yaml create mode 100644 templates/civo/project-cluster/templates/argocd/argocd-ui-ingress.yaml create mode 100644 templates/civo/project-cluster/templates/argocd/kustomization.yaml create mode 100644 templates/civo/project-cluster/templates/argocd/rbac.yaml create mode 100644 templates/civo/project-cluster/templates/cluster-secret-store/clustersecretstore.yaml create mode 100644 templates/civo/project-cluster/templates/crossplane-components/controllerconfig.yaml create mode 100644 templates/civo/project-cluster/templates/crossplane-components/crossplane-secrets.yaml create mode 100644 templates/civo/project-cluster/templates/crossplane-components/svc.yaml create mode 100644 templates/civo/project-cluster/templates/crossplane-components/terraform-provider.yaml rename templates/{workload-project-cluster => civo/project-cluster/templates}/infrastructure/wait.yaml (61%) create mode 100644 templates/civo/project-cluster/templates/infrastructure/workspace.yaml create mode 100644 templates/civo/project-cluster/templates/provider-config/providerconfig.yaml create mode 100644 templates/civo/project-cluster/templates/registry-workload-cluster.yaml create mode 100644 templates/civo/project-cluster/templates/secrets/secret.yaml create mode 100644 templates/civo/project-cluster/values.yaml create mode 100644 templates/civo/workload-cluster/Chart.yaml rename templates/{workload-downstream-host-vcluster => civo/workload-cluster/templates}/0-providerconfig.yaml (71%) rename templates/{civo-workload-cluster => civo/workload-cluster/templates}/10-infrastructure.yaml (64%) create mode 100644 templates/civo/workload-cluster/templates/20-argocd-connection.yaml rename templates/{workload-downstream-host-vcluster => civo/workload-cluster/templates}/30-cert-manager.yaml (79%) rename templates/{civo-workload-cluster => civo/workload-cluster/templates}/30-ingress-nginx.yaml (81%) rename templates/{workload-downstream-host-vcluster => civo/workload-cluster/templates}/30-reloader.yaml (79%) create mode 100644 templates/civo/workload-cluster/templates/45-environment.yaml create mode 100644 templates/civo/workload-cluster/templates/infrastructure/wait.yaml create mode 100644 templates/civo/workload-cluster/templates/infrastructure/workspace.yaml rename templates/{civo-workload-cluster => civo/workload-cluster/templates}/provider-config/providerconfig.yaml (65%) rename templates/{workload-downstream-cluster => civo/workload-cluster/templates}/registry-workload-cluster.yaml (78%) create mode 100644 templates/civo/workload-cluster/templates/workloadcluster-environment-project.yaml rename templates/{workload-downstream-host-vcluster/workloadcluster-environment-project.yaml => civo/workload-cluster/templates/workloadcluster-platform-project.yaml} (50%) create mode 100644 templates/civo/workload-cluster/templates/workloadcluster-project.yaml create mode 100644 templates/civo/workload-cluster/values.yaml delete mode 100644 templates/workload-downstream-host-vcluster/workloadcluster-project.yaml create mode 100644 terraform/civo/modules/project-cluster/main.tf create mode 100644 terraform/civo/modules/project-cluster/variables.tf diff --git a/templates/workload-project-cluster/0-providerconfig.yaml b/templates/aws/project-cluster/0-providerconfig.yaml similarity index 100% rename from templates/workload-project-cluster/0-providerconfig.yaml rename to templates/aws/project-cluster/0-providerconfig.yaml diff --git a/templates/workload-project-cluster/10-infrastructure.yaml b/templates/aws/project-cluster/10-infrastructure.yaml similarity index 100% rename from templates/workload-project-cluster/10-infrastructure.yaml rename to templates/aws/project-cluster/10-infrastructure.yaml diff --git a/templates/workload-project-cluster/15-infrastructure-bootstrap.yaml b/templates/aws/project-cluster/15-infrastructure-bootstrap.yaml similarity index 100% rename from templates/workload-project-cluster/15-infrastructure-bootstrap.yaml rename to templates/aws/project-cluster/15-infrastructure-bootstrap.yaml diff --git a/templates/workload-project-cluster/20-argocd-connection.yaml b/templates/aws/project-cluster/20-argocd-connection.yaml similarity index 100% rename from templates/workload-project-cluster/20-argocd-connection.yaml rename to templates/aws/project-cluster/20-argocd-connection.yaml diff --git a/templates/workload-project-cluster/30-argocd.yaml b/templates/aws/project-cluster/30-argocd.yaml similarity index 100% rename from templates/workload-project-cluster/30-argocd.yaml rename to templates/aws/project-cluster/30-argocd.yaml diff --git a/templates/workload-project-cluster/30-cert-manager.yaml b/templates/aws/project-cluster/30-cert-manager.yaml similarity index 100% rename from templates/workload-project-cluster/30-cert-manager.yaml rename to templates/aws/project-cluster/30-cert-manager.yaml diff --git a/templates/workload-project-cluster/30-crossplane.yaml b/templates/aws/project-cluster/30-crossplane.yaml similarity index 100% rename from templates/workload-project-cluster/30-crossplane.yaml rename to templates/aws/project-cluster/30-crossplane.yaml diff --git a/templates/workload-project-cluster/30-external-dns.yaml b/templates/aws/project-cluster/30-external-dns.yaml similarity index 100% rename from templates/workload-project-cluster/30-external-dns.yaml rename to templates/aws/project-cluster/30-external-dns.yaml diff --git a/templates/workload-project-cluster/30-external-secrets-operator.yaml b/templates/aws/project-cluster/30-external-secrets-operator.yaml similarity index 100% rename from templates/workload-project-cluster/30-external-secrets-operator.yaml rename to templates/aws/project-cluster/30-external-secrets-operator.yaml diff --git a/templates/workload-project-cluster/30-ingress-nginx.yaml b/templates/aws/project-cluster/30-ingress-nginx.yaml similarity index 100% rename from templates/workload-project-cluster/30-ingress-nginx.yaml rename to templates/aws/project-cluster/30-ingress-nginx.yaml diff --git a/templates/workload-project-cluster/30-reloader.yaml b/templates/aws/project-cluster/30-reloader.yaml similarity index 100% rename from templates/workload-project-cluster/30-reloader.yaml rename to templates/aws/project-cluster/30-reloader.yaml diff --git a/templates/workload-project-cluster/35-clustersecretstore.yaml b/templates/aws/project-cluster/35-clustersecretstore.yaml similarity index 100% rename from templates/workload-project-cluster/35-clustersecretstore.yaml rename to templates/aws/project-cluster/35-clustersecretstore.yaml diff --git a/templates/workload-project-cluster/40-clusterissuers.yaml b/templates/aws/project-cluster/40-clusterissuers.yaml similarity index 100% rename from templates/workload-project-cluster/40-clusterissuers.yaml rename to templates/aws/project-cluster/40-clusterissuers.yaml diff --git a/templates/workload-project-cluster/40-crossplane-components.yaml b/templates/aws/project-cluster/40-crossplane-components.yaml similarity index 100% rename from templates/workload-project-cluster/40-crossplane-components.yaml rename to templates/aws/project-cluster/40-crossplane-components.yaml diff --git a/templates/workload-project-cluster/40-secret.yaml b/templates/aws/project-cluster/40-secret.yaml similarity index 100% rename from templates/workload-project-cluster/40-secret.yaml rename to templates/aws/project-cluster/40-secret.yaml diff --git a/templates/workload-project-cluster/45-environment.yaml b/templates/aws/project-cluster/45-environment.yaml similarity index 100% rename from templates/workload-project-cluster/45-environment.yaml rename to templates/aws/project-cluster/45-environment.yaml diff --git a/templates/workload-project-cluster/50-actions-runner-controller.yaml b/templates/aws/project-cluster/50-actions-runner-controller.yaml similarity index 100% rename from templates/workload-project-cluster/50-actions-runner-controller.yaml rename to templates/aws/project-cluster/50-actions-runner-controller.yaml diff --git a/templates/workload-project-cluster/51-actions-runner-application.yaml b/templates/aws/project-cluster/51-actions-runner-application.yaml similarity index 100% rename from templates/workload-project-cluster/51-actions-runner-application.yaml rename to templates/aws/project-cluster/51-actions-runner-application.yaml diff --git a/templates/workload-project-cluster/actions-runner-controller/51-actions-runner-externalsecret.yaml b/templates/aws/project-cluster/actions-runner-controller/51-actions-runner-externalsecret.yaml similarity index 100% rename from templates/workload-project-cluster/actions-runner-controller/51-actions-runner-externalsecret.yaml rename to templates/aws/project-cluster/actions-runner-controller/51-actions-runner-externalsecret.yaml diff --git a/templates/workload-project-cluster/actions-runner-controller/51-actions-runner-runnerdeployment.yaml b/templates/aws/project-cluster/actions-runner-controller/51-actions-runner-runnerdeployment.yaml similarity index 100% rename from templates/workload-project-cluster/actions-runner-controller/51-actions-runner-runnerdeployment.yaml rename to templates/aws/project-cluster/actions-runner-controller/51-actions-runner-runnerdeployment.yaml diff --git a/templates/workload-project-cluster/actions-runner-controller/51-actions-runner-serviceaccount.yaml b/templates/aws/project-cluster/actions-runner-controller/51-actions-runner-serviceaccount.yaml similarity index 100% rename from templates/workload-project-cluster/actions-runner-controller/51-actions-runner-serviceaccount.yaml rename to templates/aws/project-cluster/actions-runner-controller/51-actions-runner-serviceaccount.yaml diff --git a/templates/workload-project-cluster/actions-runner-controller/51-actions-runner-wait.yaml b/templates/aws/project-cluster/actions-runner-controller/51-actions-runner-wait.yaml similarity index 100% rename from templates/workload-project-cluster/actions-runner-controller/51-actions-runner-wait.yaml rename to templates/aws/project-cluster/actions-runner-controller/51-actions-runner-wait.yaml diff --git a/templates/workload-project-cluster/appproject-workload-cluster.yaml b/templates/aws/project-cluster/appproject-workload-cluster.yaml similarity index 100% rename from templates/workload-project-cluster/appproject-workload-cluster.yaml rename to templates/aws/project-cluster/appproject-workload-cluster.yaml diff --git a/templates/workload-project-cluster/argocd/.DS_Store b/templates/aws/project-cluster/argocd/.DS_Store similarity index 100% rename from templates/workload-project-cluster/argocd/.DS_Store rename to templates/aws/project-cluster/argocd/.DS_Store diff --git a/templates/workload-project-cluster/argocd/application.yaml b/templates/aws/project-cluster/argocd/application.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/application.yaml rename to templates/aws/project-cluster/argocd/application.yaml diff --git a/templates/workload-project-cluster/argocd/argocd-application-controller-sa.yaml b/templates/aws/project-cluster/argocd/argocd-application-controller-sa.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/argocd-application-controller-sa.yaml rename to templates/aws/project-cluster/argocd/argocd-application-controller-sa.yaml diff --git a/templates/workload-project-cluster/argocd/argocd-application-controller-statefulset.yaml b/templates/aws/project-cluster/argocd/argocd-application-controller-statefulset.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/argocd-application-controller-statefulset.yaml rename to templates/aws/project-cluster/argocd/argocd-application-controller-statefulset.yaml diff --git a/templates/workload-project-cluster/argocd/argocd-applicationset-controller-sa.yaml b/templates/aws/project-cluster/argocd/argocd-applicationset-controller-sa.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/argocd-applicationset-controller-sa.yaml rename to templates/aws/project-cluster/argocd/argocd-applicationset-controller-sa.yaml diff --git a/templates/workload-project-cluster/argocd/argocd-cm.yaml b/templates/aws/project-cluster/argocd/argocd-cm.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/argocd-cm.yaml rename to templates/aws/project-cluster/argocd/argocd-cm.yaml diff --git a/templates/workload-project-cluster/argocd/argocd-cmd-params-cm.yaml b/templates/aws/project-cluster/argocd/argocd-cmd-params-cm.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/argocd-cmd-params-cm.yaml rename to templates/aws/project-cluster/argocd/argocd-cmd-params-cm.yaml diff --git a/templates/workload-project-cluster/argocd/argocd-repo-server-deployment.yaml b/templates/aws/project-cluster/argocd/argocd-repo-server-deployment.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/argocd-repo-server-deployment.yaml rename to templates/aws/project-cluster/argocd/argocd-repo-server-deployment.yaml diff --git a/templates/workload-project-cluster/argocd/argocd-server-deployment.yaml b/templates/aws/project-cluster/argocd/argocd-server-deployment.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/argocd-server-deployment.yaml rename to templates/aws/project-cluster/argocd/argocd-server-deployment.yaml diff --git a/templates/workload-project-cluster/argocd/argocd-server-sa.yaml b/templates/aws/project-cluster/argocd/argocd-server-sa.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/argocd-server-sa.yaml rename to templates/aws/project-cluster/argocd/argocd-server-sa.yaml diff --git a/templates/workload-project-cluster/argocd/argocd-ui-ingress.yaml b/templates/aws/project-cluster/argocd/argocd-ui-ingress.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/argocd-ui-ingress.yaml rename to templates/aws/project-cluster/argocd/argocd-ui-ingress.yaml diff --git a/templates/workload-project-cluster/argocd/kustomization.yaml b/templates/aws/project-cluster/argocd/kustomization.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/kustomization.yaml rename to templates/aws/project-cluster/argocd/kustomization.yaml diff --git a/templates/workload-project-cluster/argocd/rbac.yaml b/templates/aws/project-cluster/argocd/rbac.yaml similarity index 100% rename from templates/workload-project-cluster/argocd/rbac.yaml rename to templates/aws/project-cluster/argocd/rbac.yaml diff --git a/templates/workload-project-cluster/cert-issuers/clusterissuers.yaml b/templates/aws/project-cluster/cert-issuers/clusterissuers.yaml similarity index 100% rename from templates/workload-project-cluster/cert-issuers/clusterissuers.yaml rename to templates/aws/project-cluster/cert-issuers/clusterissuers.yaml diff --git a/templates/workload-project-cluster/cluster-secret-store/clustersecretstore.yaml b/templates/aws/project-cluster/cluster-secret-store/clustersecretstore.yaml similarity index 100% rename from templates/workload-project-cluster/cluster-secret-store/clustersecretstore.yaml rename to templates/aws/project-cluster/cluster-secret-store/clustersecretstore.yaml diff --git a/templates/workload-project-cluster/crossplane-components/controllerconfig.yaml b/templates/aws/project-cluster/crossplane-components/controllerconfig.yaml similarity index 100% rename from templates/workload-project-cluster/crossplane-components/controllerconfig.yaml rename to templates/aws/project-cluster/crossplane-components/controllerconfig.yaml diff --git a/templates/workload-project-cluster/crossplane-components/crossplane-secrets.yaml b/templates/aws/project-cluster/crossplane-components/crossplane-secrets.yaml similarity index 100% rename from templates/workload-project-cluster/crossplane-components/crossplane-secrets.yaml rename to templates/aws/project-cluster/crossplane-components/crossplane-secrets.yaml diff --git a/templates/workload-project-cluster/crossplane-components/svc.yaml b/templates/aws/project-cluster/crossplane-components/svc.yaml similarity index 100% rename from templates/workload-project-cluster/crossplane-components/svc.yaml rename to templates/aws/project-cluster/crossplane-components/svc.yaml diff --git a/templates/workload-project-cluster/crossplane-components/terraform-provider.yaml b/templates/aws/project-cluster/crossplane-components/terraform-provider.yaml similarity index 100% rename from templates/workload-project-cluster/crossplane-components/terraform-provider.yaml rename to templates/aws/project-cluster/crossplane-components/terraform-provider.yaml diff --git a/templates/workload-downstream-cluster/infrastructure-bootstrap/wait.yaml b/templates/aws/project-cluster/infrastructure-bootstrap/wait.yaml similarity index 100% rename from templates/workload-downstream-cluster/infrastructure-bootstrap/wait.yaml rename to templates/aws/project-cluster/infrastructure-bootstrap/wait.yaml diff --git a/templates/workload-downstream-cluster/infrastructure-bootstrap/workspace.yaml b/templates/aws/project-cluster/infrastructure-bootstrap/workspace.yaml similarity index 100% rename from templates/workload-downstream-cluster/infrastructure-bootstrap/workspace.yaml rename to templates/aws/project-cluster/infrastructure-bootstrap/workspace.yaml diff --git a/templates/civo-workload-cluster/infrastructure/wait.yaml b/templates/aws/project-cluster/infrastructure/wait.yaml similarity index 100% rename from templates/civo-workload-cluster/infrastructure/wait.yaml rename to templates/aws/project-cluster/infrastructure/wait.yaml diff --git a/templates/workload-project-cluster/infrastructure/workspace.yaml b/templates/aws/project-cluster/infrastructure/workspace.yaml similarity index 100% rename from templates/workload-project-cluster/infrastructure/workspace.yaml rename to templates/aws/project-cluster/infrastructure/workspace.yaml diff --git a/templates/workload-downstream-cluster/kubefirst.yaml b/templates/aws/project-cluster/kubefirst.yaml similarity index 100% rename from templates/workload-downstream-cluster/kubefirst.yaml rename to templates/aws/project-cluster/kubefirst.yaml diff --git a/templates/workload-project-cluster/provider-config/providerconfig.yaml b/templates/aws/project-cluster/provider-config/providerconfig.yaml similarity index 100% rename from templates/workload-project-cluster/provider-config/providerconfig.yaml rename to templates/aws/project-cluster/provider-config/providerconfig.yaml diff --git a/templates/workload-project-cluster/registry-workload-cluster.yaml b/templates/aws/project-cluster/registry-workload-cluster.yaml similarity index 100% rename from templates/workload-project-cluster/registry-workload-cluster.yaml rename to templates/aws/project-cluster/registry-workload-cluster.yaml diff --git a/templates/workload-project-cluster/secrets/ecr-secrets.yaml b/templates/aws/project-cluster/secrets/ecr-secrets.yaml similarity index 100% rename from templates/workload-project-cluster/secrets/ecr-secrets.yaml rename to templates/aws/project-cluster/secrets/ecr-secrets.yaml diff --git a/templates/workload-project-cluster/secrets/secret.yaml b/templates/aws/project-cluster/secrets/secret.yaml similarity index 100% rename from templates/workload-project-cluster/secrets/secret.yaml rename to templates/aws/project-cluster/secrets/secret.yaml diff --git a/templates/civo-workload-cluster/0-providerconfig.yaml b/templates/aws/workload-cluster/0-providerconfig.yaml similarity index 100% rename from templates/civo-workload-cluster/0-providerconfig.yaml rename to templates/aws/workload-cluster/0-providerconfig.yaml diff --git a/templates/workload-downstream-cluster/10-infrastructure.yaml b/templates/aws/workload-cluster/10-infrastructure.yaml similarity index 100% rename from templates/workload-downstream-cluster/10-infrastructure.yaml rename to templates/aws/workload-cluster/10-infrastructure.yaml diff --git a/templates/workload-downstream-cluster/15-infrastructure-bootstrap.yaml b/templates/aws/workload-cluster/15-infrastructure-bootstrap.yaml similarity index 100% rename from templates/workload-downstream-cluster/15-infrastructure-bootstrap.yaml rename to templates/aws/workload-cluster/15-infrastructure-bootstrap.yaml diff --git a/templates/workload-downstream-cluster/20-argocd-connection.yaml b/templates/aws/workload-cluster/20-argocd-connection.yaml similarity index 100% rename from templates/workload-downstream-cluster/20-argocd-connection.yaml rename to templates/aws/workload-cluster/20-argocd-connection.yaml diff --git a/templates/workload-downstream-cluster/30-cert-manager.yaml b/templates/aws/workload-cluster/30-cert-manager.yaml similarity index 100% rename from templates/workload-downstream-cluster/30-cert-manager.yaml rename to templates/aws/workload-cluster/30-cert-manager.yaml diff --git a/templates/workload-downstream-cluster/30-external-dns.yaml b/templates/aws/workload-cluster/30-external-dns.yaml similarity index 100% rename from templates/workload-downstream-cluster/30-external-dns.yaml rename to templates/aws/workload-cluster/30-external-dns.yaml diff --git a/templates/workload-downstream-cluster/30-external-secrets-operator.yaml b/templates/aws/workload-cluster/30-external-secrets-operator.yaml similarity index 100% rename from templates/workload-downstream-cluster/30-external-secrets-operator.yaml rename to templates/aws/workload-cluster/30-external-secrets-operator.yaml diff --git a/templates/workload-downstream-cluster/30-ingress-nginx.yaml b/templates/aws/workload-cluster/30-ingress-nginx.yaml similarity index 100% rename from templates/workload-downstream-cluster/30-ingress-nginx.yaml rename to templates/aws/workload-cluster/30-ingress-nginx.yaml diff --git a/templates/workload-downstream-cluster/30-reloader.yaml b/templates/aws/workload-cluster/30-reloader.yaml similarity index 100% rename from templates/workload-downstream-cluster/30-reloader.yaml rename to templates/aws/workload-cluster/30-reloader.yaml diff --git a/templates/workload-downstream-cluster/40-clusterissuers.yaml b/templates/aws/workload-cluster/40-clusterissuers.yaml similarity index 100% rename from templates/workload-downstream-cluster/40-clusterissuers.yaml rename to templates/aws/workload-cluster/40-clusterissuers.yaml diff --git a/templates/workload-downstream-cluster/40-clustersecretstore.yaml b/templates/aws/workload-cluster/40-clustersecretstore.yaml similarity index 100% rename from templates/workload-downstream-cluster/40-clustersecretstore.yaml rename to templates/aws/workload-cluster/40-clustersecretstore.yaml diff --git a/templates/workload-downstream-cluster/40-rbac.yaml b/templates/aws/workload-cluster/40-rbac.yaml similarity index 100% rename from templates/workload-downstream-cluster/40-rbac.yaml rename to templates/aws/workload-cluster/40-rbac.yaml diff --git a/templates/workload-downstream-cluster/40-secret.yaml b/templates/aws/workload-cluster/40-secret.yaml similarity index 100% rename from templates/workload-downstream-cluster/40-secret.yaml rename to templates/aws/workload-cluster/40-secret.yaml diff --git a/templates/civo-workload-cluster/45-environment.yaml b/templates/aws/workload-cluster/45-environment.yaml similarity index 100% rename from templates/civo-workload-cluster/45-environment.yaml rename to templates/aws/workload-cluster/45-environment.yaml diff --git a/templates/workload-downstream-cluster/cert-issuers/clusterissuers.yaml b/templates/aws/workload-cluster/cert-issuers/clusterissuers.yaml similarity index 100% rename from templates/workload-downstream-cluster/cert-issuers/clusterissuers.yaml rename to templates/aws/workload-cluster/cert-issuers/clusterissuers.yaml diff --git a/templates/workload-downstream-cluster/cluster-secret-store/clustersecretstore.yaml b/templates/aws/workload-cluster/cluster-secret-store/clustersecretstore.yaml similarity index 100% rename from templates/workload-downstream-cluster/cluster-secret-store/clustersecretstore.yaml rename to templates/aws/workload-cluster/cluster-secret-store/clustersecretstore.yaml diff --git a/templates/workload-project-cluster/infrastructure-bootstrap/wait.yaml b/templates/aws/workload-cluster/infrastructure-bootstrap/wait.yaml similarity index 100% rename from templates/workload-project-cluster/infrastructure-bootstrap/wait.yaml rename to templates/aws/workload-cluster/infrastructure-bootstrap/wait.yaml diff --git a/templates/workload-project-cluster/infrastructure-bootstrap/workspace.yaml b/templates/aws/workload-cluster/infrastructure-bootstrap/workspace.yaml similarity index 100% rename from templates/workload-project-cluster/infrastructure-bootstrap/workspace.yaml rename to templates/aws/workload-cluster/infrastructure-bootstrap/workspace.yaml diff --git a/templates/workload-downstream-cluster/infrastructure/wait.yaml b/templates/aws/workload-cluster/infrastructure/wait.yaml similarity index 100% rename from templates/workload-downstream-cluster/infrastructure/wait.yaml rename to templates/aws/workload-cluster/infrastructure/wait.yaml diff --git a/templates/workload-downstream-cluster/infrastructure/workspace.yaml b/templates/aws/workload-cluster/infrastructure/workspace.yaml similarity index 100% rename from templates/workload-downstream-cluster/infrastructure/workspace.yaml rename to templates/aws/workload-cluster/infrastructure/workspace.yaml diff --git a/templates/workload-project-cluster/kubefirst.yaml b/templates/aws/workload-cluster/kubefirst.yaml similarity index 100% rename from templates/workload-project-cluster/kubefirst.yaml rename to templates/aws/workload-cluster/kubefirst.yaml diff --git a/templates/workload-downstream-cluster/provider-config/providerconfig.yaml b/templates/aws/workload-cluster/provider-config/providerconfig.yaml similarity index 100% rename from templates/workload-downstream-cluster/provider-config/providerconfig.yaml rename to templates/aws/workload-cluster/provider-config/providerconfig.yaml diff --git a/templates/workload-downstream-cluster/rbac/cluster-role-binding.yaml b/templates/aws/workload-cluster/rbac/cluster-role-binding.yaml similarity index 100% rename from templates/workload-downstream-cluster/rbac/cluster-role-binding.yaml rename to templates/aws/workload-cluster/rbac/cluster-role-binding.yaml diff --git a/templates/workload-downstream-cluster/rbac/cluster-role.yaml b/templates/aws/workload-cluster/rbac/cluster-role.yaml similarity index 100% rename from templates/workload-downstream-cluster/rbac/cluster-role.yaml rename to templates/aws/workload-cluster/rbac/cluster-role.yaml diff --git a/templates/civo-workload-cluster/registry-workload-cluster.yaml b/templates/aws/workload-cluster/registry-workload-cluster.yaml similarity index 100% rename from templates/civo-workload-cluster/registry-workload-cluster.yaml rename to templates/aws/workload-cluster/registry-workload-cluster.yaml diff --git a/templates/workload-downstream-cluster/secrets/ecr.yaml b/templates/aws/workload-cluster/secrets/ecr.yaml similarity index 100% rename from templates/workload-downstream-cluster/secrets/ecr.yaml rename to templates/aws/workload-cluster/secrets/ecr.yaml diff --git a/templates/civo-workload-cluster/workloadcluster-environment-project.yaml b/templates/aws/workload-cluster/workloadcluster-environment-project.yaml similarity index 100% rename from templates/civo-workload-cluster/workloadcluster-environment-project.yaml rename to templates/aws/workload-cluster/workloadcluster-environment-project.yaml diff --git a/templates/workload-downstream-cluster/workloadcluster-platform-project.yaml b/templates/aws/workload-cluster/workloadcluster-platform-project.yaml similarity index 100% rename from templates/workload-downstream-cluster/workloadcluster-platform-project.yaml rename to templates/aws/workload-cluster/workloadcluster-platform-project.yaml diff --git a/templates/civo-workload-cluster/workloadcluster-project.yaml b/templates/aws/workload-cluster/workloadcluster-project.yaml similarity index 100% rename from templates/civo-workload-cluster/workloadcluster-project.yaml rename to templates/aws/workload-cluster/workloadcluster-project.yaml diff --git a/templates/workload-downstream-cluster/0-providerconfig.yaml b/templates/aws/workload-vcluster/0-providerconfig.yaml similarity index 100% rename from templates/workload-downstream-cluster/0-providerconfig.yaml rename to templates/aws/workload-vcluster/0-providerconfig.yaml diff --git a/templates/workload-downstream-host-vcluster/10-infrastructure.yaml b/templates/aws/workload-vcluster/10-infrastructure.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/10-infrastructure.yaml rename to templates/aws/workload-vcluster/10-infrastructure.yaml diff --git a/templates/workload-downstream-host-vcluster/15-bootstrap.yaml b/templates/aws/workload-vcluster/15-bootstrap.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/15-bootstrap.yaml rename to templates/aws/workload-vcluster/15-bootstrap.yaml diff --git a/templates/civo-workload-cluster/20-argocd-connection.yaml b/templates/aws/workload-vcluster/20-argocd-connection.yaml similarity index 100% rename from templates/civo-workload-cluster/20-argocd-connection.yaml rename to templates/aws/workload-vcluster/20-argocd-connection.yaml diff --git a/templates/civo-workload-cluster/30-cert-manager.yaml b/templates/aws/workload-vcluster/30-cert-manager.yaml similarity index 100% rename from templates/civo-workload-cluster/30-cert-manager.yaml rename to templates/aws/workload-vcluster/30-cert-manager.yaml diff --git a/templates/workload-downstream-host-vcluster/30-external-dns.yaml b/templates/aws/workload-vcluster/30-external-dns.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/30-external-dns.yaml rename to templates/aws/workload-vcluster/30-external-dns.yaml diff --git a/templates/workload-downstream-host-vcluster/30-external-secrets-operator.yaml b/templates/aws/workload-vcluster/30-external-secrets-operator.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/30-external-secrets-operator.yaml rename to templates/aws/workload-vcluster/30-external-secrets-operator.yaml diff --git a/templates/workload-downstream-host-vcluster/30-ingress-nginx.yaml b/templates/aws/workload-vcluster/30-ingress-nginx.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/30-ingress-nginx.yaml rename to templates/aws/workload-vcluster/30-ingress-nginx.yaml diff --git a/templates/civo-workload-cluster/30-reloader.yaml b/templates/aws/workload-vcluster/30-reloader.yaml similarity index 100% rename from templates/civo-workload-cluster/30-reloader.yaml rename to templates/aws/workload-vcluster/30-reloader.yaml diff --git a/templates/workload-downstream-host-vcluster/40-clusterissuers.yaml b/templates/aws/workload-vcluster/40-clusterissuers.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/40-clusterissuers.yaml rename to templates/aws/workload-vcluster/40-clusterissuers.yaml diff --git a/templates/workload-downstream-host-vcluster/40-clustersecretstore.yaml b/templates/aws/workload-vcluster/40-clustersecretstore.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/40-clustersecretstore.yaml rename to templates/aws/workload-vcluster/40-clustersecretstore.yaml diff --git a/templates/workload-downstream-host-vcluster/40-rbac.yaml b/templates/aws/workload-vcluster/40-rbac.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/40-rbac.yaml rename to templates/aws/workload-vcluster/40-rbac.yaml diff --git a/templates/workload-downstream-host-vcluster/45-environment.yaml b/templates/aws/workload-vcluster/45-environment.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/45-environment.yaml rename to templates/aws/workload-vcluster/45-environment.yaml diff --git a/templates/workload-downstream-host-vcluster/bootstrap/workspace.yaml b/templates/aws/workload-vcluster/bootstrap/workspace.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/bootstrap/workspace.yaml rename to templates/aws/workload-vcluster/bootstrap/workspace.yaml diff --git a/templates/workload-downstream-host-vcluster/cert-issuers/clusterissuers.yaml b/templates/aws/workload-vcluster/cert-issuers/clusterissuers.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/cert-issuers/clusterissuers.yaml rename to templates/aws/workload-vcluster/cert-issuers/clusterissuers.yaml diff --git a/templates/workload-downstream-host-vcluster/cluster-secret-store/clustersecretstore.yaml b/templates/aws/workload-vcluster/cluster-secret-store/clustersecretstore.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/cluster-secret-store/clustersecretstore.yaml rename to templates/aws/workload-vcluster/cluster-secret-store/clustersecretstore.yaml diff --git a/templates/workload-downstream-host-vcluster/infrastructure/wait.yaml b/templates/aws/workload-vcluster/infrastructure/wait.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/infrastructure/wait.yaml rename to templates/aws/workload-vcluster/infrastructure/wait.yaml diff --git a/templates/workload-downstream-host-vcluster/infrastructure/workspace.yaml b/templates/aws/workload-vcluster/infrastructure/workspace.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/infrastructure/workspace.yaml rename to templates/aws/workload-vcluster/infrastructure/workspace.yaml diff --git a/templates/workload-downstream-host-vcluster/kubefirst.yaml b/templates/aws/workload-vcluster/kubefirst.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/kubefirst.yaml rename to templates/aws/workload-vcluster/kubefirst.yaml diff --git a/templates/workload-downstream-host-vcluster/provider-config/providerconfig.yaml b/templates/aws/workload-vcluster/provider-config/providerconfig.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/provider-config/providerconfig.yaml rename to templates/aws/workload-vcluster/provider-config/providerconfig.yaml diff --git a/templates/workload-downstream-host-vcluster/rbac/cluster-role-binding.yaml b/templates/aws/workload-vcluster/rbac/cluster-role-binding.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/rbac/cluster-role-binding.yaml rename to templates/aws/workload-vcluster/rbac/cluster-role-binding.yaml diff --git a/templates/workload-downstream-host-vcluster/rbac/cluster-role.yaml b/templates/aws/workload-vcluster/rbac/cluster-role.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/rbac/cluster-role.yaml rename to templates/aws/workload-vcluster/rbac/cluster-role.yaml diff --git a/templates/workload-downstream-host-vcluster/registry-workload-cluster.yaml b/templates/aws/workload-vcluster/registry-workload-cluster.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/registry-workload-cluster.yaml rename to templates/aws/workload-vcluster/registry-workload-cluster.yaml diff --git a/templates/workload-downstream-cluster/workloadcluster-environment-project.yaml b/templates/aws/workload-vcluster/workloadcluster-environment-project.yaml similarity index 100% rename from templates/workload-downstream-cluster/workloadcluster-environment-project.yaml rename to templates/aws/workload-vcluster/workloadcluster-environment-project.yaml diff --git a/templates/workload-downstream-host-vcluster/workloadcluster-platform-project.yaml b/templates/aws/workload-vcluster/workloadcluster-platform-project.yaml similarity index 100% rename from templates/workload-downstream-host-vcluster/workloadcluster-platform-project.yaml rename to templates/aws/workload-vcluster/workloadcluster-platform-project.yaml diff --git a/templates/workload-downstream-cluster/workloadcluster-project.yaml b/templates/aws/workload-vcluster/workloadcluster-project.yaml similarity index 100% rename from templates/workload-downstream-cluster/workloadcluster-project.yaml rename to templates/aws/workload-vcluster/workloadcluster-project.yaml diff --git a/templates/civo-workload-cluster/infrastructure/workspace.yaml b/templates/civo-workload-cluster/infrastructure/workspace.yaml deleted file mode 100644 index 3956fc7..0000000 --- a/templates/civo-workload-cluster/infrastructure/workspace.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: tf.upbound.io/v1beta1 -kind: Workspace -metadata: - name: -infrastructure -spec: - providerConfigRef: - name: - forProvider: - source: Remote - module: - vars: - - key: cluster_name - value: - - key: cluster_region - value: - - key: environment - value: - - key: node_count - value: "" - - key: node_type - value: - - key: is_gpu - value: "false" diff --git a/templates/civo-workload-cluster/kubefirst.yaml b/templates/civo-workload-cluster/kubefirst.yaml deleted file mode 100644 index 8b13789..0000000 --- a/templates/civo-workload-cluster/kubefirst.yaml +++ /dev/null @@ -1 +0,0 @@ - diff --git a/templates/civo/project-cluster/Chart.yaml b/templates/civo/project-cluster/Chart.yaml new file mode 100644 index 0000000..47baa1c --- /dev/null +++ b/templates/civo/project-cluster/Chart.yaml @@ -0,0 +1,15 @@ +apiVersion: v2 +name: civo-project-cluster +description: "Civo project cluster template for Konstruct with ArgoCD Applications, Crossplane infrastructure, and core platform services" +type: application +version: 2.0.0 +appVersion: "2.0" +keywords: + - argocd + - project-cluster + - gitops + - crossplane + - terraform + - civo +maintainers: + - name: Konstruct diff --git a/templates/workload-downstream-cluster/45-environment.yaml b/templates/civo/project-cluster/templates/0-providerconfig.yaml similarity index 55% rename from templates/workload-downstream-cluster/45-environment.yaml rename to templates/civo/project-cluster/templates/0-providerconfig.yaml index 683b7c5..6f4d623 100644 --- a/templates/workload-downstream-cluster/45-environment.yaml +++ b/templates/civo/project-cluster/templates/0-providerconfig.yaml @@ -1,21 +1,21 @@ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: - + name: {{ .Values.workloadClusterName }}-provider-config namespace: argocd finalizers: - resources-finalizer.argocd.argoproj.io annotations: - argocd.argoproj.io/sync-wave: '45' + argocd.argoproj.io/sync-wave: '0' spec: - project: -environment + project: default source: - repoURL: - path: registry/environments// + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/provider-config targetRevision: HEAD destination: name: in-cluster - namespace: -environment + namespace: crossplane-system syncPolicy: automated: prune: true diff --git a/templates/civo/project-cluster/templates/10-infrastructure.yaml b/templates/civo/project-cluster/templates/10-infrastructure.yaml new file mode 100644 index 0000000..c8e5576 --- /dev/null +++ b/templates/civo/project-cluster/templates/10-infrastructure.yaml @@ -0,0 +1,29 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-infrastructure + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/infrastructure + targetRevision: HEAD + destination: + name: in-cluster + namespace: {{ .Values.workloadClusterName }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 30 + backoff: + duration: 1m + factor: 1 diff --git a/templates/civo/project-cluster/templates/15-infrastructure-bootstrap.yaml b/templates/civo/project-cluster/templates/15-infrastructure-bootstrap.yaml new file mode 100644 index 0000000..87fd876 --- /dev/null +++ b/templates/civo/project-cluster/templates/15-infrastructure-bootstrap.yaml @@ -0,0 +1,29 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-bootstrap + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '15' +spec: + project: default + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/infrastructure-bootstrap + targetRevision: HEAD + destination: + name: in-cluster + namespace: {{ .Values.workloadClusterName }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 30 + backoff: + duration: 1m + factor: 1 diff --git a/templates/workload-downstream-host-vcluster/20-argocd-connection.yaml b/templates/civo/project-cluster/templates/20-argocd-connection.yaml similarity index 74% rename from templates/workload-downstream-host-vcluster/20-argocd-connection.yaml rename to templates/civo/project-cluster/templates/20-argocd-connection.yaml index fe735a7..d8ba1e7 100644 --- a/templates/workload-downstream-host-vcluster/20-argocd-connection.yaml +++ b/templates/civo/project-cluster/templates/20-argocd-connection.yaml @@ -1,14 +1,14 @@ -apiVersion: "external-secrets.io/v1" +apiVersion: "external-secrets.io/v1beta1" kind: ExternalSecret metadata: - name: + name: {{ .Values.workloadClusterName }} annotations: argocd.argoproj.io/sync-wave: '20' labels: app.kubernetes.io/part-of: argocd spec: target: - name: + name: {{ .Values.workloadClusterName }} template: metadata: labels: @@ -30,33 +30,33 @@ spec: } secretStoreRef: kind: ClusterSecretStore - name: -aws-ssm + name: vault-kv-secret refreshInterval: 10s data: - remoteRef: - key: /clusters/ + key: clusters/{{ .Values.workloadClusterName }} property: argocd_manager_sa_token secretKey: argocd_manager_sa_token - remoteRef: - key: /clusters/ + key: clusters/{{ .Values.workloadClusterName }} property: host secretKey: host - remoteRef: - key: /clusters/ + key: clusters/{{ .Values.workloadClusterName }} property: cluster_name secretKey: cluster_name - remoteRef: - key: /clusters/ + key: clusters/{{ .Values.workloadClusterName }} property: cluster_ca_certificate conversionStrategy: Default secretKey: cluster_ca_certificate - remoteRef: - key: /clusters/ + key: clusters/{{ .Values.workloadClusterName }} property: client_certificate conversionStrategy: Default secretKey: client_certificate - remoteRef: - key: /clusters/ + key: clusters/{{ .Values.workloadClusterName }} property: client_key conversionStrategy: Default secretKey: client_key diff --git a/templates/civo/project-cluster/templates/30-argocd.yaml b/templates/civo/project-cluster/templates/30-argocd.yaml new file mode 100644 index 0000000..4fb54ef --- /dev/null +++ b/templates/civo/project-cluster/templates/30-argocd.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-argocd + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: {{ .Values.clusterName }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/argocd + targetRevision: HEAD + destination: + name: {{ .Values.clusterName }} + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/civo/project-cluster/templates/30-crossplane.yaml b/templates/civo/project-cluster/templates/30-crossplane.yaml new file mode 100644 index 0000000..e26d715 --- /dev/null +++ b/templates/civo/project-cluster/templates/30-crossplane.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-crossplane + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "30" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: {{ .Values.workloadClusterName }} + destination: + name: {{ .Values.workloadClusterName }} + namespace: crossplane-system + source: + repoURL: https://charts.crossplane.io/stable + chart: crossplane + targetRevision: 1.17.0 + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/civo/project-cluster/templates/30-external-dns.yaml b/templates/civo/project-cluster/templates/30-external-dns.yaml new file mode 100644 index 0000000..fd9958b --- /dev/null +++ b/templates/civo/project-cluster/templates/30-external-dns.yaml @@ -0,0 +1,44 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-external-dns + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: {{ .Values.workloadClusterName }} + source: + repoURL: https://kubernetes-sigs.github.io/external-dns + targetRevision: 1.14.4 + helm: + releaseName: external-dns + values: | + image: + repository: registry.k8s.io/external-dns/external-dns + tag: "v0.13.2" + serviceAccount: + create: true + name: external-dns + provider: {{ .Values.externalDnsProviderName }} + sources: + - ingress + domainFilters: + - {{ .Values.workloadExternalDnsDomainName }} + env: + - name: {{ .Values.externalDnsProviderTokenEnvName }} + valueFrom: + secretKeyRef: + name: external-dns-secrets + key: token + chart: external-dns + destination: + name: {{ .Values.workloadClusterName }} + namespace: external-dns + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/civo/project-cluster/templates/30-external-secrets-operator.yaml b/templates/civo/project-cluster/templates/30-external-secrets-operator.yaml new file mode 100644 index 0000000..cacd679 --- /dev/null +++ b/templates/civo/project-cluster/templates/30-external-secrets-operator.yaml @@ -0,0 +1,73 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-external-secrets-operator + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: {{ .Values.workloadClusterName }} + source: + repoURL: https://charts.external-secrets.io + targetRevision: 0.19.2 + helm: + values: |- + serviceAccount: + create: true + name: external-secrets + chart: external-secrets + destination: + name: {{ .Values.workloadClusterName }} + namespace: external-secrets-operator + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - RespectIgnoreDifferences=true + - ServerSideApply=true + - ServerSideApplyForce=true + ignoreDifferences: + - group: apiextensions.k8s.io + kind: CustomResourceDefinition + jqPathExpressions: + - .spec.conversion.webhook.clientConfig.caBundle + - .spec.conversion.webhook.clientConfig.service.name + - .spec.conversion.webhook.clientConfig.service.namespace + - group: admissionregistration.k8s.io + kind: ValidatingWebhookConfiguration + jqPathExpressions: + - .webhooks[]?.clientConfig.caBundle +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ .Values.workloadClusterName }}-eso-kubernetes-external-secrets-auth + annotations: + argocd.argoproj.io/sync-wave: '40' +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: 'system:auth-delegator' +subjects: + - kind: ServiceAccount + name: external-secrets + namespace: external-secrets-operator +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ .Values.workloadClusterName }}-eso-kubernetes-external-secrets-auth2 + annotations: + argocd.argoproj.io/sync-wave: '40' +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: 'cluster-admin' +subjects: + - kind: ServiceAccount + name: external-secrets + namespace: external-secrets-operator diff --git a/templates/civo/project-cluster/templates/30-reloader.yaml b/templates/civo/project-cluster/templates/30-reloader.yaml new file mode 100644 index 0000000..b78a188 --- /dev/null +++ b/templates/civo/project-cluster/templates/30-reloader.yaml @@ -0,0 +1,33 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-reloader + finalizers: + - resources-finalizer.argocd.argoproj.io + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: {{ .Values.workloadClusterName }} + source: + repoURL: 'https://stakater.github.io/stakater-charts' + targetRevision: v1.0.10 + chart: reloader + helm: + values: |- + ignoreSecrets: false + destination: + name: {{ .Values.workloadClusterName }} + namespace: reloader + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/templates/civo/project-cluster/templates/35-clustersecretstore.yaml b/templates/civo/project-cluster/templates/35-clustersecretstore.yaml new file mode 100644 index 0000000..0eb0aee --- /dev/null +++ b/templates/civo/project-cluster/templates/35-clustersecretstore.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-cluster-secret-store + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '35' +spec: + project: {{ .Values.workloadClusterName }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/cluster-secret-store + targetRevision: HEAD + destination: + name: {{ .Values.workloadClusterName }} + namespace: external-secrets-operator + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/civo/project-cluster/templates/40-crossplane-components.yaml b/templates/civo/project-cluster/templates/40-crossplane-components.yaml new file mode 100644 index 0000000..9088f94 --- /dev/null +++ b/templates/civo/project-cluster/templates/40-crossplane-components.yaml @@ -0,0 +1,25 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-crossplane-components + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '40' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: {{ .Values.workloadClusterName }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/crossplane-components + targetRevision: HEAD + destination: + name: {{ .Values.workloadClusterName }} + namespace: crossplane-system + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - Replace=true diff --git a/templates/civo/project-cluster/templates/40-secret.yaml b/templates/civo/project-cluster/templates/40-secret.yaml new file mode 100644 index 0000000..4a725b4 --- /dev/null +++ b/templates/civo/project-cluster/templates/40-secret.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-secrets + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '40' +spec: + project: {{ .Values.clusterName }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/konstruct-clusters/{{ .Values.clusterName }}/secrets + targetRevision: HEAD + destination: + name: {{ .Values.clusterName }} + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/civo-workload-cluster/workloadcluster-platform-project.yaml b/templates/civo/project-cluster/templates/appproject-workload-cluster.yaml similarity index 57% rename from templates/civo-workload-cluster/workloadcluster-platform-project.yaml rename to templates/civo/project-cluster/templates/appproject-workload-cluster.yaml index b23d7d5..889f44f 100644 --- a/templates/civo-workload-cluster/workloadcluster-platform-project.yaml +++ b/templates/civo/project-cluster/templates/appproject-workload-cluster.yaml @@ -1,16 +1,16 @@ apiVersion: argoproj.io/v1alpha1 kind: AppProject metadata: - name: -platform + name: {{ .Values.workloadClusterName }} namespace: argocd annotations: argocd.argoproj.io/sync-wave: "-1" finalizers: - resources-finalizer.argocd.argoproj.io spec: - description: description + description: {{ .Values.workloadClusterName }} description sourceRepos: - - '*' + - '*' destinations: - namespace: '*' server: '*' @@ -18,9 +18,9 @@ spec: - group: '*' kind: '*' roles: - - description: -admin-role + - description: {{ .Values.workloadClusterName }}-admin-role groups: - admins name: admin-role policies: - - p, proj::admin-role, applications, *, /*, allow + - p, proj:{{ .Values.workloadClusterName }}:admin-role, applications, *, {{ .Values.workloadClusterName }}/*, allow diff --git a/templates/civo/project-cluster/templates/argocd/application.yaml b/templates/civo/project-cluster/templates/argocd/application.yaml new file mode 100644 index 0000000..3d52de1 --- /dev/null +++ b/templates/civo/project-cluster/templates/argocd/application.yaml @@ -0,0 +1,87 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: argocd-application-creator + namespace: argocd +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: argocd-application-creator + namespace: argocd +rules: +- apiGroups: ["argoproj.io"] + resources: ["applications"] + verbs: ["create", "get", "update", "patch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: argocd-application-creator + namespace: argocd +subjects: +- kind: ServiceAccount + name: argocd-application-creator + namespace: argocd +roleRef: + kind: Role + name: argocd-application-creator + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: apply-argocd-clusters-app + namespace: argocd +spec: + ttlSecondsAfterFinished: 100 + template: + spec: + serviceAccountName: argocd-application-creator + restartPolicy: OnFailure + containers: + - name: kubectl + image: {{ .Values.waitJobImage }} + env: + - name: ORG_NAME + value: "{{ .Values.orgName }}" + - name: REPO_NAME + value: "{{ .Values.repoName }}" + - name: CLUSTER_NAME + value: "{{ .Values.workloadClusterName }}" + command: + - /bin/sh + - -c + - | + cat <-infrastructure-wait + name: {{ .Values.workloadClusterName }}-infrastructure-wait namespace: argocd annotations: argocd.argoproj.io/sync-wave: "20" @@ -11,14 +11,11 @@ spec: serviceAccountName: argocd-server containers: - name: wait - image: dtzar/helm-kubectl:3.19.0 + image: {{ .Values.waitJobImage }} command: - /bin/sh - -c - | - while ! kubectl wait --for=jsonpath='{.status.conditions[0].status}'='True' workspace/-infrastructure; do echo "waiting for cluster to provision"; sleep 5; done + while ! kubectl wait --for=jsonpath='{.status.conditions[0].status}'='True' workspace/{{ .Values.workloadClusterName }}-infrastructure; do echo "waiting for cluster to provision"; sleep 5; done restartPolicy: Never backoffLimit: 1 - - - diff --git a/templates/civo/project-cluster/templates/infrastructure/workspace.yaml b/templates/civo/project-cluster/templates/infrastructure/workspace.yaml new file mode 100644 index 0000000..2b3ab11 --- /dev/null +++ b/templates/civo/project-cluster/templates/infrastructure/workspace.yaml @@ -0,0 +1,20 @@ +apiVersion: tf.upbound.io/v1beta1 +kind: Workspace +metadata: + name: {{ .Values.workloadClusterName }}-infrastructure +spec: + providerConfigRef: + name: {{ .Values.workloadClusterName }} + forProvider: + source: Remote + module: {{ .Values.workloadClusterTerraformModuleUrl }} + enableTerraformCLILogging: true + vars: + - key: cluster_name + value: "{{ .Values.workloadClusterName }}" + - key: cluster_region + value: "{{ .Values.workloadClusterRegion }}" + - key: node_count + value: "{{ .Values.workloadNodeCount }}" + - key: node_type + value: "{{ .Values.workloadNodeType }}" diff --git a/templates/civo/project-cluster/templates/provider-config/providerconfig.yaml b/templates/civo/project-cluster/templates/provider-config/providerconfig.yaml new file mode 100644 index 0000000..150096b --- /dev/null +++ b/templates/civo/project-cluster/templates/provider-config/providerconfig.yaml @@ -0,0 +1,57 @@ +apiVersion: tf.upbound.io/v1beta1 +kind: ProviderConfig +metadata: + name: {{ .Values.workloadClusterName }} + annotations: + argocd.argoproj.io/sync-wave: "-1" +spec: + configuration: | + terraform { + backend "s3" { + bucket = "{{ .Values.kubefirstStateStoreBucket }}" + key = "registry/konstruct-clusters/{{ .Values.workloadClusterName }}/infrastructure/provider-config/terraform.tfstate" + region = "{{ .Values.cloudRegion }}" + endpoint = "https://objectstore.{{ .Values.cloudRegion }}.civo.com" + + skip_credentials_validation = true + skip_metadata_api_check = true + skip_region_validation = true + force_path_style = true + } + required_providers { + civo = { + source = "civo/civo" + version = "= 1.1.0" + } + } + } + provider "civo" { + credentials_file = "projectcluster-civo.json" + region = "{{ .Values.cloudRegion }}" + } + provider "civo" { + alias = "kubefirst_mgmt_s3_bucket_region" + credentials_file = "civo.json" + region = "{{ .Values.cloudRegion }}" + } + pluginCache: false + credentials: + - filename: projectcluster-civo.json + source: Secret + secretRef: + namespace: crossplane-system + name: {{ .Values.workloadClusterName }}-civo-creds + key: config.json + - filename: civo.json + source: Secret + secretRef: + namespace: crossplane-system + name: civo-creds + key: config.json + - filename: .git-credentials + source: Secret + secretRef: + + namespace: crossplane-system + name: git-credentials + key: creds diff --git a/templates/civo/project-cluster/templates/registry-workload-cluster.yaml b/templates/civo/project-cluster/templates/registry-workload-cluster.yaml new file mode 100644 index 0000000..ae80f4c --- /dev/null +++ b/templates/civo/project-cluster/templates/registry-workload-cluster.yaml @@ -0,0 +1,30 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: registry-{{ .Values.workloadClusterName }} + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '100' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: default + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/konstruct-clusters/{{ .Values.workloadClusterName }} + targetRevision: HEAD + destination: + server: https://kubernetes.default.svc + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 5 + backoff: + duration: 1m + maxDuration: 15m0s + factor: 2 diff --git a/templates/civo/project-cluster/templates/secrets/secret.yaml b/templates/civo/project-cluster/templates/secrets/secret.yaml new file mode 100644 index 0000000..df38282 --- /dev/null +++ b/templates/civo/project-cluster/templates/secrets/secret.yaml @@ -0,0 +1,69 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: repo-credentials-template-{{ .Values.projectOrg }} + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '20' + labels: + app.kubernetes.io/part-of: argocd +spec: + refreshInterval: 10s + secretStoreRef: + kind: ClusterSecretStore + name: {{ .Values.clusterName }}-vault-kv-secret + target: + name: repo-credentials-template-{{ .Values.projectOrg }} + creationPolicy: Owner + template: + metadata: + annotations: + managed-by: argocd.argoproj.io + labels: + argocd.argoproj.io/secret-type: repository + type: Opaque + data: + # Template will be populated from Vault data + type: "{{` {{ .type }} `}}" + name: "{{` {{ .name }} `}}" + url: "{{` {{ .url }} `}}" + username: "{{` {{ .username }} `}}" + password: "{{` {{ .password }} `}}" + dataFrom: + - extract: + key: argocd/repo-credentials-template/{{ .Values.projectName }} +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: repo-credentials-template-{{ .Values.platformOrg }} + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '20' + labels: + app.kubernetes.io/part-of: argocd +spec: + refreshInterval: 10s + secretStoreRef: + kind: ClusterSecretStore + name: {{ .Values.clusterName }}-vault-kv-secret + target: + name: repo-credentials-template-{{ .Values.platformOrg }} + creationPolicy: Owner + template: + metadata: + annotations: + managed-by: argocd.argoproj.io + labels: + argocd.argoproj.io/secret-type: repository + type: Opaque + data: + # Template will be populated from Vault data + type: "{{` {{ .type }} `}}" + name: "{{` {{ .name }} `}}" + url: "{{` {{ .url }} `}}" + username: "{{` {{ .username }} `}}" + password: "{{` {{ .password }} `}}" + dataFrom: + - extract: + key: argocd/repo-credentials-template/{{ .Values.projectName }}-platform diff --git a/templates/civo/project-cluster/values.yaml b/templates/civo/project-cluster/values.yaml new file mode 100644 index 0000000..3fea60b --- /dev/null +++ b/templates/civo/project-cluster/values.yaml @@ -0,0 +1,161 @@ +# Workload Cluster Configuration +# @input.type: string +# @input.description: the name of the workload cluster (used for naming resources and ArgoCD applications) +# @input.required: true +workloadClusterName: my-workload-cluster + +# @input.type: string +# @input.description: the cluster identifier (used for ArgoCD destinations and references) +# @input.required: true +clusterName: my-cluster + +# GitOps Repository Configuration +# @input.type: string +# @input.description: the GitHub organization name +# @input.required: true +orgName: my-org + +# @input.type: string +# @input.description: the GitOps repository name +# @input.required: true +repoName: gitops-repo + +# @input.type: string +# @input.description: the full GitOps repository URL (e.g., https://github.com/org/repo) +# @input.required: true +gitopsRepoUrl: "https://github.com/my-org/gitops-repo" + +# Domain Configuration +# @input.type: string +# @input.description: the base domain name for ingresses (e.g., example.com) +# @input.required: true +domainName: example.com + +# @input.type: string +# @input.description: the Dex OIDC provider domain for ArgoCD authentication +# @input.required: true +dexDomainName: "https://dex.example.com" + +# Workload Cluster Infrastructure Settings +# @input.type: string +# @input.description: the Civo region where the workload cluster will be deployed (e.g., LON1, NYC1, FRA1) +# @input.required: true +workloadClusterRegion: LON1 + +# @input.type: string +# @input.description: the AWS account ID for the workload cluster +# @input.required: true +workloadClusterAccountId: "123456789012" + +# @input.type: string +# @input.description: the IAM role ARN to assume for workload cluster operations +# @input.required: true +workloadAssumeRole: "arn:aws:iam::123456789012:role/crossplane-workload" + +# @input.type: string +# @input.description: the number of worker nodes in the Civo Kubernetes cluster +# @input.required: true +workloadNodeCount: "3" + +# @input.type: string +# @input.description: the Civo instance type for worker nodes (e.g., g4s.kube.small, g4s.kube.medium, g4s.kube.large) +# @input.required: true +workloadNodeType: g4s.kube.medium + +# @input.type: string +# @input.description: the AMI type for worker nodes +# @input.required: false +workloadAmiType: AL2_x86_64 + +# @input.type: string +# @input.description: the S3 bucket name for workload cluster data +# @input.required: true +workloadS3BucketName: workload-bucket + +# Management Cluster Configuration +# @input.type: string +# @input.description: the AWS account ID for the management (Kubefirst) cluster +# @input.required: true +kubefirstMgmtAccountId: "123456789012" + +# @input.type: string +# @input.description: the name of the Kubefirst management cluster +# @input.required: true +kubefirstMgmtClusterName: mgmt-cluster + +# @input.type: string +# @input.description: the primary cloud region for the management cluster +# @input.required: true +cloudRegion: us-east-1 + +# @input.type: string +# @input.description: the S3 bucket name for Terraform state storage +# @input.required: true +kubefirstStateStoreBucket: k1-state-store-bucket + +# Terraform Module Configuration +# @input.type: string +# @input.description: the complete URL for the Terraform module for infrastructure provisioning +# @input.required: true +workloadClusterTerraformModuleUrl: "git::https://github.com/konstructio/gitops-template.git//terraform/civo/modules/workload-cluster?ref=main" + +# @input.type: string +# @input.description: the complete URL for the Terraform bootstrap module +# @input.required: true +workloadClusterBootstrapTerraformModuleUrl: "git::https://github.com/konstructio/gitops-template.git//terraform/civo/modules/bootstrap?ref=main" + +# Project Configuration +# @input.type: string +# @input.description: the project organization name (used for secrets and credentials) +# @input.required: true +projectOrg: project-org + +# @input.type: string +# @input.description: the project name (used for Vault paths and ArgoCD credentials) +# @input.required: true +projectName: my-project + +# @input.type: string +# @input.description: the platform organization name (used for platform credentials) +# @input.required: true +platformOrg: platform-org + +# Cert-Manager Issuer Annotations +# @input.type: string +# @input.description: first cert-manager issuer annotation line (e.g., cert-manager.io/cluster-issuer: letsencrypt-prod) +# @input.required: false +certManagerIssuerAnnotation1: 'cert-manager.io/cluster-issuer: letsencrypt-prod' + +# @input.type: string +# @input.description: second cert-manager issuer annotation line (leave empty if not needed) +# @input.required: false +certManagerIssuerAnnotation2: "" + +# @input.type: string +# @input.description: third cert-manager issuer annotation line (leave empty if not needed) +# @input.required: false +certManagerIssuerAnnotation3: "" + +# @input.type: string +# @input.description: fourth cert-manager issuer annotation line (leave empty if not needed) +# @input.required: false +certManagerIssuerAnnotation4: "" + +# External DNS Configuration +# @input.type: string +# @input.description: the DNS provider name for external-dns (e.g., cloudflare, aws, digitalocean) +# @input.required: false +externalDnsProviderName: cloudflare + +# @input.type: string +# @input.description: the domain name filter for external-dns +# @input.required: false +workloadExternalDnsDomainName: example.com + +# @input.type: string +# @input.description: the environment variable name for the DNS provider token (e.g., CF_API_TOKEN) +# @input.required: false +externalDnsProviderTokenEnvName: CF_API_TOKEN + +# Wait Job Configuration +waitJobImage: "dtzar/helm-kubectl:3.19.0" diff --git a/templates/civo/workload-cluster/Chart.yaml b/templates/civo/workload-cluster/Chart.yaml new file mode 100644 index 0000000..b5ea525 --- /dev/null +++ b/templates/civo/workload-cluster/Chart.yaml @@ -0,0 +1,15 @@ +apiVersion: v2 +name: civo-workload-cluster +description: "Civo workload cluster template for Konstruct with ArgoCD Applications and core platform services" +type: application +version: 2.0.0 +appVersion: "2.0" +keywords: + - argocd + - workload-cluster + - gitops + - crossplane + - terraform + - civo +maintainers: + - name: Konstruct diff --git a/templates/workload-downstream-host-vcluster/0-providerconfig.yaml b/templates/civo/workload-cluster/templates/0-providerconfig.yaml similarity index 71% rename from templates/workload-downstream-host-vcluster/0-providerconfig.yaml rename to templates/civo/workload-cluster/templates/0-providerconfig.yaml index cac4df0..9093291 100644 --- a/templates/workload-downstream-host-vcluster/0-providerconfig.yaml +++ b/templates/civo/workload-cluster/templates/0-providerconfig.yaml @@ -1,7 +1,7 @@ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: -provider-config + name: {{ .Values.workloadClusterName }}-provider-config namespace: argocd finalizers: - resources-finalizer.argocd.argoproj.io @@ -10,8 +10,8 @@ metadata: spec: project: default source: - repoURL: - path: registry/clusters//provider-config + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.workloadClusterName }}/provider-config targetRevision: HEAD destination: name: in-cluster diff --git a/templates/civo-workload-cluster/10-infrastructure.yaml b/templates/civo/workload-cluster/templates/10-infrastructure.yaml similarity index 64% rename from templates/civo-workload-cluster/10-infrastructure.yaml rename to templates/civo/workload-cluster/templates/10-infrastructure.yaml index 5e2a0de..47c45de 100644 --- a/templates/civo-workload-cluster/10-infrastructure.yaml +++ b/templates/civo/workload-cluster/templates/10-infrastructure.yaml @@ -1,7 +1,7 @@ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: -infrastructure + name: {{ .Values.workloadClusterName }}-infrastructure namespace: argocd finalizers: - resources-finalizer.argocd.argoproj.io @@ -10,12 +10,12 @@ metadata: spec: project: default source: - repoURL: - path: registry/clusters//infrastructure + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.workloadClusterName }}/infrastructure targetRevision: HEAD destination: name: in-cluster - namespace: + namespace: {{ .Values.workloadClusterName }} syncPolicy: automated: prune: true diff --git a/templates/civo/workload-cluster/templates/20-argocd-connection.yaml b/templates/civo/workload-cluster/templates/20-argocd-connection.yaml new file mode 100644 index 0000000..26518df --- /dev/null +++ b/templates/civo/workload-cluster/templates/20-argocd-connection.yaml @@ -0,0 +1,62 @@ +apiVersion: "external-secrets.io/v1" +kind: ExternalSecret +metadata: + name: {{ .Values.workloadClusterName }} + annotations: + argocd.argoproj.io/sync-wave: '20' + labels: + app.kubernetes.io/part-of: argocd +spec: + target: + name: {{ .Values.workloadClusterName }} + template: + metadata: + labels: + argocd.argoproj.io/secret-type: cluster + engineVersion: v2 + data: + name: "{{` {{ .cluster_name }} `}}" + server: "{{` {{ .host }} `}}" + clusterResources: "true" + config: | + { + "bearerToken": "{{` {{ .argocd_manager_sa_token }} `}}", + "tlsClientConfig": { + "caData": "{{` {{ .cluster_ca_certificate | b64enc }} `}}", + "certData": "{{` {{ .client_certificate | b64enc }} `}}", + "insecure": false, + "keyData": "{{` {{ .client_key | b64enc }} `}}" + } + } + secretStoreRef: + kind: ClusterSecretStore + name: {{ .Values.projectClusterName }}-aws-ssm + refreshInterval: 10s + data: + - remoteRef: + key: /clusters/{{ .Values.workloadClusterName }} + property: argocd_manager_sa_token + secretKey: argocd_manager_sa_token + - remoteRef: + key: /clusters/{{ .Values.workloadClusterName }} + property: host + secretKey: host + - remoteRef: + key: /clusters/{{ .Values.workloadClusterName }} + property: cluster_name + secretKey: cluster_name + - remoteRef: + key: /clusters/{{ .Values.workloadClusterName }} + property: cluster_ca_certificate + conversionStrategy: Default + secretKey: cluster_ca_certificate + - remoteRef: + key: /clusters/{{ .Values.workloadClusterName }} + property: client_certificate + conversionStrategy: Default + secretKey: client_certificate + - remoteRef: + key: /clusters/{{ .Values.workloadClusterName }} + property: client_key + conversionStrategy: Default + secretKey: client_key diff --git a/templates/workload-downstream-host-vcluster/30-cert-manager.yaml b/templates/civo/workload-cluster/templates/30-cert-manager.yaml similarity index 79% rename from templates/workload-downstream-host-vcluster/30-cert-manager.yaml rename to templates/civo/workload-cluster/templates/30-cert-manager.yaml index a4a6472..c0bc0f6 100644 --- a/templates/workload-downstream-host-vcluster/30-cert-manager.yaml +++ b/templates/civo/workload-cluster/templates/30-cert-manager.yaml @@ -1,14 +1,14 @@ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: -cert-manager + name: {{ .Values.workloadClusterName }}-cert-manager namespace: argocd finalizers: - resources-finalizer.argocd.argoproj.io annotations: argocd.argoproj.io/sync-wave: '30' spec: - project: -platform + project: {{ .Values.workloadClusterName }}-platform source: repoURL: https://charts.jetstack.io targetRevision: v1.14.4 @@ -20,7 +20,7 @@ spec: installCRDs: true chart: cert-manager destination: - name: + name: {{ .Values.workloadClusterName }} namespace: cert-manager syncPolicy: automated: diff --git a/templates/civo-workload-cluster/30-ingress-nginx.yaml b/templates/civo/workload-cluster/templates/30-ingress-nginx.yaml similarity index 81% rename from templates/civo-workload-cluster/30-ingress-nginx.yaml rename to templates/civo/workload-cluster/templates/30-ingress-nginx.yaml index b75fcda..5c6ffad 100644 --- a/templates/civo-workload-cluster/30-ingress-nginx.yaml +++ b/templates/civo/workload-cluster/templates/30-ingress-nginx.yaml @@ -1,14 +1,14 @@ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: -ingress-nginx + name: {{ .Values.workloadClusterName }}-ingress-nginx namespace: argocd finalizers: - resources-finalizer.argocd.argoproj.io annotations: argocd.argoproj.io/sync-wave: '30' spec: - project: -platform + project: {{ .Values.workloadClusterName }}-platform source: repoURL: https://kubernetes.github.io/ingress-nginx targetRevision: 4.12.1 @@ -22,7 +22,7 @@ spec: enable-ssl-passthrough: true chart: ingress-nginx destination: - name: + name: {{ .Values.workloadClusterName }} namespace: ingress-nginx syncPolicy: automated: diff --git a/templates/workload-downstream-host-vcluster/30-reloader.yaml b/templates/civo/workload-cluster/templates/30-reloader.yaml similarity index 79% rename from templates/workload-downstream-host-vcluster/30-reloader.yaml rename to templates/civo/workload-cluster/templates/30-reloader.yaml index 3bf9dd4..f6dd120 100644 --- a/templates/workload-downstream-host-vcluster/30-reloader.yaml +++ b/templates/civo/workload-cluster/templates/30-reloader.yaml @@ -1,12 +1,12 @@ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: -reloader + name: {{ .Values.workloadClusterName }}-reloader namespace: argocd annotations: argocd.argoproj.io/sync-wave: '30' spec: - project: -platform + project: {{ .Values.workloadClusterName }}-platform source: repoURL: 'https://stakater.github.io/stakater-charts' targetRevision: v1.0.10 @@ -15,7 +15,7 @@ spec: values: |- ignoreSecrets: false destination: - name: + name: {{ .Values.workloadClusterName }} namespace: reloader syncPolicy: automated: diff --git a/templates/civo/workload-cluster/templates/45-environment.yaml b/templates/civo/workload-cluster/templates/45-environment.yaml new file mode 100644 index 0000000..16146b0 --- /dev/null +++ b/templates/civo/workload-cluster/templates/45-environment.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-{{ .Values.envName }} + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '45' +spec: + project: {{ .Values.workloadClusterName }}-environment + source: + repoURL: {{ .Values.teamGitopsRepoUrl }} + path: registry/environments/{{ .Values.envName }}/{{ .Values.workloadClusterName }} + targetRevision: HEAD + destination: + name: in-cluster + namespace: {{ .Values.workloadClusterName }}-environment + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/civo/workload-cluster/templates/infrastructure/wait.yaml b/templates/civo/workload-cluster/templates/infrastructure/wait.yaml new file mode 100644 index 0000000..8238d93 --- /dev/null +++ b/templates/civo/workload-cluster/templates/infrastructure/wait.yaml @@ -0,0 +1,21 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ .Values.workloadClusterName }}-infrastructure-wait + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "20" +spec: + template: + spec: + serviceAccountName: argocd-server + containers: + - name: wait + image: {{ .Values.waitJobImage }} + command: + - /bin/sh + - -c + - | + while ! kubectl wait --for=jsonpath='{.status.conditions[0].status}'='True' workspace/{{ .Values.workloadClusterName }}-infrastructure; do echo "waiting for cluster to provision"; sleep 5; done + restartPolicy: Never + backoffLimit: 1 diff --git a/templates/civo/workload-cluster/templates/infrastructure/workspace.yaml b/templates/civo/workload-cluster/templates/infrastructure/workspace.yaml new file mode 100644 index 0000000..8ff55f3 --- /dev/null +++ b/templates/civo/workload-cluster/templates/infrastructure/workspace.yaml @@ -0,0 +1,23 @@ +apiVersion: tf.upbound.io/v1beta1 +kind: Workspace +metadata: + name: {{ .Values.workloadClusterName }}-infrastructure +spec: + providerConfigRef: + name: {{ .Values.workloadClusterName }} + forProvider: + source: Remote + module: {{ .Values.workloadClusterTerraformModuleUrl }} + vars: + - key: cluster_name + value: {{ .Values.workloadClusterName }} + - key: cluster_region + value: {{ .Values.workloadClusterRegion }} + - key: environment + value: {{ .Values.workloadClusterName }} + - key: node_count + value: "{{ .Values.workloadNodeCount }}" + - key: node_type + value: {{ .Values.workloadNodeType }} + - key: is_gpu + value: "false" diff --git a/templates/civo-workload-cluster/provider-config/providerconfig.yaml b/templates/civo/workload-cluster/templates/provider-config/providerconfig.yaml similarity index 65% rename from templates/civo-workload-cluster/provider-config/providerconfig.yaml rename to templates/civo/workload-cluster/templates/provider-config/providerconfig.yaml index 31263d9..6d0f2a8 100644 --- a/templates/civo-workload-cluster/provider-config/providerconfig.yaml +++ b/templates/civo/workload-cluster/templates/provider-config/providerconfig.yaml @@ -1,16 +1,16 @@ apiVersion: tf.upbound.io/v1beta1 kind: ProviderConfig metadata: - name: + name: {{ .Values.workloadClusterName }} annotations: argocd.argoproj.io/sync-wave: "-1" spec: configuration: | terraform { backend "s3" { - bucket = "" - key = "registry/clusters//infrastructure/provider-config/terraform.tfstate" - region = "" + bucket = "{{ .Values.projectStateStoreBucket }}" + key = "registry/clusters/{{ .Values.workloadClusterName }}/infrastructure/provider-config/terraform.tfstate" + region = "{{ .Values.projectRegion }}" encrypt = true } required_providers { @@ -26,24 +26,24 @@ spec: } provider "aws" { alias = "PROJECT_REGION" - region = "" - allowed_account_ids = [""] + region = "{{ .Values.projectRegion }}" + allowed_account_ids = ["{{ .Values.projectAwsAccountId }}"] assume_role_with_web_identity { session_name = "kubefirst-pro" - role_arn = "" + role_arn = "{{ .Values.projectAssumeRole }}" web_identity_token_file = "/var/run/secrets/eks.amazonaws.com/serviceaccount/token" } } provider "civo" { credentials_file = "civo.json" - region = "" + region = "{{ .Values.workloadClusterRegion }}" } credentials: - filename: civo.json source: Secret secretRef: namespace: crossplane-system - name: -civo-creds + name: {{ .Values.cloudAccountName }}-civo-creds key: config.json - filename: .git-credentials source: Secret diff --git a/templates/workload-downstream-cluster/registry-workload-cluster.yaml b/templates/civo/workload-cluster/templates/registry-workload-cluster.yaml similarity index 78% rename from templates/workload-downstream-cluster/registry-workload-cluster.yaml rename to templates/civo/workload-cluster/templates/registry-workload-cluster.yaml index 941b9e7..0136813 100644 --- a/templates/workload-downstream-cluster/registry-workload-cluster.yaml +++ b/templates/civo/workload-cluster/templates/registry-workload-cluster.yaml @@ -1,7 +1,7 @@ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: registry- + name: registry-{{ .Values.workloadClusterName }} namespace: argocd annotations: argocd.argoproj.io/sync-wave: '100' @@ -10,8 +10,8 @@ metadata: spec: project: default source: - repoURL: - path: registry/clusters/ + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.workloadClusterName }} targetRevision: HEAD destination: server: https://kubernetes.default.svc @@ -28,4 +28,3 @@ spec: duration: 1m maxDuration: 15m0s factor: 2 - diff --git a/templates/civo/workload-cluster/templates/workloadcluster-environment-project.yaml b/templates/civo/workload-cluster/templates/workloadcluster-environment-project.yaml new file mode 100644 index 0000000..6ad76d1 --- /dev/null +++ b/templates/civo/workload-cluster/templates/workloadcluster-environment-project.yaml @@ -0,0 +1,26 @@ +apiVersion: argoproj.io/v1alpha1 +kind: AppProject +metadata: + name: {{ .Values.workloadClusterName }}-environment + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "-1" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + description: {{ .Values.workloadClusterName }} description + sourceRepos: + - '{{ .Values.teamGitopsRepoUrl }}' + destinations: + - name: in-cluster + namespace: {{ .Values.workloadClusterName }}-environment + clusterResourceWhitelist: + - group: '*' + kind: '*' + roles: + - description: {{ .Values.workloadClusterName }}-admin-role + groups: + - admins + name: admin-role + policies: + - p, proj:{{ .Values.workloadClusterName }}:admin-role, applications, *, {{ .Values.workloadClusterName }}/*, allow diff --git a/templates/workload-downstream-host-vcluster/workloadcluster-environment-project.yaml b/templates/civo/workload-cluster/templates/workloadcluster-platform-project.yaml similarity index 50% rename from templates/workload-downstream-host-vcluster/workloadcluster-environment-project.yaml rename to templates/civo/workload-cluster/templates/workloadcluster-platform-project.yaml index ca7d2aa..7a63f6d 100644 --- a/templates/workload-downstream-host-vcluster/workloadcluster-environment-project.yaml +++ b/templates/civo/workload-cluster/templates/workloadcluster-platform-project.yaml @@ -1,26 +1,26 @@ apiVersion: argoproj.io/v1alpha1 kind: AppProject metadata: - name: -environment + name: {{ .Values.workloadClusterName }}-platform namespace: argocd annotations: argocd.argoproj.io/sync-wave: "-1" finalizers: - resources-finalizer.argocd.argoproj.io spec: - description: description + description: {{ .Values.workloadClusterName }} description sourceRepos: - - '' + - '*' destinations: - - name: in-cluster - namespace: -environment + - namespace: '*' + server: '*' clusterResourceWhitelist: - group: '*' kind: '*' roles: - - description: -admin-role + - description: {{ .Values.workloadClusterName }}-admin-role groups: - admins name: admin-role policies: - - p, proj::admin-role, applications, *, /*, allow + - p, proj:{{ .Values.workloadClusterName }}:admin-role, applications, *, {{ .Values.workloadClusterName }}/*, allow diff --git a/templates/civo/workload-cluster/templates/workloadcluster-project.yaml b/templates/civo/workload-cluster/templates/workloadcluster-project.yaml new file mode 100644 index 0000000..5c6adc2 --- /dev/null +++ b/templates/civo/workload-cluster/templates/workloadcluster-project.yaml @@ -0,0 +1,27 @@ +apiVersion: argoproj.io/v1alpha1 +kind: AppProject +metadata: + name: {{ .Values.workloadClusterName }} + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "-1" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + description: {{ .Values.workloadClusterName }} description + sourceNamespaces: ["{{ .Values.workloadClusterName }}-environment"] + sourceRepos: + - '{{ .Values.teamGitopsRepoUrl }}' + destinations: + - name: {{ .Values.workloadClusterName }} + namespace: '*' + clusterResourceWhitelist: + - group: '*' + kind: '*' + roles: + - description: {{ .Values.workloadClusterName }}-admin-role + groups: + - admins + name: admin-role + policies: + - p, proj:{{ .Values.workloadClusterName }}:admin-role, applications, *, {{ .Values.workloadClusterName }}/*, allow diff --git a/templates/civo/workload-cluster/values.yaml b/templates/civo/workload-cluster/values.yaml new file mode 100644 index 0000000..b6b6049 --- /dev/null +++ b/templates/civo/workload-cluster/values.yaml @@ -0,0 +1,79 @@ +# Workload Cluster Configuration +# @input.type: string +# @input.description: the name of the workload cluster (used for naming resources and ArgoCD applications) +# @input.required: true +workloadClusterName: my-workload-cluster + +# @input.type: string +# @input.description: the name of the project cluster that manages this workload cluster +# @input.required: true +projectClusterName: my-project-cluster + +# GitOps Repository Configuration +# @input.type: string +# @input.description: the full GitOps repository URL (e.g., https://github.com/org/repo) +# @input.required: true +gitopsRepoUrl: "https://github.com/my-org/gitops-repo" + +# @input.type: string +# @input.description: the team GitOps repository URL for environment deployments +# @input.required: true +teamGitopsRepoUrl: "https://github.com/my-org/team-gitops-repo" + +# Environment Configuration +# @input.type: string +# @input.description: the environment name (e.g., dev, staging, production) +# @input.required: true +envName: dev + +# Workload Cluster Infrastructure Settings +# @input.type: string +# @input.description: the Civo region where the workload cluster will be deployed (e.g., LON1, NYC1, FRA1) +# @input.required: true +workloadClusterRegion: LON1 + +# @input.type: string +# @input.description: the number of worker nodes in the Civo Kubernetes cluster +# @input.required: true +workloadNodeCount: "3" + +# @input.type: string +# @input.description: the Civo instance type for worker nodes (e.g., g4s.kube.small, g4s.kube.medium, g4s.kube.large) +# @input.required: true +workloadNodeType: g4s.kube.medium + +# Terraform Module Configuration +# @input.type: string +# @input.description: the complete URL for the Terraform module for infrastructure provisioning +# @input.required: true +workloadClusterTerraformModuleUrl: "git::https://github.com/konstructio/gitops-template.git//terraform/civo/modules/workload-cluster?ref=main" + +# Project Cluster Configuration +# @input.type: string +# @input.description: the S3 bucket name for Terraform state storage +# @input.required: true +projectStateStoreBucket: project-state-bucket + +# @input.type: string +# @input.description: the AWS region of the project cluster +# @input.required: true +projectRegion: us-east-1 + +# @input.type: string +# @input.description: the AWS account ID for the project cluster +# @input.required: true +projectAwsAccountId: "123456789012" + +# @input.type: string +# @input.description: the IAM role ARN to assume for project cluster operations +# @input.required: true +projectAssumeRole: "arn:aws:iam::123456789012:role/crossplane-project" + +# Cloud Account Configuration +# @input.type: string +# @input.description: the name of the Civo cloud account (used for credentials secret name) +# @input.required: true +cloudAccountName: civo-account + +# Wait Job Configuration +waitJobImage: "dtzar/helm-kubectl:3.19.0" diff --git a/templates/workload-downstream-host-vcluster/workloadcluster-project.yaml b/templates/workload-downstream-host-vcluster/workloadcluster-project.yaml deleted file mode 100644 index d4c5cff..0000000 --- a/templates/workload-downstream-host-vcluster/workloadcluster-project.yaml +++ /dev/null @@ -1,27 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: AppProject -metadata: - name: - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: "-1" - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - description: description - sourceNamespaces: ["-environment"] - sourceRepos: - - '' - destinations: - - name: - namespace: '*' - clusterResourceWhitelist: - - group: '*' - kind: '*' - roles: - - description: -admin-role - groups: - - admins - name: admin-role - policies: - - p, proj::admin-role, applications, *, /*, allow diff --git a/terraform/civo/modules/project-cluster/main.tf b/terraform/civo/modules/project-cluster/main.tf new file mode 100644 index 0000000..e85d28a --- /dev/null +++ b/terraform/civo/modules/project-cluster/main.tf @@ -0,0 +1,118 @@ +# S3 Bucket + +resource "civo_object_store" "backup" { + name = "k1-project-${var.cluster_name}" + max_size_gb = 500 + region = var.cluster_region +} + +# If you create the bucket without credentials, you can read the credentials in this way +data "civo_object_store_credential" "backup" { + id = civo_object_store.backup.access_key_id +} + +# Project Cluster + +resource "civo_network" "project-cluster" { + label = var.cluster_name +} + +resource "civo_firewall" "project-cluster" { + name = var.cluster_name + network_id = civo_network.project-cluster.id + create_default_rules = true +} + +resource "civo_kubernetes_cluster" "project-cluster" { + name = var.cluster_name + network_id = civo_network.project-cluster.id + firewall_id = civo_firewall.project-cluster.id + write_kubeconfig = true + cluster_type = "k3s" + kubernetes_version = "1.32.5-k3s1" + pools { + label = var.cluster_name + size = var.node_type + node_count = var.node_count + } +} + +resource "vault_generic_secret" "clusters" { + path = "secret/clusters/${var.cluster_name}" + + data_json = jsonencode( + { + kubeconfig = civo_kubernetes_cluster.project-cluster.kubeconfig + client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.project-cluster.kubeconfig).users[0].user.client-certificate-data) + client_key = base64decode(yamldecode(civo_kubernetes_cluster.project-cluster.kubeconfig).users[0].user.client-key-data) + cluster_ca_certificate = base64decode(yamldecode(civo_kubernetes_cluster.project-cluster.kubeconfig).clusters[0].cluster.certificate-authority-data) + host = civo_kubernetes_cluster.project-cluster.api_endpoint + cluster_name = var.cluster_name + argocd_manager_sa_token = kubernetes_secret_v1.argocd_manager.data.token + } + ) +} + +provider "kubernetes" { + host = civo_kubernetes_cluster.project-cluster.api_endpoint + client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.project-cluster.kubeconfig).users[0].user.client-certificate-data) + client_key = base64decode(yamldecode(civo_kubernetes_cluster.project-cluster.kubeconfig).users[0].user.client-key-data) + cluster_ca_certificate = base64decode(yamldecode(civo_kubernetes_cluster.project-cluster.kubeconfig).clusters[0].cluster.certificate-authority-data) +} + +provider "helm" { + repository_config_path = "${path.module}/.helm/repositories.yaml" + repository_cache = "${path.module}/.helm" + kubernetes = { + host = civo_kubernetes_cluster.project-cluster.api_endpoint + client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.project-cluster.kubeconfig).users[0].user.client-certificate-data) + client_key = base64decode(yamldecode(civo_kubernetes_cluster.project-cluster.kubeconfig).users[0].user.client-key-data) + cluster_ca_certificate = base64decode(yamldecode(civo_kubernetes_cluster.project-cluster.kubeconfig).clusters[0].cluster.certificate-authority-data) + } +} + +resource "kubernetes_cluster_role_v1" "argocd_manager" { + metadata { + name = "argocd-manager-role" + } + + rule { + api_groups = ["*"] + resources = ["*"] + verbs = ["*"] + } + rule { + non_resource_urls = ["*"] + verbs = ["*"] + } +} + + +resource "kubernetes_cluster_role_binding_v1" "argocd_manager" { + metadata { + name = "argocd-manager-role-binding" + } + role_ref { + api_group = "rbac.authorization.k8s.io" + kind = "ClusterRole" + name = kubernetes_cluster_role_v1.argocd_manager.metadata.0.name + } + subject { + kind = "ServiceAccount" + name = kubernetes_service_account_v1.argocd_manager.metadata.0.name + namespace = "kube-system" + } +} + +resource "kubernetes_service_account_v1" "argocd_manager" { + metadata { + name = "argocd-manager" + namespace = "kube-system" + } + secret { + name = "argocd-manager-token" + } +} + + + diff --git a/terraform/civo/modules/project-cluster/variables.tf b/terraform/civo/modules/project-cluster/variables.tf new file mode 100644 index 0000000..64bc599 --- /dev/null +++ b/terraform/civo/modules/project-cluster/variables.tf @@ -0,0 +1,15 @@ +variable "cluster_name" { + type = string +} + +variable "cluster_region" { + type = string +} + +variable "node_count" { + type = number +} + +variable "node_type" { + type = string +} From c2abbaeabc12ed7fa8c846bb2084462fcb7ef631 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Thu, 19 Feb 2026 15:33:46 +0530 Subject: [PATCH 02/77] fix: values.yaml --- .../project-cluster/templates/30-argocd.yaml | 6 +- .../project-cluster/templates/40-secret.yaml | 8 +- .../templates/argocd/argocd-ui-ingress.yaml | 8 +- .../templates/crossplane-components/svc.yaml | 4 +- .../templates/secrets/secret.yaml | 4 +- templates/civo/project-cluster/values.yaml | 137 ------------------ 6 files changed, 15 insertions(+), 152 deletions(-) diff --git a/templates/civo/project-cluster/templates/30-argocd.yaml b/templates/civo/project-cluster/templates/30-argocd.yaml index 4fb54ef..3117d05 100644 --- a/templates/civo/project-cluster/templates/30-argocd.yaml +++ b/templates/civo/project-cluster/templates/30-argocd.yaml @@ -1,20 +1,20 @@ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: {{ .Values.clusterName }}-argocd + name: {{ .Values.workloadClusterName }}-argocd namespace: argocd finalizers: - resources-finalizer.argocd.argoproj.io annotations: argocd.argoproj.io/sync-wave: '30' spec: - project: {{ .Values.clusterName }} + project: {{ .Values.workloadClusterName }} source: repoURL: {{ .Values.gitopsRepoUrl }} path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/argocd targetRevision: HEAD destination: - name: {{ .Values.clusterName }} + name: {{ .Values.workloadClusterName }} namespace: argocd syncPolicy: automated: diff --git a/templates/civo/project-cluster/templates/40-secret.yaml b/templates/civo/project-cluster/templates/40-secret.yaml index 4a725b4..a4de531 100644 --- a/templates/civo/project-cluster/templates/40-secret.yaml +++ b/templates/civo/project-cluster/templates/40-secret.yaml @@ -1,20 +1,20 @@ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: {{ .Values.clusterName }}-secrets + name: {{ .Values.workloadClusterName }}-secrets namespace: argocd finalizers: - resources-finalizer.argocd.argoproj.io annotations: argocd.argoproj.io/sync-wave: '40' spec: - project: {{ .Values.clusterName }} + project: {{ .Values.workloadClusterName }} source: repoURL: {{ .Values.gitopsRepoUrl }} - path: registry/konstruct-clusters/{{ .Values.clusterName }}/secrets + path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/secrets targetRevision: HEAD destination: - name: {{ .Values.clusterName }} + name: {{ .Values.workloadClusterName }} namespace: argocd syncPolicy: automated: diff --git a/templates/civo/project-cluster/templates/argocd/argocd-ui-ingress.yaml b/templates/civo/project-cluster/templates/argocd/argocd-ui-ingress.yaml index 2dd1bf3..0823ebd 100644 --- a/templates/civo/project-cluster/templates/argocd/argocd-ui-ingress.yaml +++ b/templates/civo/project-cluster/templates/argocd/argocd-ui-ingress.yaml @@ -30,10 +30,10 @@ spec: name: argocd-server port: name: http - host: argocd-{{ .Values.clusterName }}.{{ .Values.domainName }} + host: argocd-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} tls: - hosts: - - argocd-{{ .Values.clusterName }}.{{ .Values.domainName }} + - argocd-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} secretName: argocd-ingress-http --- apiVersion: networking.k8s.io/v1 @@ -67,8 +67,8 @@ spec: name: argocd-server port: name: https - host: grpc-{{ .Values.clusterName }}.argocd.{{ .Values.domainName }} + host: grpc-{{ .Values.workloadClusterName }}.argocd.{{ .Values.domainName }} tls: - hosts: - - grpc-argocd-{{ .Values.clusterName }}.{{ .Values.domainName }} + - grpc-argocd-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} secretName: argocd-ingress-grpc diff --git a/templates/civo/project-cluster/templates/crossplane-components/svc.yaml b/templates/civo/project-cluster/templates/crossplane-components/svc.yaml index 029e31e..e272c51 100644 --- a/templates/civo/project-cluster/templates/crossplane-components/svc.yaml +++ b/templates/civo/project-cluster/templates/crossplane-components/svc.yaml @@ -28,7 +28,7 @@ metadata: spec: ingressClassName: nginx rules: - - host: logs-{{ .Values.clusterName }}.{{ .Values.domainName }} + - host: logs-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} http: paths: - backend: @@ -40,5 +40,5 @@ spec: pathType: Prefix tls: - hosts: - - logs-{{ .Values.clusterName }}.{{ .Values.domainName }} + - logs-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} secretName: logs-mgmt-cluster diff --git a/templates/civo/project-cluster/templates/secrets/secret.yaml b/templates/civo/project-cluster/templates/secrets/secret.yaml index df38282..f5de225 100644 --- a/templates/civo/project-cluster/templates/secrets/secret.yaml +++ b/templates/civo/project-cluster/templates/secrets/secret.yaml @@ -11,7 +11,7 @@ spec: refreshInterval: 10s secretStoreRef: kind: ClusterSecretStore - name: {{ .Values.clusterName }}-vault-kv-secret + name: {{ .Values.workloadClusterName }}-vault-kv-secret target: name: repo-credentials-template-{{ .Values.projectOrg }} creationPolicy: Owner @@ -46,7 +46,7 @@ spec: refreshInterval: 10s secretStoreRef: kind: ClusterSecretStore - name: {{ .Values.clusterName }}-vault-kv-secret + name: {{ .Values.workloadClusterName }}-vault-kv-secret target: name: repo-credentials-template-{{ .Values.platformOrg }} creationPolicy: Owner diff --git a/templates/civo/project-cluster/values.yaml b/templates/civo/project-cluster/values.yaml index 3fea60b..72173bc 100644 --- a/templates/civo/project-cluster/values.yaml +++ b/templates/civo/project-cluster/values.yaml @@ -1,146 +1,9 @@ -# Workload Cluster Configuration -# @input.type: string -# @input.description: the name of the workload cluster (used for naming resources and ArgoCD applications) -# @input.required: true -workloadClusterName: my-workload-cluster - -# @input.type: string -# @input.description: the cluster identifier (used for ArgoCD destinations and references) -# @input.required: true -clusterName: my-cluster - -# GitOps Repository Configuration -# @input.type: string -# @input.description: the GitHub organization name -# @input.required: true -orgName: my-org - -# @input.type: string -# @input.description: the GitOps repository name -# @input.required: true -repoName: gitops-repo - -# @input.type: string -# @input.description: the full GitOps repository URL (e.g., https://github.com/org/repo) -# @input.required: true -gitopsRepoUrl: "https://github.com/my-org/gitops-repo" - -# Domain Configuration -# @input.type: string -# @input.description: the base domain name for ingresses (e.g., example.com) -# @input.required: true -domainName: example.com - -# @input.type: string -# @input.description: the Dex OIDC provider domain for ArgoCD authentication -# @input.required: true -dexDomainName: "https://dex.example.com" - -# Workload Cluster Infrastructure Settings -# @input.type: string -# @input.description: the Civo region where the workload cluster will be deployed (e.g., LON1, NYC1, FRA1) -# @input.required: true -workloadClusterRegion: LON1 - -# @input.type: string -# @input.description: the AWS account ID for the workload cluster -# @input.required: true -workloadClusterAccountId: "123456789012" - -# @input.type: string -# @input.description: the IAM role ARN to assume for workload cluster operations -# @input.required: true -workloadAssumeRole: "arn:aws:iam::123456789012:role/crossplane-workload" - -# @input.type: string -# @input.description: the number of worker nodes in the Civo Kubernetes cluster -# @input.required: true -workloadNodeCount: "3" - -# @input.type: string -# @input.description: the Civo instance type for worker nodes (e.g., g4s.kube.small, g4s.kube.medium, g4s.kube.large) -# @input.required: true -workloadNodeType: g4s.kube.medium - -# @input.type: string -# @input.description: the AMI type for worker nodes -# @input.required: false -workloadAmiType: AL2_x86_64 - -# @input.type: string -# @input.description: the S3 bucket name for workload cluster data -# @input.required: true -workloadS3BucketName: workload-bucket - -# Management Cluster Configuration -# @input.type: string -# @input.description: the AWS account ID for the management (Kubefirst) cluster -# @input.required: true -kubefirstMgmtAccountId: "123456789012" - -# @input.type: string -# @input.description: the name of the Kubefirst management cluster -# @input.required: true -kubefirstMgmtClusterName: mgmt-cluster - -# @input.type: string -# @input.description: the primary cloud region for the management cluster -# @input.required: true -cloudRegion: us-east-1 - -# @input.type: string -# @input.description: the S3 bucket name for Terraform state storage -# @input.required: true -kubefirstStateStoreBucket: k1-state-store-bucket - # Terraform Module Configuration # @input.type: string # @input.description: the complete URL for the Terraform module for infrastructure provisioning # @input.required: true workloadClusterTerraformModuleUrl: "git::https://github.com/konstructio/gitops-template.git//terraform/civo/modules/workload-cluster?ref=main" -# @input.type: string -# @input.description: the complete URL for the Terraform bootstrap module -# @input.required: true -workloadClusterBootstrapTerraformModuleUrl: "git::https://github.com/konstructio/gitops-template.git//terraform/civo/modules/bootstrap?ref=main" - -# Project Configuration -# @input.type: string -# @input.description: the project organization name (used for secrets and credentials) -# @input.required: true -projectOrg: project-org - -# @input.type: string -# @input.description: the project name (used for Vault paths and ArgoCD credentials) -# @input.required: true -projectName: my-project - -# @input.type: string -# @input.description: the platform organization name (used for platform credentials) -# @input.required: true -platformOrg: platform-org - -# Cert-Manager Issuer Annotations -# @input.type: string -# @input.description: first cert-manager issuer annotation line (e.g., cert-manager.io/cluster-issuer: letsencrypt-prod) -# @input.required: false -certManagerIssuerAnnotation1: 'cert-manager.io/cluster-issuer: letsencrypt-prod' - -# @input.type: string -# @input.description: second cert-manager issuer annotation line (leave empty if not needed) -# @input.required: false -certManagerIssuerAnnotation2: "" - -# @input.type: string -# @input.description: third cert-manager issuer annotation line (leave empty if not needed) -# @input.required: false -certManagerIssuerAnnotation3: "" - -# @input.type: string -# @input.description: fourth cert-manager issuer annotation line (leave empty if not needed) -# @input.required: false -certManagerIssuerAnnotation4: "" - # External DNS Configuration # @input.type: string # @input.description: the DNS provider name for external-dns (e.g., cloudflare, aws, digitalocean) From 661bc449e3c9d9616372542b320592829c71d543 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Thu, 19 Feb 2026 16:24:54 +0530 Subject: [PATCH 03/77] fix: workload cluster template --- .../provider-config/providerconfig.yaml | 39 ++++++++++--------- 1 file changed, 21 insertions(+), 18 deletions(-) diff --git a/templates/civo/workload-cluster/templates/provider-config/providerconfig.yaml b/templates/civo/workload-cluster/templates/provider-config/providerconfig.yaml index 6d0f2a8..3069bd7 100644 --- a/templates/civo/workload-cluster/templates/provider-config/providerconfig.yaml +++ b/templates/civo/workload-cluster/templates/provider-config/providerconfig.yaml @@ -8,42 +8,45 @@ spec: configuration: | terraform { backend "s3" { + key = "registry/konstruct-clusters/{{ .Values.workloadClusterName }}/infrastructure/provider-config/terraform.tfstate" bucket = "{{ .Values.projectStateStoreBucket }}" - key = "registry/clusters/{{ .Values.workloadClusterName }}/infrastructure/provider-config/terraform.tfstate" - region = "{{ .Values.projectRegion }}" - encrypt = true + region = "{{ .Values.projectRegion }}" + endpoint = "https://objectstore.{{ .Values.projectRegion }}.civo.com" + + skip_credentials_validation = true + skip_metadata_api_check = true + skip_region_validation = true + force_path_style = true } required_providers { civo = { source = "civo/civo" version = "= 1.1.0" } - aws = { - source = "hashicorp/aws" - version = ">= 5.30.0, < 6.0.0" - } - } - } - provider "aws" { - alias = "PROJECT_REGION" - region = "{{ .Values.projectRegion }}" - allowed_account_ids = ["{{ .Values.projectAwsAccountId }}"] - assume_role_with_web_identity { - session_name = "kubefirst-pro" - role_arn = "{{ .Values.projectAssumeRole }}" - web_identity_token_file = "/var/run/secrets/eks.amazonaws.com/serviceaccount/token" } } provider "civo" { credentials_file = "civo.json" region = "{{ .Values.workloadClusterRegion }}" } + provider "civo" { + alias = "PROJECT_REGION" + region = "{{ .Values.projectRegion }}" + credentials_file = "projectclustercivo.json" + } + pluginCache: false credentials: + - filename: projectclustercivo.json + source: Secret + secretRef: + namespace: crossplane-system + name: {{ .Values.workloadClusterName }}-civo-creds + key: config.json - filename: civo.json source: Secret secretRef: namespace: crossplane-system - name: {{ .Values.cloudAccountName }}-civo-creds + name: civo-creds key: config.json - filename: .git-credentials source: Secret From 7e81fd08fda190287487a7a07bf000c900b18d84 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Thu, 19 Feb 2026 16:50:38 +0530 Subject: [PATCH 04/77] fix: workload cluster template --- .../templates/secrets/secret.yaml | 35 ------------------- 1 file changed, 35 deletions(-) diff --git a/templates/civo/project-cluster/templates/secrets/secret.yaml b/templates/civo/project-cluster/templates/secrets/secret.yaml index f5de225..a209a6e 100644 --- a/templates/civo/project-cluster/templates/secrets/secret.yaml +++ b/templates/civo/project-cluster/templates/secrets/secret.yaml @@ -32,38 +32,3 @@ spec: dataFrom: - extract: key: argocd/repo-credentials-template/{{ .Values.projectName }} ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: repo-credentials-template-{{ .Values.platformOrg }} - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: '20' - labels: - app.kubernetes.io/part-of: argocd -spec: - refreshInterval: 10s - secretStoreRef: - kind: ClusterSecretStore - name: {{ .Values.workloadClusterName }}-vault-kv-secret - target: - name: repo-credentials-template-{{ .Values.platformOrg }} - creationPolicy: Owner - template: - metadata: - annotations: - managed-by: argocd.argoproj.io - labels: - argocd.argoproj.io/secret-type: repository - type: Opaque - data: - # Template will be populated from Vault data - type: "{{` {{ .type }} `}}" - name: "{{` {{ .name }} `}}" - url: "{{` {{ .url }} `}}" - username: "{{` {{ .username }} `}}" - password: "{{` {{ .password }} `}}" - dataFrom: - - extract: - key: argocd/repo-credentials-template/{{ .Values.projectName }}-platform From 26d416553f38b752f1b54f216952e721cf5a2080 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Thu, 19 Feb 2026 18:52:46 +0530 Subject: [PATCH 05/77] fix: workload cluster template --- .../templates/provider-config/providerconfig.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/templates/civo/project-cluster/templates/provider-config/providerconfig.yaml b/templates/civo/project-cluster/templates/provider-config/providerconfig.yaml index 150096b..0dda948 100644 --- a/templates/civo/project-cluster/templates/provider-config/providerconfig.yaml +++ b/templates/civo/project-cluster/templates/provider-config/providerconfig.yaml @@ -10,8 +10,8 @@ spec: backend "s3" { bucket = "{{ .Values.kubefirstStateStoreBucket }}" key = "registry/konstruct-clusters/{{ .Values.workloadClusterName }}/infrastructure/provider-config/terraform.tfstate" - region = "{{ .Values.cloudRegion }}" - endpoint = "https://objectstore.{{ .Values.cloudRegion }}.civo.com" + region = "{{ .Values.mainMgmtcloudRegion }}" + endpoint = "https://objectstore.{{ .Values.mainMgmtcloudRegion }}.civo.com" skip_credentials_validation = true skip_metadata_api_check = true @@ -27,12 +27,12 @@ spec: } provider "civo" { credentials_file = "projectcluster-civo.json" - region = "{{ .Values.cloudRegion }}" + region = "{{ .Values.workloadClusterRegion }}" } provider "civo" { alias = "kubefirst_mgmt_s3_bucket_region" credentials_file = "civo.json" - region = "{{ .Values.cloudRegion }}" + region = "{{ .Values.mainMgmtcloudRegion }}" } pluginCache: false credentials: From 63c7d0081f91229fd83b3e6690e4c5c338b1696b Mon Sep 17 00:00:00 2001 From: mrrishi Date: Fri, 20 Feb 2026 00:34:23 +0530 Subject: [PATCH 06/77] fix: workload cluster template --- .../templates/20-argocd-connection.yaml | 12 ++++++------ .../templates/provider-config/providerconfig.yaml | 1 - 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/templates/civo/project-cluster/templates/20-argocd-connection.yaml b/templates/civo/project-cluster/templates/20-argocd-connection.yaml index d8ba1e7..4a6e04f 100644 --- a/templates/civo/project-cluster/templates/20-argocd-connection.yaml +++ b/templates/civo/project-cluster/templates/20-argocd-connection.yaml @@ -15,17 +15,17 @@ spec: argocd.argoproj.io/secret-type: cluster engineVersion: v2 data: - name: "{{ .cluster_name }}" - server: "{{ .host }}" + name: {{`"{{ .cluster_name }}"`}} + server: {{`"{{ .host }}"`}} clusterResources: "true" config: | { - "bearerToken": "{{ .argocd_manager_sa_token }}", + "bearerToken": {{`"{{ .argocd_manager_sa_token }}"`}}, "tlsClientConfig": { - "caData": "{{ .cluster_ca_certificate | b64enc }}", - "certData": "{{ .client_certificate | b64enc }}", + "caData": {{`"{{ .cluster_ca_certificate | b64enc }}"`}}, + "certData": {{`"{{ .client_certificate | b64enc }}"`}}, "insecure": false, - "keyData": "{{ .client_key | b64enc }}" + "keyData": {{`"{{ .client_key | b64enc }}"`}} } } secretStoreRef: diff --git a/templates/civo/project-cluster/templates/provider-config/providerconfig.yaml b/templates/civo/project-cluster/templates/provider-config/providerconfig.yaml index 0dda948..099aee4 100644 --- a/templates/civo/project-cluster/templates/provider-config/providerconfig.yaml +++ b/templates/civo/project-cluster/templates/provider-config/providerconfig.yaml @@ -51,7 +51,6 @@ spec: - filename: .git-credentials source: Secret secretRef: - namespace: crossplane-system name: git-credentials key: creds From 4c9495fce33a11a4872373afc8a20d864ad4800a Mon Sep 17 00:00:00 2001 From: mrrishi Date: Fri, 20 Feb 2026 03:32:31 +0530 Subject: [PATCH 07/77] fix: workload cluster template --- .../templates/argocd/argocd-grpc-ingress.yaml | 37 ++++++++++++++++++ ...ingress.yaml => argocd-https-ingress.yaml} | 38 +------------------ templates/civo/project-cluster/values.yaml | 5 +++ 3 files changed, 43 insertions(+), 37 deletions(-) create mode 100644 templates/civo/project-cluster/templates/argocd/argocd-grpc-ingress.yaml rename templates/civo/project-cluster/templates/argocd/{argocd-ui-ingress.yaml => argocd-https-ingress.yaml} (51%) diff --git a/templates/civo/project-cluster/templates/argocd/argocd-grpc-ingress.yaml b/templates/civo/project-cluster/templates/argocd/argocd-grpc-ingress.yaml new file mode 100644 index 0000000..6012aa5 --- /dev/null +++ b/templates/civo/project-cluster/templates/argocd/argocd-grpc-ingress.yaml @@ -0,0 +1,37 @@ +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: argocd-server-grpc-ingress + namespace: argocd + annotations: + nginx.ingress.kubernetes.io/backend-protocol: "GRPC" + {{- if .Values.certManagerIssuerAnnotation1 }} + {{ .Values.certManagerIssuerAnnotation1 }} + {{- end }} + {{- if .Values.certManagerIssuerAnnotation2 }} + {{ .Values.certManagerIssuerAnnotation2 }} + {{- end }} + {{- if .Values.certManagerIssuerAnnotation3 }} + {{ .Values.certManagerIssuerAnnotation3 }} + {{- end }} + {{- if .Values.certManagerIssuerAnnotation4 }} + {{ .Values.certManagerIssuerAnnotation4 }} + {{- end }} +spec: + ingressClassName: nginx + rules: + - http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: argocd-server + port: + name: https + host: grpc-{{ .Values.workloadClusterName }}.argocd.{{ .Values.domainName }} + tls: + - hosts: + - grpc-argocd-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} + secretName: argocd-ingress-grpc diff --git a/templates/civo/project-cluster/templates/argocd/argocd-ui-ingress.yaml b/templates/civo/project-cluster/templates/argocd/argocd-https-ingress.yaml similarity index 51% rename from templates/civo/project-cluster/templates/argocd/argocd-ui-ingress.yaml rename to templates/civo/project-cluster/templates/argocd/argocd-https-ingress.yaml index 0823ebd..12d068b 100644 --- a/templates/civo/project-cluster/templates/argocd/argocd-ui-ingress.yaml +++ b/templates/civo/project-cluster/templates/argocd/argocd-https-ingress.yaml @@ -35,40 +35,4 @@ spec: - hosts: - argocd-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} secretName: argocd-ingress-http ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: argocd-server-grpc-ingress - namespace: argocd - annotations: - nginx.ingress.kubernetes.io/backend-protocol: "GRPC" - {{- if .Values.certManagerIssuerAnnotation1 }} - {{ .Values.certManagerIssuerAnnotation1 }} - {{- end }} - {{- if .Values.certManagerIssuerAnnotation2 }} - {{ .Values.certManagerIssuerAnnotation2 }} - {{- end }} - {{- if .Values.certManagerIssuerAnnotation3 }} - {{ .Values.certManagerIssuerAnnotation3 }} - {{- end }} - {{- if .Values.certManagerIssuerAnnotation4 }} - {{ .Values.certManagerIssuerAnnotation4 }} - {{- end }} -spec: - ingressClassName: nginx - rules: - - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: argocd-server - port: - name: https - host: grpc-{{ .Values.workloadClusterName }}.argocd.{{ .Values.domainName }} - tls: - - hosts: - - grpc-argocd-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} - secretName: argocd-ingress-grpc + diff --git a/templates/civo/project-cluster/values.yaml b/templates/civo/project-cluster/values.yaml index 72173bc..dd30a72 100644 --- a/templates/civo/project-cluster/values.yaml +++ b/templates/civo/project-cluster/values.yaml @@ -4,6 +4,11 @@ # @input.required: true workloadClusterTerraformModuleUrl: "git::https://github.com/konstructio/gitops-template.git//terraform/civo/modules/workload-cluster?ref=main" +# @input.type: string +# @input.description: the Domain Name +# @input.required: false +domainName: kubefunk.net + # External DNS Configuration # @input.type: string # @input.description: the DNS provider name for external-dns (e.g., cloudflare, aws, digitalocean) From 7b8f0b402a901c3db8935b581e91f836eca60774 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Fri, 20 Feb 2026 04:14:00 +0530 Subject: [PATCH 08/77] fix: workload cluster template --- .../templates/argocd/kustomization.yaml | 3 +- .../templates/secrets/secret.yaml | 1 + .../civo/modules/project-cluster/main.tf | 30 +++++++++++++++++++ 3 files changed, 33 insertions(+), 1 deletion(-) diff --git a/templates/civo/project-cluster/templates/argocd/kustomization.yaml b/templates/civo/project-cluster/templates/argocd/kustomization.yaml index 4066abf..213e9eb 100644 --- a/templates/civo/project-cluster/templates/argocd/kustomization.yaml +++ b/templates/civo/project-cluster/templates/argocd/kustomization.yaml @@ -6,7 +6,8 @@ namespace: argocd # https://github.com/argoproj/argo-cd/tags resources: - github.com:konstructio/manifests.git/argocd/cloud?ref=jokestax-patch-2 - - argocd-ui-ingress.yaml + - argocd-https-ingress.yaml + - argocd-grpc-ingress.yaml - application.yaml - rbac.yaml diff --git a/templates/civo/project-cluster/templates/secrets/secret.yaml b/templates/civo/project-cluster/templates/secrets/secret.yaml index a209a6e..cab8daa 100644 --- a/templates/civo/project-cluster/templates/secrets/secret.yaml +++ b/templates/civo/project-cluster/templates/secrets/secret.yaml @@ -32,3 +32,4 @@ spec: dataFrom: - extract: key: argocd/repo-credentials-template/{{ .Values.projectName }} + diff --git a/terraform/civo/modules/project-cluster/main.tf b/terraform/civo/modules/project-cluster/main.tf index e85d28a..4f7cfb7 100644 --- a/terraform/civo/modules/project-cluster/main.tf +++ b/terraform/civo/modules/project-cluster/main.tf @@ -114,5 +114,35 @@ resource "kubernetes_service_account_v1" "argocd_manager" { } } +resource "kubernetes_secret_v1" "argocd_manager" { + metadata { + name = "argocd-manager-token" + namespace = "kube-system" + annotations = { + "kubernetes.io/service-account.name" = "argocd-manager" + } + } + type = "kubernetes.io/service-account-token" + depends_on = [kubernetes_service_account_v1.argocd_manager] +} + +data "vault_generic_secret" "external_dns" { + path = "secret/external-dns" +} +resource "kubernetes_namespace_v1" "external_dns" { + metadata { + name = "external-dns" + } +} +resource "kubernetes_secret_v1" "external_dns" { + metadata { + name = "external-dns-secrets" + namespace = "external-dns" + } + data = { + token = data.vault_generic_secret.external_dns.data["token"] + } + type = "Opaque" +} From 787aa297ecdc70eb27e08b0466f987fd9bd6458d Mon Sep 17 00:00:00 2001 From: mrrishi Date: Fri, 20 Feb 2026 12:22:45 +0530 Subject: [PATCH 09/77] fix: remove secret store --- .../templates/30-ingress-nginx.yaml | 32 +++++++++++ .../templates/35-clustersecretstore.yaml | 24 -------- .../project-cluster/templates/40-secret.yaml | 24 -------- .../clustersecretstore.yaml | 34 ------------ .../crossplane-secrets.yaml | 51 ----------------- .../templates/secrets/secret.yaml | 35 ------------ .../civo/modules/project-cluster/main.tf | 55 +++++++++++++++++++ 7 files changed, 87 insertions(+), 168 deletions(-) create mode 100644 templates/civo/project-cluster/templates/30-ingress-nginx.yaml delete mode 100644 templates/civo/project-cluster/templates/35-clustersecretstore.yaml delete mode 100644 templates/civo/project-cluster/templates/40-secret.yaml delete mode 100644 templates/civo/project-cluster/templates/cluster-secret-store/clustersecretstore.yaml delete mode 100644 templates/civo/project-cluster/templates/crossplane-components/crossplane-secrets.yaml delete mode 100644 templates/civo/project-cluster/templates/secrets/secret.yaml diff --git a/templates/civo/project-cluster/templates/30-ingress-nginx.yaml b/templates/civo/project-cluster/templates/30-ingress-nginx.yaml new file mode 100644 index 0000000..5c6ffad --- /dev/null +++ b/templates/civo/project-cluster/templates/30-ingress-nginx.yaml @@ -0,0 +1,32 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-ingress-nginx + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: {{ .Values.workloadClusterName }}-platform + source: + repoURL: https://kubernetes.github.io/ingress-nginx + targetRevision: 4.12.1 + helm: + values: |- + controller: + ingressClass: nginx + publishService: + enabled: true + extraArgs: + enable-ssl-passthrough: true + chart: ingress-nginx + destination: + name: {{ .Values.workloadClusterName }} + namespace: ingress-nginx + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/civo/project-cluster/templates/35-clustersecretstore.yaml b/templates/civo/project-cluster/templates/35-clustersecretstore.yaml deleted file mode 100644 index 0eb0aee..0000000 --- a/templates/civo/project-cluster/templates/35-clustersecretstore.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: {{ .Values.workloadClusterName }}-cluster-secret-store - namespace: argocd - finalizers: - - resources-finalizer.argocd.argoproj.io - annotations: - argocd.argoproj.io/sync-wave: '35' -spec: - project: {{ .Values.workloadClusterName }} - source: - repoURL: {{ .Values.gitopsRepoUrl }} - path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/cluster-secret-store - targetRevision: HEAD - destination: - name: {{ .Values.workloadClusterName }} - namespace: external-secrets-operator - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/templates/civo/project-cluster/templates/40-secret.yaml b/templates/civo/project-cluster/templates/40-secret.yaml deleted file mode 100644 index a4de531..0000000 --- a/templates/civo/project-cluster/templates/40-secret.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: {{ .Values.workloadClusterName }}-secrets - namespace: argocd - finalizers: - - resources-finalizer.argocd.argoproj.io - annotations: - argocd.argoproj.io/sync-wave: '40' -spec: - project: {{ .Values.workloadClusterName }} - source: - repoURL: {{ .Values.gitopsRepoUrl }} - path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/secrets - targetRevision: HEAD - destination: - name: {{ .Values.workloadClusterName }} - namespace: argocd - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/templates/civo/project-cluster/templates/cluster-secret-store/clustersecretstore.yaml b/templates/civo/project-cluster/templates/cluster-secret-store/clustersecretstore.yaml deleted file mode 100644 index fe8a5fd..0000000 --- a/templates/civo/project-cluster/templates/cluster-secret-store/clustersecretstore.yaml +++ /dev/null @@ -1,34 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ClusterSecretStore -metadata: - name: {{ .Values.workloadClusterName }}-vault-kv-secret - annotations: - argocd.argoproj.io/sync-wave: '10' -spec: - provider: - vault: - server: 'https://vault.{{ .Values.domainName }}' - path: 'secret' - version: 'v2' - auth: - # points to a secret that contains a vault token - # https://www.vaultproject.io/docs/auth/token - tokenSecretRef: - name: "{{ .Values.workloadClusterName }}-cluster-vault-bootstrap" - key: "vault-token" ---- -apiVersion: external-secrets.io/v1 -kind: ClusterSecretStore -metadata: - name: {{ .Values.workloadClusterName }}-aws-ssm -spec: - provider: - aws: - service: ParameterStore - role: arn:aws:iam::{{ .Values.workloadClusterAccountId }}:role/eso-{{ .Values.workloadClusterName }} - region: {{ .Values.workloadClusterRegion }} - auth: - jwt: - serviceAccountRef: - name: external-secrets - namespace: external-secrets-operator diff --git a/templates/civo/project-cluster/templates/crossplane-components/crossplane-secrets.yaml b/templates/civo/project-cluster/templates/crossplane-components/crossplane-secrets.yaml deleted file mode 100644 index febe1e2..0000000 --- a/templates/civo/project-cluster/templates/crossplane-components/crossplane-secrets.yaml +++ /dev/null @@ -1,51 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - annotations: - argocd.argoproj.io/sync-wave: "0" - name: crossplane-secrets - namespace: crossplane-system -spec: - dataFrom: - - extract: - conversionStrategy: Default - decodingStrategy: None - key: /crossplane - refreshInterval: 10s - secretStoreRef: - kind: ClusterSecretStore - name: {{ .Values.workloadClusterName }}-vault-kv-secret - target: - creationPolicy: Owner - deletionPolicy: Retain - name: crossplane-secrets ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: git-credentials - annotations: - argocd.argoproj.io/sync-wave: "0" -spec: - target: - name: git-credentials - template: - engineVersion: v2 - data: - creds: | - https://{{` {{ .username }} `}}:{{` {{ .password }} `}}@github.com - secretStoreRef: - kind: ClusterSecretStore - name: {{ .Values.workloadClusterName }}-vault-kv-secret - refreshInterval: 10s - data: - - remoteRef: - key: argocd/repo-credentials-template/{{ .Values.projectName }} - property: username - conversionStrategy: Default - secretKey: username - - remoteRef: - key: argocd/repo-credentials-template/{{ .Values.projectName }} - property: password - conversionStrategy: Default - secretKey: password diff --git a/templates/civo/project-cluster/templates/secrets/secret.yaml b/templates/civo/project-cluster/templates/secrets/secret.yaml deleted file mode 100644 index cab8daa..0000000 --- a/templates/civo/project-cluster/templates/secrets/secret.yaml +++ /dev/null @@ -1,35 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: repo-credentials-template-{{ .Values.projectOrg }} - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: '20' - labels: - app.kubernetes.io/part-of: argocd -spec: - refreshInterval: 10s - secretStoreRef: - kind: ClusterSecretStore - name: {{ .Values.workloadClusterName }}-vault-kv-secret - target: - name: repo-credentials-template-{{ .Values.projectOrg }} - creationPolicy: Owner - template: - metadata: - annotations: - managed-by: argocd.argoproj.io - labels: - argocd.argoproj.io/secret-type: repository - type: Opaque - data: - # Template will be populated from Vault data - type: "{{` {{ .type }} `}}" - name: "{{` {{ .name }} `}}" - url: "{{` {{ .url }} `}}" - username: "{{` {{ .username }} `}}" - password: "{{` {{ .password }} `}}" - dataFrom: - - extract: - key: argocd/repo-credentials-template/{{ .Values.projectName }} - diff --git a/terraform/civo/modules/project-cluster/main.tf b/terraform/civo/modules/project-cluster/main.tf index 4f7cfb7..5c39d92 100644 --- a/terraform/civo/modules/project-cluster/main.tf +++ b/terraform/civo/modules/project-cluster/main.tf @@ -146,3 +146,58 @@ resource "kubernetes_secret_v1" "external_dns" { } type = "Opaque" } + +# ────────────────────────────────────────────── +# Variables +# ────────────────────────────────────────────── + +variable "workload_cluster_name" { + description = "Name of the workload cluster" + type = string +} + +variable "project_name" { + description = "Project name used in Vault path" + type = string +} + +# ────────────────────────────────────────────── +# 1. Crossplane Secrets (extract all keys from /crossplane) +# ────────────────────────────────────────────── + +data "vault_generic_secret" "crossplane" { + path = "secret/crossplane" # maps to key: /crossplane +} + +resource "kubernetes_secret_v1" "crossplane_secrets" { + metadata { + name = "crossplane-secrets" + namespace = "crossplane-system" + } + + # Extract all key-value pairs from Vault into the secret + data = data.vault_generic_secret.crossplane.data + + type = "Opaque" +} + +# ────────────────────────────────────────────── +# 2. Git Credentials (templated creds file) +# ────────────────────────────────────────────── + +data "vault_generic_secret" "git_credentials" { + path = "secret/argocd/repo-credentials-template/${var.project_name}" +} + +resource "kubernetes_secret_v1" "git_credentials" { + metadata { + name = "git-credentials" + namespace = "crossplane-system" + } + + data = { + creds = "https://${data.vault_generic_secret.git_credentials.data["username"]}:${data.vault_generic_secret.git_credentials.data["password"]}@github.com" + } + + type = "Opaque" +} From abb361f134d279006fa66cace475245c20295fdb Mon Sep 17 00:00:00 2001 From: mrrishi Date: Fri, 20 Feb 2026 12:36:49 +0530 Subject: [PATCH 10/77] fix: add project var --- .../project-cluster/templates/infrastructure/workspace.yaml | 2 ++ terraform/civo/modules/project-cluster/variables.tf | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/templates/civo/project-cluster/templates/infrastructure/workspace.yaml b/templates/civo/project-cluster/templates/infrastructure/workspace.yaml index 2b3ab11..bc90aa5 100644 --- a/templates/civo/project-cluster/templates/infrastructure/workspace.yaml +++ b/templates/civo/project-cluster/templates/infrastructure/workspace.yaml @@ -18,3 +18,5 @@ spec: value: "{{ .Values.workloadNodeCount }}" - key: node_type value: "{{ .Values.workloadNodeType }}" + - key: project_name + value: "{{ .Values.workloadClusterProjectName }}" diff --git a/terraform/civo/modules/project-cluster/variables.tf b/terraform/civo/modules/project-cluster/variables.tf index 64bc599..924dc95 100644 --- a/terraform/civo/modules/project-cluster/variables.tf +++ b/terraform/civo/modules/project-cluster/variables.tf @@ -13,3 +13,7 @@ variable "node_count" { variable "node_type" { type = string } + +variable "project_name" { + type = string +} From a788ef9071fd34e21fd4aea1531632d8f8102092 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Fri, 20 Feb 2026 12:40:03 +0530 Subject: [PATCH 11/77] fix: sync wave number --- .../project-cluster/templates/30-argocd.yaml | 24 ------------------- .../templates/30-crossplane.yaml | 24 ------------------- 2 files changed, 48 deletions(-) delete mode 100644 templates/civo/project-cluster/templates/30-argocd.yaml delete mode 100644 templates/civo/project-cluster/templates/30-crossplane.yaml diff --git a/templates/civo/project-cluster/templates/30-argocd.yaml b/templates/civo/project-cluster/templates/30-argocd.yaml deleted file mode 100644 index 3117d05..0000000 --- a/templates/civo/project-cluster/templates/30-argocd.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: {{ .Values.workloadClusterName }}-argocd - namespace: argocd - finalizers: - - resources-finalizer.argocd.argoproj.io - annotations: - argocd.argoproj.io/sync-wave: '30' -spec: - project: {{ .Values.workloadClusterName }} - source: - repoURL: {{ .Values.gitopsRepoUrl }} - path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/argocd - targetRevision: HEAD - destination: - name: {{ .Values.workloadClusterName }} - namespace: argocd - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/templates/civo/project-cluster/templates/30-crossplane.yaml b/templates/civo/project-cluster/templates/30-crossplane.yaml deleted file mode 100644 index e26d715..0000000 --- a/templates/civo/project-cluster/templates/30-crossplane.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: {{ .Values.workloadClusterName }}-crossplane - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: "30" - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: {{ .Values.workloadClusterName }} - destination: - name: {{ .Values.workloadClusterName }} - namespace: crossplane-system - source: - repoURL: https://charts.crossplane.io/stable - chart: crossplane - targetRevision: 1.17.0 - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true From 87a26dcd7c9da91fa6748a4d0923860c779feed6 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Fri, 20 Feb 2026 12:40:10 +0530 Subject: [PATCH 12/77] fix: sync wave number --- .../templates/35-crossplane.yaml | 24 +++++++++++++++++++ .../project-cluster/templates/40-argocd.yaml | 24 +++++++++++++++++++ 2 files changed, 48 insertions(+) create mode 100644 templates/civo/project-cluster/templates/35-crossplane.yaml create mode 100644 templates/civo/project-cluster/templates/40-argocd.yaml diff --git a/templates/civo/project-cluster/templates/35-crossplane.yaml b/templates/civo/project-cluster/templates/35-crossplane.yaml new file mode 100644 index 0000000..b856f8b --- /dev/null +++ b/templates/civo/project-cluster/templates/35-crossplane.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-crossplane + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "35" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: {{ .Values.workloadClusterName }} + destination: + name: {{ .Values.workloadClusterName }} + namespace: crossplane-system + source: + repoURL: https://charts.crossplane.io/stable + chart: crossplane + targetRevision: 1.17.0 + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/civo/project-cluster/templates/40-argocd.yaml b/templates/civo/project-cluster/templates/40-argocd.yaml new file mode 100644 index 0000000..068a8fa --- /dev/null +++ b/templates/civo/project-cluster/templates/40-argocd.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-argocd + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '40' +spec: + project: {{ .Values.workloadClusterName }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/argocd + targetRevision: HEAD + destination: + name: {{ .Values.workloadClusterName }} + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true From beedf002276ac6a7328ed6171ffd46c3fdcd404c Mon Sep 17 00:00:00 2001 From: mrrishi Date: Fri, 20 Feb 2026 12:42:32 +0530 Subject: [PATCH 13/77] fix: sync wave number --- templates/civo/project-cluster/templates/30-ingress-nginx.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/civo/project-cluster/templates/30-ingress-nginx.yaml b/templates/civo/project-cluster/templates/30-ingress-nginx.yaml index 5c6ffad..37383b0 100644 --- a/templates/civo/project-cluster/templates/30-ingress-nginx.yaml +++ b/templates/civo/project-cluster/templates/30-ingress-nginx.yaml @@ -8,7 +8,7 @@ metadata: annotations: argocd.argoproj.io/sync-wave: '30' spec: - project: {{ .Values.workloadClusterName }}-platform + project: {{ .Values.workloadClusterName }} source: repoURL: https://kubernetes.github.io/ingress-nginx targetRevision: 4.12.1 From 21006cbb8e2847b7325c41e6c071f39ecae9d049 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Fri, 20 Feb 2026 12:54:20 +0530 Subject: [PATCH 14/77] fix: sync wave number --- .../templates/30-external-dns.yaml | 5 +-- .../templates/30-ingress-nginx.yaml | 2 +- .../templates/30-reloader.yaml | 2 +- .../templates/argocd/argocd-grpc-ingress.yaml | 37 ------------------ .../argocd/argocd-https-ingress.yaml | 38 ------------------- .../templates/argocd/kustomization.yaml | 3 +- 6 files changed, 4 insertions(+), 83 deletions(-) delete mode 100644 templates/civo/project-cluster/templates/argocd/argocd-grpc-ingress.yaml delete mode 100644 templates/civo/project-cluster/templates/argocd/argocd-https-ingress.yaml diff --git a/templates/civo/project-cluster/templates/30-external-dns.yaml b/templates/civo/project-cluster/templates/30-external-dns.yaml index fd9958b..92eb7c1 100644 --- a/templates/civo/project-cluster/templates/30-external-dns.yaml +++ b/templates/civo/project-cluster/templates/30-external-dns.yaml @@ -11,13 +11,10 @@ spec: project: {{ .Values.workloadClusterName }} source: repoURL: https://kubernetes-sigs.github.io/external-dns - targetRevision: 1.14.4 + targetRevision: 1.20.0 helm: releaseName: external-dns values: | - image: - repository: registry.k8s.io/external-dns/external-dns - tag: "v0.13.2" serviceAccount: create: true name: external-dns diff --git a/templates/civo/project-cluster/templates/30-ingress-nginx.yaml b/templates/civo/project-cluster/templates/30-ingress-nginx.yaml index 37383b0..9b82797 100644 --- a/templates/civo/project-cluster/templates/30-ingress-nginx.yaml +++ b/templates/civo/project-cluster/templates/30-ingress-nginx.yaml @@ -11,7 +11,7 @@ spec: project: {{ .Values.workloadClusterName }} source: repoURL: https://kubernetes.github.io/ingress-nginx - targetRevision: 4.12.1 + targetRevision: 4.14.3 helm: values: |- controller: diff --git a/templates/civo/project-cluster/templates/30-reloader.yaml b/templates/civo/project-cluster/templates/30-reloader.yaml index b78a188..cfb9074 100644 --- a/templates/civo/project-cluster/templates/30-reloader.yaml +++ b/templates/civo/project-cluster/templates/30-reloader.yaml @@ -11,7 +11,7 @@ spec: project: {{ .Values.workloadClusterName }} source: repoURL: 'https://stakater.github.io/stakater-charts' - targetRevision: v1.0.10 + targetRevision: 2.2.8 chart: reloader helm: values: |- diff --git a/templates/civo/project-cluster/templates/argocd/argocd-grpc-ingress.yaml b/templates/civo/project-cluster/templates/argocd/argocd-grpc-ingress.yaml deleted file mode 100644 index 6012aa5..0000000 --- a/templates/civo/project-cluster/templates/argocd/argocd-grpc-ingress.yaml +++ /dev/null @@ -1,37 +0,0 @@ ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: argocd-server-grpc-ingress - namespace: argocd - annotations: - nginx.ingress.kubernetes.io/backend-protocol: "GRPC" - {{- if .Values.certManagerIssuerAnnotation1 }} - {{ .Values.certManagerIssuerAnnotation1 }} - {{- end }} - {{- if .Values.certManagerIssuerAnnotation2 }} - {{ .Values.certManagerIssuerAnnotation2 }} - {{- end }} - {{- if .Values.certManagerIssuerAnnotation3 }} - {{ .Values.certManagerIssuerAnnotation3 }} - {{- end }} - {{- if .Values.certManagerIssuerAnnotation4 }} - {{ .Values.certManagerIssuerAnnotation4 }} - {{- end }} -spec: - ingressClassName: nginx - rules: - - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: argocd-server - port: - name: https - host: grpc-{{ .Values.workloadClusterName }}.argocd.{{ .Values.domainName }} - tls: - - hosts: - - grpc-argocd-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} - secretName: argocd-ingress-grpc diff --git a/templates/civo/project-cluster/templates/argocd/argocd-https-ingress.yaml b/templates/civo/project-cluster/templates/argocd/argocd-https-ingress.yaml deleted file mode 100644 index 12d068b..0000000 --- a/templates/civo/project-cluster/templates/argocd/argocd-https-ingress.yaml +++ /dev/null @@ -1,38 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: argocd-server-http-ingress - namespace: argocd - annotations: - nginx.ingress.kubernetes.io/force-ssl-redirect: "true" - nginx.ingress.kubernetes.io/backend-protocol: "HTTP" - {{- if .Values.certManagerIssuerAnnotation1 }} - {{ .Values.certManagerIssuerAnnotation1 }} - {{- end }} - {{- if .Values.certManagerIssuerAnnotation2 }} - {{ .Values.certManagerIssuerAnnotation2 }} - {{- end }} - {{- if .Values.certManagerIssuerAnnotation3 }} - {{ .Values.certManagerIssuerAnnotation3 }} - {{- end }} - {{- if .Values.certManagerIssuerAnnotation4 }} - {{ .Values.certManagerIssuerAnnotation4 }} - {{- end }} -spec: - ingressClassName: nginx - rules: - - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: argocd-server - port: - name: http - host: argocd-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} - tls: - - hosts: - - argocd-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} - secretName: argocd-ingress-http - diff --git a/templates/civo/project-cluster/templates/argocd/kustomization.yaml b/templates/civo/project-cluster/templates/argocd/kustomization.yaml index 213e9eb..4066abf 100644 --- a/templates/civo/project-cluster/templates/argocd/kustomization.yaml +++ b/templates/civo/project-cluster/templates/argocd/kustomization.yaml @@ -6,8 +6,7 @@ namespace: argocd # https://github.com/argoproj/argo-cd/tags resources: - github.com:konstructio/manifests.git/argocd/cloud?ref=jokestax-patch-2 - - argocd-https-ingress.yaml - - argocd-grpc-ingress.yaml + - argocd-ui-ingress.yaml - application.yaml - rbac.yaml From d40836bba585eeb0e9fef60e653f719011f90f60 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Fri, 20 Feb 2026 12:54:29 +0530 Subject: [PATCH 15/77] fix: sync wave number --- .../templates/argocd/argocd-ui-ingress.yaml | 74 +++++++++++++++++++ 1 file changed, 74 insertions(+) create mode 100644 templates/civo/project-cluster/templates/argocd/argocd-ui-ingress.yaml diff --git a/templates/civo/project-cluster/templates/argocd/argocd-ui-ingress.yaml b/templates/civo/project-cluster/templates/argocd/argocd-ui-ingress.yaml new file mode 100644 index 0000000..0823ebd --- /dev/null +++ b/templates/civo/project-cluster/templates/argocd/argocd-ui-ingress.yaml @@ -0,0 +1,74 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: argocd-server-http-ingress + namespace: argocd + annotations: + nginx.ingress.kubernetes.io/force-ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" + {{- if .Values.certManagerIssuerAnnotation1 }} + {{ .Values.certManagerIssuerAnnotation1 }} + {{- end }} + {{- if .Values.certManagerIssuerAnnotation2 }} + {{ .Values.certManagerIssuerAnnotation2 }} + {{- end }} + {{- if .Values.certManagerIssuerAnnotation3 }} + {{ .Values.certManagerIssuerAnnotation3 }} + {{- end }} + {{- if .Values.certManagerIssuerAnnotation4 }} + {{ .Values.certManagerIssuerAnnotation4 }} + {{- end }} +spec: + ingressClassName: nginx + rules: + - http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: argocd-server + port: + name: http + host: argocd-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} + tls: + - hosts: + - argocd-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} + secretName: argocd-ingress-http +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: argocd-server-grpc-ingress + namespace: argocd + annotations: + nginx.ingress.kubernetes.io/backend-protocol: "GRPC" + {{- if .Values.certManagerIssuerAnnotation1 }} + {{ .Values.certManagerIssuerAnnotation1 }} + {{- end }} + {{- if .Values.certManagerIssuerAnnotation2 }} + {{ .Values.certManagerIssuerAnnotation2 }} + {{- end }} + {{- if .Values.certManagerIssuerAnnotation3 }} + {{ .Values.certManagerIssuerAnnotation3 }} + {{- end }} + {{- if .Values.certManagerIssuerAnnotation4 }} + {{ .Values.certManagerIssuerAnnotation4 }} + {{- end }} +spec: + ingressClassName: nginx + rules: + - http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: argocd-server + port: + name: https + host: grpc-{{ .Values.workloadClusterName }}.argocd.{{ .Values.domainName }} + tls: + - hosts: + - grpc-argocd-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} + secretName: argocd-ingress-grpc From 35daa11557a26d867c372a31dd789fe942a7513d Mon Sep 17 00:00:00 2001 From: mrrishi Date: Fri, 20 Feb 2026 13:00:29 +0530 Subject: [PATCH 16/77] feat: add cert issuers --- .../templates/30-clusterissuers.yaml | 24 +++++++++++++++ .../cert-issuers/clusterissuers.yaml | 29 +++++++++++++++++++ templates/civo/project-cluster/values.yaml | 5 ++++ 3 files changed, 58 insertions(+) create mode 100644 templates/civo/project-cluster/templates/30-clusterissuers.yaml create mode 100644 templates/civo/project-cluster/templates/cert-issuers/clusterissuers.yaml diff --git a/templates/civo/project-cluster/templates/30-clusterissuers.yaml b/templates/civo/project-cluster/templates/30-clusterissuers.yaml new file mode 100644 index 0000000..f25e25e --- /dev/null +++ b/templates/civo/project-cluster/templates/30-clusterissuers.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-cert-issuers + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '40' +spec: + project: {{ .Values.workloadClusterName }} + source: + repoURL: https://github.com/k1-civo/gitops.git + path: registry/clusters/{{ .Values.workloadClusterName }}/cert-issuers + targetRevision: HEAD + destination: + name: {{ .Values.workloadClusterName }} + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/civo/project-cluster/templates/cert-issuers/clusterissuers.yaml b/templates/civo/project-cluster/templates/cert-issuers/clusterissuers.yaml new file mode 100644 index 0000000..185d5fb --- /dev/null +++ b/templates/civo/project-cluster/templates/cert-issuers/clusterissuers.yaml @@ -0,0 +1,29 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-staging +spec: + acme: + server: https://acme-staging-v02.api.letsencrypt.org/directory + email: {{ .Values.email }} + privateKeySecretRef: + name: letsencrypt-staging + solvers: + - http01: + ingress: + class: nginx +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-prod +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + email: {{ .Values.email }} + privateKeySecretRef: + name: letsencrypt-prod + solvers: + - http01: + ingress: + class: nginx diff --git a/templates/civo/project-cluster/values.yaml b/templates/civo/project-cluster/values.yaml index dd30a72..8eecb5a 100644 --- a/templates/civo/project-cluster/values.yaml +++ b/templates/civo/project-cluster/values.yaml @@ -4,6 +4,11 @@ # @input.required: true workloadClusterTerraformModuleUrl: "git::https://github.com/konstructio/gitops-template.git//terraform/civo/modules/workload-cluster?ref=main" +# @input.type: string +# @input.description: Alert email address for cert-manager notifications +# @input.required: false +email: 123@gmail.com + # @input.type: string # @input.description: the Domain Name # @input.required: false From 540fb572bce5963dcf163440db5c0289988bc7e9 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Fri, 20 Feb 2026 13:02:52 +0530 Subject: [PATCH 17/77] feat: add cert manager --- .../templates/30-cert-manager.yaml | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 templates/civo/project-cluster/templates/30-cert-manager.yaml diff --git a/templates/civo/project-cluster/templates/30-cert-manager.yaml b/templates/civo/project-cluster/templates/30-cert-manager.yaml new file mode 100644 index 0000000..68044e1 --- /dev/null +++ b/templates/civo/project-cluster/templates/30-cert-manager.yaml @@ -0,0 +1,30 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-cert-manager + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: {{ .Values.workloadClusterName }} + source: + repoURL: https://charts.jetstack.io + targetRevision: v1.14.4 + helm: + values: |- + serviceAccount: + create: true + name: cert-manager + installCRDs: true + chart: cert-manager + destination: + name: {{ .Values.workloadClusterName }} + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true From ebd87b5544e601b0dd6aedaa38af47ed53f69a6e Mon Sep 17 00:00:00 2001 From: mrrishi Date: Fri, 20 Feb 2026 13:07:45 +0530 Subject: [PATCH 18/77] feat: add cert manager --- templates/civo/project-cluster/templates/30-cert-manager.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/civo/project-cluster/templates/30-cert-manager.yaml b/templates/civo/project-cluster/templates/30-cert-manager.yaml index 68044e1..9a71b7d 100644 --- a/templates/civo/project-cluster/templates/30-cert-manager.yaml +++ b/templates/civo/project-cluster/templates/30-cert-manager.yaml @@ -11,7 +11,7 @@ spec: project: {{ .Values.workloadClusterName }} source: repoURL: https://charts.jetstack.io - targetRevision: v1.14.4 + targetRevision: v1.19.3 helm: values: |- serviceAccount: From a2abfa1e1c8e861970527e8f185893f7626df439 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Fri, 20 Feb 2026 13:13:33 +0530 Subject: [PATCH 19/77] fix: external dns --- .../civo/project-cluster/templates/30-external-dns.yaml | 4 ++-- templates/civo/project-cluster/values.yaml | 5 ----- 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/templates/civo/project-cluster/templates/30-external-dns.yaml b/templates/civo/project-cluster/templates/30-external-dns.yaml index 92eb7c1..9371262 100644 --- a/templates/civo/project-cluster/templates/30-external-dns.yaml +++ b/templates/civo/project-cluster/templates/30-external-dns.yaml @@ -11,7 +11,7 @@ spec: project: {{ .Values.workloadClusterName }} source: repoURL: https://kubernetes-sigs.github.io/external-dns - targetRevision: 1.20.0 + targetRevision: 1.14.4 helm: releaseName: external-dns values: | @@ -22,7 +22,7 @@ spec: sources: - ingress domainFilters: - - {{ .Values.workloadExternalDnsDomainName }} + - {{ .Values.domainName }} env: - name: {{ .Values.externalDnsProviderTokenEnvName }} valueFrom: diff --git a/templates/civo/project-cluster/values.yaml b/templates/civo/project-cluster/values.yaml index 8eecb5a..d033e42 100644 --- a/templates/civo/project-cluster/values.yaml +++ b/templates/civo/project-cluster/values.yaml @@ -20,11 +20,6 @@ domainName: kubefunk.net # @input.required: false externalDnsProviderName: cloudflare -# @input.type: string -# @input.description: the domain name filter for external-dns -# @input.required: false -workloadExternalDnsDomainName: example.com - # @input.type: string # @input.description: the environment variable name for the DNS provider token (e.g., CF_API_TOKEN) # @input.required: false From d9cb186dbd31222ce213f7214dce685c00be440a Mon Sep 17 00:00:00 2001 From: mrrishi Date: Fri, 20 Feb 2026 16:11:48 +0530 Subject: [PATCH 20/77] fix: namespace creation --- .../civo/modules/project-cluster/main.tf | 33 ++++++++----------- 1 file changed, 13 insertions(+), 20 deletions(-) diff --git a/terraform/civo/modules/project-cluster/main.tf b/terraform/civo/modules/project-cluster/main.tf index 5c39d92..3179a88 100644 --- a/terraform/civo/modules/project-cluster/main.tf +++ b/terraform/civo/modules/project-cluster/main.tf @@ -126,20 +126,20 @@ resource "kubernetes_secret_v1" "argocd_manager" { depends_on = [kubernetes_service_account_v1.argocd_manager] } -data "vault_generic_secret" "external_dns" { - path = "secret/external-dns" -} - resource "kubernetes_namespace_v1" "external_dns" { metadata { name = "external-dns" } } +data "vault_generic_secret" "external_dns" { + path = "secret/external-dns" +} + resource "kubernetes_secret_v1" "external_dns" { metadata { name = "external-dns-secrets" - namespace = "external-dns" + namespace = kubernetes_namespace_v1.external_dns.metadata.0.name } data = { token = data.vault_generic_secret.external_dns.data["token"] @@ -148,23 +148,15 @@ resource "kubernetes_secret_v1" "external_dns" { } # ────────────────────────────────────────────── -# Variables +# 1. Crossplane Secrets (extract all keys from /crossplane) # ────────────────────────────────────────────── -variable "workload_cluster_name" { - description = "Name of the workload cluster" - type = string -} - -variable "project_name" { - description = "Project name used in Vault path" - type = string +resource "kubernetes_namespace_v1" "crossplane_system" { + metadata { + name = "crossplane-system" + } } -# ────────────────────────────────────────────── -# 1. Crossplane Secrets (extract all keys from /crossplane) -# ────────────────────────────────────────────── - data "vault_generic_secret" "crossplane" { path = "secret/crossplane" # maps to key: /crossplane } @@ -172,7 +164,7 @@ data "vault_generic_secret" "crossplane" { resource "kubernetes_secret_v1" "crossplane_secrets" { metadata { name = "crossplane-secrets" - namespace = "crossplane-system" + namespace = kubernetes_namespace_v1.crossplane_system.metadata.0.name } # Extract all key-value pairs from Vault into the secret @@ -192,7 +184,7 @@ data "vault_generic_secret" "git_credentials" { resource "kubernetes_secret_v1" "git_credentials" { metadata { name = "git-credentials" - namespace = "crossplane-system" + namespace = kubernetes_namespace_v1.crossplane_system.metadata.0.name } data = { @@ -201,3 +193,4 @@ resource "kubernetes_secret_v1" "git_credentials" { type = "Opaque" } + From 286e0d017e6e08c2b984736aec4911d841d6e846 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Fri, 20 Feb 2026 16:16:11 +0530 Subject: [PATCH 21/77] fix: remove bootstrap --- .../15-infrastructure-bootstrap.yaml | 29 ------------------- 1 file changed, 29 deletions(-) delete mode 100644 templates/civo/project-cluster/templates/15-infrastructure-bootstrap.yaml diff --git a/templates/civo/project-cluster/templates/15-infrastructure-bootstrap.yaml b/templates/civo/project-cluster/templates/15-infrastructure-bootstrap.yaml deleted file mode 100644 index 87fd876..0000000 --- a/templates/civo/project-cluster/templates/15-infrastructure-bootstrap.yaml +++ /dev/null @@ -1,29 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: {{ .Values.workloadClusterName }}-bootstrap - namespace: argocd - finalizers: - - resources-finalizer.argocd.argoproj.io - annotations: - argocd.argoproj.io/sync-wave: '15' -spec: - project: default - source: - repoURL: {{ .Values.gitopsRepoUrl }} - path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/infrastructure-bootstrap - targetRevision: HEAD - destination: - name: in-cluster - namespace: {{ .Values.workloadClusterName }} - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - retry: - limit: 30 - backoff: - duration: 1m - factor: 1 From 0a70aa504bf8517a2c32d9765b2bf161cad46984 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Sat, 21 Feb 2026 10:52:18 +0530 Subject: [PATCH 22/77] fix: add argocd ns --- .../templates/20-argocd-connection.yaml | 62 ---- .../templates/30-cert-manager.yaml | 2 +- .../templates/30-ingress-nginx.yaml | 2 +- .../templates/infrastructure/workspace.yaml | 3 +- .../provider-config/providerconfig.yaml | 13 +- templates/civo/workload-cluster/values.yaml | 71 ----- .../civo/modules/project-cluster/main.tf | 22 ++ .../civo/modules/workload-cluster/gpu.tf | 290 ------------------ .../civo/modules/workload-cluster/main.tf | 56 ++-- .../modules/workload-cluster/variables.tf | 4 - 10 files changed, 49 insertions(+), 476 deletions(-) delete mode 100644 templates/civo/workload-cluster/templates/20-argocd-connection.yaml delete mode 100644 terraform/civo/modules/workload-cluster/gpu.tf diff --git a/templates/civo/workload-cluster/templates/20-argocd-connection.yaml b/templates/civo/workload-cluster/templates/20-argocd-connection.yaml deleted file mode 100644 index 26518df..0000000 --- a/templates/civo/workload-cluster/templates/20-argocd-connection.yaml +++ /dev/null @@ -1,62 +0,0 @@ -apiVersion: "external-secrets.io/v1" -kind: ExternalSecret -metadata: - name: {{ .Values.workloadClusterName }} - annotations: - argocd.argoproj.io/sync-wave: '20' - labels: - app.kubernetes.io/part-of: argocd -spec: - target: - name: {{ .Values.workloadClusterName }} - template: - metadata: - labels: - argocd.argoproj.io/secret-type: cluster - engineVersion: v2 - data: - name: "{{` {{ .cluster_name }} `}}" - server: "{{` {{ .host }} `}}" - clusterResources: "true" - config: | - { - "bearerToken": "{{` {{ .argocd_manager_sa_token }} `}}", - "tlsClientConfig": { - "caData": "{{` {{ .cluster_ca_certificate | b64enc }} `}}", - "certData": "{{` {{ .client_certificate | b64enc }} `}}", - "insecure": false, - "keyData": "{{` {{ .client_key | b64enc }} `}}" - } - } - secretStoreRef: - kind: ClusterSecretStore - name: {{ .Values.projectClusterName }}-aws-ssm - refreshInterval: 10s - data: - - remoteRef: - key: /clusters/{{ .Values.workloadClusterName }} - property: argocd_manager_sa_token - secretKey: argocd_manager_sa_token - - remoteRef: - key: /clusters/{{ .Values.workloadClusterName }} - property: host - secretKey: host - - remoteRef: - key: /clusters/{{ .Values.workloadClusterName }} - property: cluster_name - secretKey: cluster_name - - remoteRef: - key: /clusters/{{ .Values.workloadClusterName }} - property: cluster_ca_certificate - conversionStrategy: Default - secretKey: cluster_ca_certificate - - remoteRef: - key: /clusters/{{ .Values.workloadClusterName }} - property: client_certificate - conversionStrategy: Default - secretKey: client_certificate - - remoteRef: - key: /clusters/{{ .Values.workloadClusterName }} - property: client_key - conversionStrategy: Default - secretKey: client_key diff --git a/templates/civo/workload-cluster/templates/30-cert-manager.yaml b/templates/civo/workload-cluster/templates/30-cert-manager.yaml index c0bc0f6..d0907e4 100644 --- a/templates/civo/workload-cluster/templates/30-cert-manager.yaml +++ b/templates/civo/workload-cluster/templates/30-cert-manager.yaml @@ -11,7 +11,7 @@ spec: project: {{ .Values.workloadClusterName }}-platform source: repoURL: https://charts.jetstack.io - targetRevision: v1.14.4 + targetRevision: v1.19.3 helm: values: |- serviceAccount: diff --git a/templates/civo/workload-cluster/templates/30-ingress-nginx.yaml b/templates/civo/workload-cluster/templates/30-ingress-nginx.yaml index 5c6ffad..e98503c 100644 --- a/templates/civo/workload-cluster/templates/30-ingress-nginx.yaml +++ b/templates/civo/workload-cluster/templates/30-ingress-nginx.yaml @@ -11,7 +11,7 @@ spec: project: {{ .Values.workloadClusterName }}-platform source: repoURL: https://kubernetes.github.io/ingress-nginx - targetRevision: 4.12.1 + targetRevision: 4.14.3 helm: values: |- controller: diff --git a/templates/civo/workload-cluster/templates/infrastructure/workspace.yaml b/templates/civo/workload-cluster/templates/infrastructure/workspace.yaml index 8ff55f3..6e77647 100644 --- a/templates/civo/workload-cluster/templates/infrastructure/workspace.yaml +++ b/templates/civo/workload-cluster/templates/infrastructure/workspace.yaml @@ -19,5 +19,4 @@ spec: value: "{{ .Values.workloadNodeCount }}" - key: node_type value: {{ .Values.workloadNodeType }} - - key: is_gpu - value: "false" + diff --git a/templates/civo/workload-cluster/templates/provider-config/providerconfig.yaml b/templates/civo/workload-cluster/templates/provider-config/providerconfig.yaml index 3069bd7..46c0185 100644 --- a/templates/civo/workload-cluster/templates/provider-config/providerconfig.yaml +++ b/templates/civo/workload-cluster/templates/provider-config/providerconfig.yaml @@ -29,24 +29,13 @@ spec: credentials_file = "civo.json" region = "{{ .Values.workloadClusterRegion }}" } - provider "civo" { - alias = "PROJECT_REGION" - region = "{{ .Values.projectRegion }}" - credentials_file = "projectclustercivo.json" - } pluginCache: false credentials: - - filename: projectclustercivo.json - source: Secret - secretRef: - namespace: crossplane-system - name: {{ .Values.workloadClusterName }}-civo-creds - key: config.json - filename: civo.json source: Secret secretRef: namespace: crossplane-system - name: civo-creds + name: {{ .Values.cloudAccountName }}-civo-creds key: config.json - filename: .git-credentials source: Secret diff --git a/templates/civo/workload-cluster/values.yaml b/templates/civo/workload-cluster/values.yaml index b6b6049..bf552d4 100644 --- a/templates/civo/workload-cluster/values.yaml +++ b/templates/civo/workload-cluster/values.yaml @@ -1,79 +1,8 @@ -# Workload Cluster Configuration -# @input.type: string -# @input.description: the name of the workload cluster (used for naming resources and ArgoCD applications) -# @input.required: true -workloadClusterName: my-workload-cluster - -# @input.type: string -# @input.description: the name of the project cluster that manages this workload cluster -# @input.required: true -projectClusterName: my-project-cluster - -# GitOps Repository Configuration -# @input.type: string -# @input.description: the full GitOps repository URL (e.g., https://github.com/org/repo) -# @input.required: true -gitopsRepoUrl: "https://github.com/my-org/gitops-repo" - -# @input.type: string -# @input.description: the team GitOps repository URL for environment deployments -# @input.required: true -teamGitopsRepoUrl: "https://github.com/my-org/team-gitops-repo" - -# Environment Configuration -# @input.type: string -# @input.description: the environment name (e.g., dev, staging, production) -# @input.required: true -envName: dev - -# Workload Cluster Infrastructure Settings -# @input.type: string -# @input.description: the Civo region where the workload cluster will be deployed (e.g., LON1, NYC1, FRA1) -# @input.required: true -workloadClusterRegion: LON1 - -# @input.type: string -# @input.description: the number of worker nodes in the Civo Kubernetes cluster -# @input.required: true -workloadNodeCount: "3" - -# @input.type: string -# @input.description: the Civo instance type for worker nodes (e.g., g4s.kube.small, g4s.kube.medium, g4s.kube.large) -# @input.required: true -workloadNodeType: g4s.kube.medium - # Terraform Module Configuration # @input.type: string # @input.description: the complete URL for the Terraform module for infrastructure provisioning # @input.required: true workloadClusterTerraformModuleUrl: "git::https://github.com/konstructio/gitops-template.git//terraform/civo/modules/workload-cluster?ref=main" -# Project Cluster Configuration -# @input.type: string -# @input.description: the S3 bucket name for Terraform state storage -# @input.required: true -projectStateStoreBucket: project-state-bucket - -# @input.type: string -# @input.description: the AWS region of the project cluster -# @input.required: true -projectRegion: us-east-1 - -# @input.type: string -# @input.description: the AWS account ID for the project cluster -# @input.required: true -projectAwsAccountId: "123456789012" - -# @input.type: string -# @input.description: the IAM role ARN to assume for project cluster operations -# @input.required: true -projectAssumeRole: "arn:aws:iam::123456789012:role/crossplane-project" - -# Cloud Account Configuration -# @input.type: string -# @input.description: the name of the Civo cloud account (used for credentials secret name) -# @input.required: true -cloudAccountName: civo-account - # Wait Job Configuration waitJobImage: "dtzar/helm-kubectl:3.19.0" diff --git a/terraform/civo/modules/project-cluster/main.tf b/terraform/civo/modules/project-cluster/main.tf index 3179a88..394ddb1 100644 --- a/terraform/civo/modules/project-cluster/main.tf +++ b/terraform/civo/modules/project-cluster/main.tf @@ -194,3 +194,25 @@ resource "kubernetes_secret_v1" "git_credentials" { type = "Opaque" } +resource "kubernetes_namespace_v1" "argocd" { + metadata { + name = "argocd" + } +} + +resource "kubernetes_secret_v1" "argocd_git_credentials" { + metadata { + name = "repo-credentials-template-${var.project_name}" + namespace = kubernetes_namespace_v1.argocd.metadata.0.name + } + + data = { + type: data.vault_generic_secret.git_credentials.data["type"], + url: data.vault_generic_secret.git_credentials.data["url"], + username: data.vault_generic_secret.git_credentials.data["username"], + password: data.vault_generic_secret.git_credentials.data["password"], + name: data.vault_generic_secret.git_credentials.data["name"], + } + + type = "Opaque" +} diff --git a/terraform/civo/modules/workload-cluster/gpu.tf b/terraform/civo/modules/workload-cluster/gpu.tf deleted file mode 100644 index e0babcf..0000000 --- a/terraform/civo/modules/workload-cluster/gpu.tf +++ /dev/null @@ -1,290 +0,0 @@ -# Configuration used to install the GPU operator - -locals { - gpu_node_sizes = [for i in data.civo_size.gpu.sizes : i.name] - gpu_prefixes = ["g4g.", "an."] # Civo GPU sizes start with these prefixes - ensure to end with "." to avoid false positives - is_gpu = contains(local.gpu_node_sizes, var.node_type) && var.is_gpu -} - -# Get all the GPU node types -data "civo_size" "gpu" { - filter { - key = "name" - values = local.gpu_prefixes - match_by = "re" - } - filter { - key = "type" - values = ["kubernetes"] - } -} - -# Create labels for the GPU operator namespace -resource "kubernetes_namespace_v1" "gpu_operator_labels" { - count = local.is_gpu ? 1 : 0 - metadata { - name = "gpu-operator" - labels = { - "pod-security.kubernetes.io/enforce" = "privileged" - } - } -} - -# Helm release configuration for the Nvidia GPU operator -resource "helm_release" "gpu_operator" { - count = local.is_gpu ? 1 : 0 - name = "gpu-operator" - repository = "https://helm.ngc.nvidia.com/nvidia" - chart = "gpu-operator" - namespace = kubernetes_namespace_v1.gpu_operator_labels[count.index].metadata[0].name - version = "v24.6.0" - atomic = true - cleanup_on_fail = true - reset_values = true - wait = true - # Values taken from Civo GPU operator - # @link https://github.com/civo-learn/civo-gpu-operator-tf/blob/cdb5bc6ac3d278e3a0285178c4960611639bf196/infra/tf/values/gpu-operator-values.yaml - values = [ - yamlencode({ - # set replica false as feature discovery remains pending - wait = true - - ## Node Feature Discovery enabled/disable configuration. - nfd = { - enabled = true - } - - # GPU Feature Discovery configuration. - gfd = { - enabled = true - } - - # Operator configuration. - operator = { - upgradeCRD = true - cleanupCRD = true - resources = { - requests = { - cpu = "10m" - memory = "100Mi" - } - limits = { - cpu = "50m" - memory = "300Mi" - } - } - } - - # Node Feature Discovery configuration. - node-feature-discovery = { - enableNodeFeatureApi = true - master = { - resources = { - requests = { - cpu = "10m" - memory = "200Mi" - } - } - } - worker = { - resources = { - requests = { - cpu = "10m" - memory = "100Mi" - } - limits = { - cpu = "50m" - memory = "300Mi" - } - } - affinity = { - nodeAffinity = { - requiredDuringSchedulingIgnoredDuringExecution = { - nodeSelectorTerms = [ - { - matchExpressions = [ - { - key = "node.kubernetes.io/instance-type" - operator = "In" - values = local.gpu_node_sizes - } - ] - } - ] - } - } - } - tolerations = [ - { - key = "nvidia.com/gpu" - operator = "Exists" - effect = "NoSchedule" - } - ] - } - gc = { - enable = false - interval = "30m" - resources = { - requests = { - cpu = "10m" - memory = "100Mi" - } - } - affinity = { - nodeAffinity = { - requiredDuringSchedulingIgnoredDuringExecution = { - nodeSelectorTerms = [ - { - matchExpressions = [ - { - key = "node.kubernetes.io/instance-type" - operator = "NotIn" - values = local.gpu_node_sizes - } - ] - } - ] - } - } - } - tolerations = [ - { - key = "nvidia.com/gpu" - operator = "Exists" - effect = "NoSchedule" - } - ] - } - } - - # Driver configuration - driver = { - enabled = false - } - - # Toolkit configuration. - toolkit = { - enabled = false - } - - # Device Plugin configuration. - devicePlugin = { - enabled = true - version = "v0.14.5" - env = [ - { - name = "FAIL_ON_INIT_ERROR" - value = "false" - } - ] - } - - # DCGM configuration - dcgm = { - # enable with monitoring - enabled = false - resources = { - requests = { - cpu = "10m" - memory = "100Mi" - } - limits = { - cpu = "50m" - memory = "400Mi" - } - } - } - - # DCGM Exporter configuration. - dcgmExporter = { - # enable with monitoring - enabled = false - } - - # MIG Manager configuration. - migManager = { - # @skip civo-talos-gpu-operator.migManager.enabled - enabled = false - } - validator = { - enabled = false - } - }) - ] -} -# as the host driver and the nvidia container toolkit are provided within Talos as Shims, -# we need to create a daemonset that forces these to be marked as ready for the GPU operator -# TODO: "productionise" this -resource "kubernetes_daemonset" "fake_toolkit_ready" { - count = local.is_gpu ? 1 : 0 - metadata { - name = "fake-toolkit-ready" - namespace = kubernetes_namespace_v1.gpu_operator_labels[count.index].metadata[0].name - } - spec { - selector { - match_labels = { - "k8s-app" = "fake-toolkit-ready" - } - } - template { - metadata { - labels = { - name = "fake-toolkit-ready" - "k8s-app" = "fake-toolkit-ready" - } - } - spec { - volume { - name = "run-nvidia" - host_path { - path = "/run/nvidia/validations/" - } - } - container { - name = "main" - image = "alpine:3.19" - command = ["sh", "-c"] - args = [ - <<-EOF - set -ex; - touch /run/nvidia/validations/host-driver-ready; - touch /run/nvidia/validations/toolkit-ready; - touch /run/nvidia/validations/.driver-ctr-ready; - touch /run/nvidia/validations/driver-ready - sleep infinity - EOF - ] - volume_mount { - name = "run-nvidia" - mount_path = "/run/nvidia/validations/" - mount_propagation = "HostToContainer" - } - image_pull_policy = "IfNotPresent" - } - restart_policy = "Always" - affinity { - node_affinity { - required_during_scheduling_ignored_during_execution { - node_selector_term { - match_expressions { - key = "node.kubernetes.io/instance-type" - operator = "In" - values = local.gpu_node_sizes - } - } - } - } - } - toleration { - key = "nvidia.com/gpu" - operator = "Exists" - effect = "NoSchedule" - } - priority_class_name = "system-node-critical" - } - } - } - depends_on = [helm_release.gpu_operator] -} diff --git a/terraform/civo/modules/workload-cluster/main.tf b/terraform/civo/modules/workload-cluster/main.tf index e56162d..58ccb88 100644 --- a/terraform/civo/modules/workload-cluster/main.tf +++ b/terraform/civo/modules/workload-cluster/main.tf @@ -13,35 +13,15 @@ resource "civo_kubernetes_cluster" "kubefirst" { network_id = civo_network.kubefirst.id firewall_id = civo_firewall.kubefirst.id write_kubeconfig = true - cluster_type = local.is_gpu ? "talos" : "k3s" # k3s doesn't support GPU - kubernetes_version = local.is_gpu ? "1.27.0" : "1.32.5-k3s1" + cluster_type = "k3s" + kubernetes_version = "1.32.5-k3s1" pools { label = var.cluster_name size = var.node_type node_count = var.node_count - labels = local.is_gpu ? { - "nvidia.com/gpu.deploy.operator-validator" = "false" - } : {} } } -resource "aws_ssm_parameter" "clusters" { - provider = aws.PROJECT_REGION - name = "/clusters/${var.cluster_name}" - description = "Cluster configuration for ${var.cluster_name}" - type = "String" - tier = "Advanced" - value = jsonencode({ - kubeconfig = civo_kubernetes_cluster.kubefirst.kubeconfig - client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-certificate-data) - client_key = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-key-data) - cluster_ca_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).clusters[0].cluster.certificate-authority-data) - host = civo_kubernetes_cluster.kubefirst.api_endpoint - cluster_name = var.cluster_name - argocd_manager_sa_token = kubernetes_secret_v1.argocd_manager.data.token - }) -} - provider "kubernetes" { host = civo_kubernetes_cluster.kubefirst.api_endpoint client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-certificate-data) @@ -115,21 +95,31 @@ resource "kubernetes_secret_v1" "argocd_manager" { depends_on = [kubernetes_service_account_v1.argocd_manager] } -resource "kubernetes_namespace_v1" "external_dns" { - metadata { - name = "external-dns" - } +provider "kubernetes" { + alias = "incluster" } -resource "kubernetes_namespace_v1" "external_secrets_operator" { +resource "kubernetes_secret_v1" "kubeconfig_secret" { + provider = kubernetes.incluster metadata { - name = "external-secrets-operator" + name = var.cluster_name + namespace = "argocd" + labels = { + "argocd.argoproj.io/secret-type" = "cluster" + } } -} -resource "kubernetes_namespace_v1" "environment" { - metadata { - name = var.cluster_name + data = { + name = var.cluster_name + server = civo_kubernetes_cluster.kubefirst.api_endpoint + config = jsonencode({ + bearerToken = kubernetes_secret_v1.argocd_manager.data["token"] + tlsClientConfig = { + insecure = false + caData = yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).clusters[0].cluster.certificate-authority-data + certData = yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-certificate-data + keyData = yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-key-data + } + }) } } - diff --git a/terraform/civo/modules/workload-cluster/variables.tf b/terraform/civo/modules/workload-cluster/variables.tf index bd67e3f..67564a1 100644 --- a/terraform/civo/modules/workload-cluster/variables.tf +++ b/terraform/civo/modules/workload-cluster/variables.tf @@ -18,7 +18,3 @@ variable "node_type" { type = string } -variable "is_gpu" { - type = bool - default = false -} From 9abe73533b1f17466175d146e36861681f1d8d33 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Sat, 21 Feb 2026 10:55:53 +0530 Subject: [PATCH 23/77] fix: add argocd ns --- terraform/civo/modules/project-cluster/main.tf | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/terraform/civo/modules/project-cluster/main.tf b/terraform/civo/modules/project-cluster/main.tf index 394ddb1..4f51bc0 100644 --- a/terraform/civo/modules/project-cluster/main.tf +++ b/terraform/civo/modules/project-cluster/main.tf @@ -203,7 +203,10 @@ resource "kubernetes_namespace_v1" "argocd" { resource "kubernetes_secret_v1" "argocd_git_credentials" { metadata { name = "repo-credentials-template-${var.project_name}" - namespace = kubernetes_namespace_v1.argocd.metadata.0.name + namespace = "argocd" + labels = { + "argocd.argoproj.io/secret-type" = "repository" + } } data = { From 23a917c8059b9ff3c1e4609c2d099de0c1606854 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Sat, 21 Feb 2026 21:06:48 +0530 Subject: [PATCH 24/77] fix: add crossplane secrets --- terraform/civo/modules/project-cluster/main.tf | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/terraform/civo/modules/project-cluster/main.tf b/terraform/civo/modules/project-cluster/main.tf index 4f51bc0..5eca004 100644 --- a/terraform/civo/modules/project-cluster/main.tf +++ b/terraform/civo/modules/project-cluster/main.tf @@ -157,22 +157,19 @@ resource "kubernetes_namespace_v1" "crossplane_system" { } } -data "vault_generic_secret" "crossplane" { - path = "secret/crossplane" # maps to key: /crossplane -} - resource "kubernetes_secret_v1" "crossplane_secrets" { metadata { name = "crossplane-secrets" namespace = kubernetes_namespace_v1.crossplane_system.metadata.0.name } - # Extract all key-value pairs from Vault into the secret - data = data.vault_generic_secret.crossplane.data + data = { + AWS_ACCESS_KEY_ID = data.civo_object_store_credential.backup.access_key_id + AWS_SECRET_ACCESS_KEY = data.civo_object_store_credential.backup.secret_access_key + } type = "Opaque" } - # ────────────────────────────────────────────── # 2. Git Credentials (templated creds file) # ────────────────────────────────────────────── From 8d60e99b33db373c894adb47c0fadac77c881c6d Mon Sep 17 00:00:00 2001 From: mrrishi Date: Mon, 23 Feb 2026 07:23:22 +0530 Subject: [PATCH 25/77] fix: add argocd ns --- terraform/civo/modules/project-cluster/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/terraform/civo/modules/project-cluster/main.tf b/terraform/civo/modules/project-cluster/main.tf index 5eca004..5a1bc16 100644 --- a/terraform/civo/modules/project-cluster/main.tf +++ b/terraform/civo/modules/project-cluster/main.tf @@ -200,7 +200,7 @@ resource "kubernetes_namespace_v1" "argocd" { resource "kubernetes_secret_v1" "argocd_git_credentials" { metadata { name = "repo-credentials-template-${var.project_name}" - namespace = "argocd" + namespace = kubernetes_namespace_v1.argocd.metadata.0.name labels = { "argocd.argoproj.io/secret-type" = "repository" } From abeeda31f11e16baca98ab455196f40b56c8654e Mon Sep 17 00:00:00 2001 From: mrrishi Date: Mon, 23 Feb 2026 12:48:53 +0530 Subject: [PATCH 26/77] fix: add argocd ns --- .../civo/project-cluster/templates/argocd/argocd-ui-ingress.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/templates/civo/project-cluster/templates/argocd/argocd-ui-ingress.yaml b/templates/civo/project-cluster/templates/argocd/argocd-ui-ingress.yaml index 0823ebd..40b49d5 100644 --- a/templates/civo/project-cluster/templates/argocd/argocd-ui-ingress.yaml +++ b/templates/civo/project-cluster/templates/argocd/argocd-ui-ingress.yaml @@ -6,6 +6,7 @@ metadata: annotations: nginx.ingress.kubernetes.io/force-ssl-redirect: "true" nginx.ingress.kubernetes.io/backend-protocol: "HTTP" + cert-manager.io/cluster-issuer: letsencrypt-prod {{- if .Values.certManagerIssuerAnnotation1 }} {{ .Values.certManagerIssuerAnnotation1 }} {{- end }} From 540b912bdbb97264b1ea0b4dab116dbde1b85665 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Sun, 1 Mar 2026 22:21:58 +0530 Subject: [PATCH 27/77] feat: use ghcr workflow --- templates/workflows/publish.yaml | 58 +++++++++++++++----------------- 1 file changed, 28 insertions(+), 30 deletions(-) diff --git a/templates/workflows/publish.yaml b/templates/workflows/publish.yaml index 6edfc7d..50641b3 100644 --- a/templates/workflows/publish.yaml +++ b/templates/workflows/publish.yaml @@ -1,4 +1,4 @@ -name: Publish image and helm chart to ECR +name: Publish image and helm chart to GHCR on: workflow_dispatch: push: @@ -6,12 +6,8 @@ on: - main permissions: - id-token: write contents: read - -env: - AWS_REGION: - ASSUME_ROLE_ARN: + packages: write jobs: publish: @@ -38,26 +34,26 @@ jobs: sudo mv linux-amd64/helm /usr/local/bin/helm helm version - - name: configure aws credentials - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 + - name: Login to GitHub Container Registry + uses: docker/login-action@v3 with: - role-to-assume: ${{ env.ASSUME_ROLE_ARN }} - aws-region: ${{ env.AWS_REGION }} - - - name: Login to Amazon ECR - id: login-ecr - uses: aws-actions/amazon-ecr-login@v2 + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} - - name: Build, tag, and push image to Amazon ECR + - name: Build, tag, and push image to GHCR env: - ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }} + REGISTRY: ghcr.io ECR_REPOSITORY: ${{ steps.extract-repo-name.outputs.repo_name }} REPO_OWNER: ${{ github.repository_owner }} SHORT_SHA: ${{ steps.get-sha.outputs.SHORT_SHA }} run: | - docker build -t $ECR_REGISTRY/$REPO_OWNER/$ECR_REPOSITORY:$SHORT_SHA . - docker push $ECR_REGISTRY/$REPO_OWNER/$ECR_REPOSITORY:$SHORT_SHA - echo "Pushed image: $ECR_REGISTRY/$REPO_OWNER/$ECR_REPOSITORY:$SHORT_SHA" + IMAGE="$REGISTRY/$REPO_OWNER/$ECR_REPOSITORY:$SHORT_SHA" + # GHCR requires lowercase image names + IMAGE=$(echo "$IMAGE" | tr '[:upper:]' '[:lower:]') + docker build -t "$IMAGE" . + docker push "$IMAGE" + echo "Pushed image: $IMAGE" - name: Update Chart.yaml env: @@ -66,35 +62,37 @@ jobs: SHORT_SHA: ${{ steps.get-sha.outputs.SHORT_SHA }} run: | cd charts/$REPO_OWNER/$ECR_REPOSITORY - + CURRENT_VERSION=$(grep '^version:' Chart.yaml | awk '{print $2}') BASE_VERSION=${CURRENT_VERSION%-rc.*} NEW_VERSION="${BASE_VERSION}-rc.${SHORT_SHA}" - + sed -i "s/^version: .*$/version: ${NEW_VERSION}/" Chart.yaml sed -i "s/^appVersion: .*$/appVersion: \"${SHORT_SHA}\"/" Chart.yaml - + echo "📝 Updated Chart.yaml:" grep -E '^(version|appVersion):' Chart.yaml - - name: push-chart-to-ecr + - name: Push chart to GHCR id: publish-chart env: - ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }} + REGISTRY: ghcr.io ECR_REPOSITORY: ${{ steps.extract-repo-name.outputs.repo_name }} REPO_OWNER: ${{ github.repository_owner }} SHORT_SHA: ${{ steps.get-sha.outputs.SHORT_SHA }} run: | cd charts/$REPO_OWNER/$ECR_REPOSITORY - + helm package . - + CHART_NAME=$(grep "^name:" Chart.yaml | awk '{print $2}') CHART_VERSION=$(grep "^version:" Chart.yaml | awk '{print $2}') CHART_ARCHIVE_FILE="${CHART_NAME}-${CHART_VERSION}.tgz" - - helm push "$CHART_ARCHIVE_FILE" "oci://$ECR_REGISTRY/$REPO_OWNER/charts" - + + # Helm OCI push to GHCR (must be lowercase) + OCI_REF="oci://$REGISTRY/$(echo $REPO_OWNER | tr '[:upper:]' '[:lower:]')/charts" + helm push "$CHART_ARCHIVE_FILE" "$OCI_REF" + echo "✅ Pushed chart: $CHART_ARCHIVE_FILE" echo "chart_version=$CHART_VERSION" >> $GITHUB_OUTPUT echo "chart_name=$CHART_NAME" >> $GITHUB_OUTPUT @@ -103,6 +101,6 @@ jobs: run: | echo "### 🚀 Deployment Summary" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY - echo "**Image**: \`${{ steps.login-ecr.outputs.registry }}/${{ github.repository_owner }}/${{ steps.extract-repo-name.outputs.repo_name }}:${{ steps.get-sha.outputs.SHORT_SHA }}\`" >> $GITHUB_STEP_SUMMARY + echo "**Image**: \`ghcr.io/${{ github.repository_owner }}/${{ steps.extract-repo-name.outputs.repo_name }}:${{ steps.get-sha.outputs.SHORT_SHA }}\`" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "**Chart**: \`${{ steps.publish-chart.outputs.chart_name }}:${{ steps.publish-chart.outputs.chart_version }}\`" >> $GITHUB_STEP_SUMMARY From ed1b03ac5d28c4d31b1562bbd967a97b0439b335 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Mon, 23 Mar 2026 20:21:34 +0530 Subject: [PATCH 28/77] fix: repo url helm template --- templates/civo/project-cluster/templates/30-clusterissuers.yaml | 2 +- .../templates/workloadcluster-environment-project.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/civo/project-cluster/templates/30-clusterissuers.yaml b/templates/civo/project-cluster/templates/30-clusterissuers.yaml index f25e25e..97980fd 100644 --- a/templates/civo/project-cluster/templates/30-clusterissuers.yaml +++ b/templates/civo/project-cluster/templates/30-clusterissuers.yaml @@ -10,7 +10,7 @@ metadata: spec: project: {{ .Values.workloadClusterName }} source: - repoURL: https://github.com/k1-civo/gitops.git + repoURL: {{ .Values.gitopsRepoUrl }} path: registry/clusters/{{ .Values.workloadClusterName }}/cert-issuers targetRevision: HEAD destination: diff --git a/templates/civo/workload-cluster/templates/workloadcluster-environment-project.yaml b/templates/civo/workload-cluster/templates/workloadcluster-environment-project.yaml index 6ad76d1..56ac444 100644 --- a/templates/civo/workload-cluster/templates/workloadcluster-environment-project.yaml +++ b/templates/civo/workload-cluster/templates/workloadcluster-environment-project.yaml @@ -10,7 +10,7 @@ metadata: spec: description: {{ .Values.workloadClusterName }} description sourceRepos: - - '{{ .Values.teamGitopsRepoUrl }}' + - '{{ .Values.gitopsRepoUrl }}' destinations: - name: in-cluster namespace: {{ .Values.workloadClusterName }}-environment From b556fa8ad3e2f18fe39adec62ac0db8b5a37986b Mon Sep 17 00:00:00 2001 From: mrrishi Date: Fri, 27 Mar 2026 18:08:29 +0530 Subject: [PATCH 29/77] feat: use github app --- .../crossplane-components/controllerconfig.yaml | 2 +- terraform/civo/modules/project-cluster/main.tf | 14 +++++++++----- 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/templates/civo/project-cluster/templates/crossplane-components/controllerconfig.yaml b/templates/civo/project-cluster/templates/crossplane-components/controllerconfig.yaml index a46fb1a..a26f4e1 100644 --- a/templates/civo/project-cluster/templates/crossplane-components/controllerconfig.yaml +++ b/templates/civo/project-cluster/templates/crossplane-components/controllerconfig.yaml @@ -25,7 +25,7 @@ spec: fsGroup: 65532 containers: - name: package-runtime - image: ghcr.io/konstructio/provider-terraform:v0.0.1 + image: ghcr.io/konstructio/provider-terraform:v0.0.1-rc.3 args: - -d - --poll=4m diff --git a/terraform/civo/modules/project-cluster/main.tf b/terraform/civo/modules/project-cluster/main.tf index 5a1bc16..2e44342 100644 --- a/terraform/civo/modules/project-cluster/main.tf +++ b/terraform/civo/modules/project-cluster/main.tf @@ -180,12 +180,16 @@ data "vault_generic_secret" "git_credentials" { resource "kubernetes_secret_v1" "git_credentials" { metadata { - name = "git-credentials" + name = "github-app-credentials" namespace = kubernetes_namespace_v1.crossplane_system.metadata.0.name } data = { - creds = "https://${data.vault_generic_secret.git_credentials.data["username"]}:${data.vault_generic_secret.git_credentials.data["password"]}@github.com" + type: data.vault_generic_secret.git_credentials.data["type"], + url: data.vault_generic_secret.git_credentials.data["url"], + app_id: data.vault_generic_secret.git_credentials.data["githubAppID"], + installation_id: data.vault_generic_secret.git_credentials.data["githubAppInstallationID"], + github_app_private_key: data.vault_generic_secret.git_credentials.data["githubAppPrivateKey"], } type = "Opaque" @@ -209,9 +213,9 @@ resource "kubernetes_secret_v1" "argocd_git_credentials" { data = { type: data.vault_generic_secret.git_credentials.data["type"], url: data.vault_generic_secret.git_credentials.data["url"], - username: data.vault_generic_secret.git_credentials.data["username"], - password: data.vault_generic_secret.git_credentials.data["password"], - name: data.vault_generic_secret.git_credentials.data["name"], + githubAppID: data.vault_generic_secret.git_credentials.data["githubAppID"], + githubAppInstallationID: data.vault_generic_secret.git_credentials.data["githubAppInstallationID"], + githubAppPrivateKey: data.vault_generic_secret.git_credentials.data["githubAppPrivateKey"], } type = "Opaque" From 385dafd059476c45284927a224b7bb0807cb659f Mon Sep 17 00:00:00 2001 From: mrrishi Date: Fri, 27 Mar 2026 22:13:48 +0530 Subject: [PATCH 30/77] fix: deploy --- templates/workflows/deploy.yaml | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/templates/workflows/deploy.yaml b/templates/workflows/deploy.yaml index 238552d..57a604a 100644 --- a/templates/workflows/deploy.yaml +++ b/templates/workflows/deploy.yaml @@ -8,7 +8,7 @@ on: required: true type: choice options: - - + - app_version: description: 'Application version to deploy' required: true @@ -24,10 +24,19 @@ jobs: trigger-update: runs-on: ubuntu-latest steps: + - name: Generate GitHub App token + id: app-token + uses: actions/create-github-app-token@v1 + with: + app-id: ${{ secrets.APP_ID }} + private-key: ${{ secrets.APP_PRIVATE_KEY }} + owner: + repositories: + - name: Trigger workflow uses: actions/github-script@v7 with: - github-token: ${{ secrets.WORKFLOW_TRIGGER_TOKEN }} + github-token: ${{ steps.app-token.outputs.token }} script: | await github.rest.actions.createWorkflowDispatch({ owner: '', @@ -44,7 +53,6 @@ jobs: }); console.log('✅ Triggered update workflow'); - # Stage 3: Notify notify: runs-on: ubuntu-latest needs: trigger-update From 01b930718ae9f31303bbf0b53e8799f2d939cb82 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Wed, 1 Apr 2026 15:53:55 +0530 Subject: [PATCH 31/77] fix: remove not required values --- templates/civo/project-cluster/values.yaml | 22 ++-------------------- 1 file changed, 2 insertions(+), 20 deletions(-) diff --git a/templates/civo/project-cluster/values.yaml b/templates/civo/project-cluster/values.yaml index d033e42..5d6a0d6 100644 --- a/templates/civo/project-cluster/values.yaml +++ b/templates/civo/project-cluster/values.yaml @@ -1,29 +1,11 @@ -# Terraform Module Configuration -# @input.type: string -# @input.description: the complete URL for the Terraform module for infrastructure provisioning -# @input.required: true -workloadClusterTerraformModuleUrl: "git::https://github.com/konstructio/gitops-template.git//terraform/civo/modules/workload-cluster?ref=main" +workloadClusterTerraformModuleUrl: "git::https://github.com/konstruct-saas/gitops.git//terraform/civo/modules/project-cluster?ref=main" # @input.type: string # @input.description: Alert email address for cert-manager notifications # @input.required: false email: 123@gmail.com -# @input.type: string -# @input.description: the Domain Name -# @input.required: false -domainName: kubefunk.net - -# External DNS Configuration -# @input.type: string -# @input.description: the DNS provider name for external-dns (e.g., cloudflare, aws, digitalocean) -# @input.required: false -externalDnsProviderName: cloudflare - -# @input.type: string -# @input.description: the environment variable name for the DNS provider token (e.g., CF_API_TOKEN) -# @input.required: false -externalDnsProviderTokenEnvName: CF_API_TOKEN +domainName: konstruct.io # Wait Job Configuration waitJobImage: "dtzar/helm-kubectl:3.19.0" From 3dd05f9eca5743ef3842086748a5f7f08c82c0bf Mon Sep 17 00:00:00 2001 From: mrrishi Date: Thu, 2 Apr 2026 14:28:03 +0530 Subject: [PATCH 32/77] feat: use token refresher --- .../argocd/github-token-refresher.yaml | 85 ++++++++++++++++++ .../github-token-refresher.yaml | 86 +++++++++++++++++++ templates/civo/project-cluster/values.yaml | 5 ++ .../civo/modules/project-cluster/main.tf | 59 ++++++------- .../civo/modules/project-cluster/variables.tf | 4 + 5 files changed, 206 insertions(+), 33 deletions(-) create mode 100644 templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml create mode 100644 templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml diff --git a/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml b/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml new file mode 100644 index 0000000..412451b --- /dev/null +++ b/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml @@ -0,0 +1,85 @@ +apiVersion: batch/v1 +kind: CronJob +metadata: + name: github-token-refresher + namespace: argocd +spec: + schedule: "*/45 * * * *" + jobTemplate: + spec: + template: + spec: + serviceAccountName: github-token-refresher + containers: + - name: refresher + image: {{ .Values.waitJobImage }} + env: + - name: VENDING_URL + value: "https://{{ .Values.domain }}/api/v1/token" + - name: TOKEN + valueFrom: + secretKeyRef: + name: platform-cluster-identity + key: token + - name: ORG_ID + valueFrom: + secretKeyRef: + name: platform-cluster-identity + key: org_id + command: + - /bin/bash + - -c + - | + set -e + + echo "Requesting GitHub installation token..." + RESPONSE=$(curl -sf \ + -X POST "${VENDING_URL}" \ + -H "Authorization: Bearer ${TOKEN}" \ + -H "Content-Type: application/json" \ + -d "{\"orgId\": \"${ORG_ID}\"}") + + if [ -z "$RESPONSE" ]; then + echo "Error: empty response from vending service" + exit 1 + fi + + echo "Patching argocd repo secret..." + ENCODED=$(echo -n "$RESPONSE" | base64 | tr -d '\n') + kubectl patch secret github-repo-creds -n argocd \ + --type='json' \ + -p="[{\"op\": \"replace\", \"path\": \"/data/password\", \"value\": \"${ENCODED}\"}]" + + echo "Done." + restartPolicy: OnFailure +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: github-token-refresher + namespace: argocd +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: github-token-refresher + namespace: argocd +rules: +- apiGroups: [""] + resources: ["secrets"] + resourceNames: ["github-repo-creds"] + verbs: ["get", "patch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: github-token-refresher + namespace: argocd +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: github-token-refresher +subjects: +- kind: ServiceAccount + name: github-token-refresher + namespace: argocd diff --git a/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml b/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml new file mode 100644 index 0000000..91641fb --- /dev/null +++ b/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml @@ -0,0 +1,86 @@ +apiVersion: batch/v1 +kind: CronJob +metadata: + name: github-token-refresher + namespace: crossplane-system +spec: + schedule: "*/45 * * * *" + jobTemplate: + spec: + template: + spec: + serviceAccountName: github-token-refresher + containers: + - name: refresher + image: bitnami/kubectl:latest + env: + - name: VENDING_URL + value: "https://{{ .Values.domain }}/api/v1/token" + - name: TOKEN + valueFrom: + secretKeyRef: + name: platform-cluster-identity + key: token + - name: ORG_ID + valueFrom: + secretKeyRef: + name: platform-cluster-identity + key: org_id + command: + - /bin/bash + - -c + - | + set -e + + echo "Requesting GitHub installation token..." + RESPONSE=$(curl -sf \ + -X POST "${VENDING_URL}" \ + -H "Authorization: Bearer ${TOKEN}" \ + -H "Content-Type: application/json" \ + -d "{\"orgId\": \"${ORG_ID}\"}") + + if [ -z "$RESPONSE" ]; then + echo "Error: empty response from vending service" + exit 1 + fi + + echo "Patching crossplane git-credentials secret..." + CREDS="https://x-access-token:${RESPONSE}@github.com" + ENCODED=$(echo -n "$CREDS" | base64 | tr -d '\n') + kubectl patch secret git-credentials -n crossplane-system \ + --type='json' \ + -p="[{\"op\": \"replace\", \"path\": \"/data/creds\", \"value\": \"${ENCODED}\"}]" + + echo "Done." + restartPolicy: OnFailure +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: github-token-refresher + namespace: crossplane-system +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: github-token-refresher + namespace: crossplane-system +rules: +- apiGroups: [""] + resources: ["secrets"] + resourceNames: ["git-credentials"] + verbs: ["get", "patch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: github-token-refresher + namespace: crossplane-system +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: github-token-refresher +subjects: +- kind: ServiceAccount + name: github-token-refresher + namespace: crossplane-system diff --git a/templates/civo/project-cluster/values.yaml b/templates/civo/project-cluster/values.yaml index 5d6a0d6..b02510c 100644 --- a/templates/civo/project-cluster/values.yaml +++ b/templates/civo/project-cluster/values.yaml @@ -9,3 +9,8 @@ domainName: konstruct.io # Wait Job Configuration waitJobImage: "dtzar/helm-kubectl:3.19.0" + +# @input.type: string +# @input.description: Domain for the Argocd +# @input.required: false +domain: saas.konstruct.io diff --git a/terraform/civo/modules/project-cluster/main.tf b/terraform/civo/modules/project-cluster/main.tf index 2e44342..57e7418 100644 --- a/terraform/civo/modules/project-cluster/main.tf +++ b/terraform/civo/modules/project-cluster/main.tf @@ -170,53 +170,46 @@ resource "kubernetes_secret_v1" "crossplane_secrets" { type = "Opaque" } -# ────────────────────────────────────────────── -# 2. Git Credentials (templated creds file) -# ────────────────────────────────────────────── -data "vault_generic_secret" "git_credentials" { - path = "secret/argocd/repo-credentials-template/${var.project_name}" +resource "random_password" "cluster_token" { + length = 32 + special = false +} + +provider "kubernetes" { + alias = "incluster" } -resource "kubernetes_secret_v1" "git_credentials" { +resource "kubernetes_secret" "preshared_token_mgmt" { + provider = kubernetes.incluster metadata { - name = "github-app-credentials" - namespace = kubernetes_namespace_v1.crossplane_system.metadata.0.name + name = "pre-shared-token" + namespace = var.org_id } - data = { - type: data.vault_generic_secret.git_credentials.data["type"], - url: data.vault_generic_secret.git_credentials.data["url"], - app_id: data.vault_generic_secret.git_credentials.data["githubAppID"], - installation_id: data.vault_generic_secret.git_credentials.data["githubAppInstallationID"], - github_app_private_key: data.vault_generic_secret.git_credentials.data["githubAppPrivateKey"], + token = random_password.cluster_token.result } - - type = "Opaque" } - -resource "kubernetes_namespace_v1" "argocd" { +resource "kubernetes_secret" "preshared_token_argocd" { + depends_on = [civo_kubernetes_cluster.project-cluster] metadata { - name = "argocd" + name = "platform-cluster-identity" + namespace = "argocd" + } + data = { + token = random_password.cluster_token.result + org_id = var.org_id } } -resource "kubernetes_secret_v1" "argocd_git_credentials" { +resource "kubernetes_secret" "preshared_token_crossplane" { + depends_on = [civo_kubernetes_cluster.project-cluster] metadata { - name = "repo-credentials-template-${var.project_name}" - namespace = kubernetes_namespace_v1.argocd.metadata.0.name - labels = { - "argocd.argoproj.io/secret-type" = "repository" - } + name = "platform-cluster-identity" + namespace = "crossplane-system" } - data = { - type: data.vault_generic_secret.git_credentials.data["type"], - url: data.vault_generic_secret.git_credentials.data["url"], - githubAppID: data.vault_generic_secret.git_credentials.data["githubAppID"], - githubAppInstallationID: data.vault_generic_secret.git_credentials.data["githubAppInstallationID"], - githubAppPrivateKey: data.vault_generic_secret.git_credentials.data["githubAppPrivateKey"], + token = random_password.cluster_token.result + org_id = var.org_id } - - type = "Opaque" } diff --git a/terraform/civo/modules/project-cluster/variables.tf b/terraform/civo/modules/project-cluster/variables.tf index 924dc95..ed00256 100644 --- a/terraform/civo/modules/project-cluster/variables.tf +++ b/terraform/civo/modules/project-cluster/variables.tf @@ -17,3 +17,7 @@ variable "node_type" { variable "project_name" { type = string } + +variable "org_id" { + type = string +} From f9a77c50f6d24d0e629e3c0cc591bfae7d3eaa30 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Thu, 2 Apr 2026 14:31:34 +0530 Subject: [PATCH 33/77] feat: use token refresher --- .../project-cluster/templates/infrastructure/workspace.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/templates/civo/project-cluster/templates/infrastructure/workspace.yaml b/templates/civo/project-cluster/templates/infrastructure/workspace.yaml index bc90aa5..f043c1b 100644 --- a/templates/civo/project-cluster/templates/infrastructure/workspace.yaml +++ b/templates/civo/project-cluster/templates/infrastructure/workspace.yaml @@ -20,3 +20,5 @@ spec: value: "{{ .Values.workloadNodeType }}" - key: project_name value: "{{ .Values.workloadClusterProjectName }}" + - key: org_id + value: "{{ .Values.workloadClusterOrgId }}" From 60063089e5605e40ea19832942886f599225d39a Mon Sep 17 00:00:00 2001 From: mrrishi Date: Thu, 2 Apr 2026 14:33:34 +0530 Subject: [PATCH 34/77] feat: use token refresher --- .../templates/crossplane-components/controllerconfig.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/civo/project-cluster/templates/crossplane-components/controllerconfig.yaml b/templates/civo/project-cluster/templates/crossplane-components/controllerconfig.yaml index a26f4e1..a46fb1a 100644 --- a/templates/civo/project-cluster/templates/crossplane-components/controllerconfig.yaml +++ b/templates/civo/project-cluster/templates/crossplane-components/controllerconfig.yaml @@ -25,7 +25,7 @@ spec: fsGroup: 65532 containers: - name: package-runtime - image: ghcr.io/konstructio/provider-terraform:v0.0.1-rc.3 + image: ghcr.io/konstructio/provider-terraform:v0.0.1 args: - -d - --poll=4m From 76b20b1c89827650402d163a5747eda92fa32b3c Mon Sep 17 00:00:00 2001 From: mrrishi Date: Thu, 2 Apr 2026 20:00:18 +0530 Subject: [PATCH 35/77] feat: use token refresher --- terraform/civo/modules/project-cluster/main.tf | 6 +++--- terraform/civo/modules/project-cluster/variables.tf | 4 ---- 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/terraform/civo/modules/project-cluster/main.tf b/terraform/civo/modules/project-cluster/main.tf index 57e7418..97f92a4 100644 --- a/terraform/civo/modules/project-cluster/main.tf +++ b/terraform/civo/modules/project-cluster/main.tf @@ -184,7 +184,7 @@ resource "kubernetes_secret" "preshared_token_mgmt" { provider = kubernetes.incluster metadata { name = "pre-shared-token" - namespace = var.org_id + namespace = var.project_name } data = { token = random_password.cluster_token.result @@ -198,7 +198,7 @@ resource "kubernetes_secret" "preshared_token_argocd" { } data = { token = random_password.cluster_token.result - org_id = var.org_id + org_id = var.project_name } } @@ -210,6 +210,6 @@ resource "kubernetes_secret" "preshared_token_crossplane" { } data = { token = random_password.cluster_token.result - org_id = var.org_id + org_id = var.project_name } } diff --git a/terraform/civo/modules/project-cluster/variables.tf b/terraform/civo/modules/project-cluster/variables.tf index ed00256..924dc95 100644 --- a/terraform/civo/modules/project-cluster/variables.tf +++ b/terraform/civo/modules/project-cluster/variables.tf @@ -17,7 +17,3 @@ variable "node_type" { variable "project_name" { type = string } - -variable "org_id" { - type = string -} From 227e788b54fe775ae4f1f217a765642a820d0452 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Thu, 2 Apr 2026 20:18:28 +0530 Subject: [PATCH 36/77] feat: use token refresher --- .../templates/argocd/github-token-refresher.yaml | 16 +++++++++++----- .../github-token-refresher.yaml | 15 +++++++++------ 2 files changed, 20 insertions(+), 11 deletions(-) diff --git a/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml b/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml index 412451b..5f1e4d1 100644 --- a/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml +++ b/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml @@ -31,7 +31,6 @@ spec: - -c - | set -e - echo "Requesting GitHub installation token..." RESPONSE=$(curl -sf \ -X POST "${VENDING_URL}" \ @@ -44,11 +43,18 @@ spec: exit 1 fi - echo "Patching argocd repo secret..." ENCODED=$(echo -n "$RESPONSE" | base64 | tr -d '\n') - kubectl patch secret github-repo-creds -n argocd \ - --type='json' \ - -p="[{\"op\": \"replace\", \"path\": \"/data/password\", \"value\": \"${ENCODED}\"}]" + + if kubectl get secret github-repo-creds -n argocd &>/dev/null; then + echo "Secret exists, patching..." + kubectl patch secret github-repo-creds -n argocd \ + --type='json' \ + -p="[{\"op\": \"replace\", \"path\": \"/data/password\", \"value\": \"${ENCODED}\"}]" + else + echo "Secret not found, creating..." + kubectl create secret generic github-repo-creds -n argocd \ + --from-literal=password="${RESPONSE}" + fi echo "Done." restartPolicy: OnFailure diff --git a/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml b/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml index 91641fb..ff53c58 100644 --- a/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml +++ b/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml @@ -44,14 +44,17 @@ spec: exit 1 fi - echo "Patching crossplane git-credentials secret..." CREDS="https://x-access-token:${RESPONSE}@github.com" - ENCODED=$(echo -n "$CREDS" | base64 | tr -d '\n') - kubectl patch secret git-credentials -n crossplane-system \ - --type='json' \ - -p="[{\"op\": \"replace\", \"path\": \"/data/creds\", \"value\": \"${ENCODED}\"}]" - echo "Done." + if kubectl get secret git-credentials -n crossplane-system &>/dev/null; then + ENCODED=$(echo -n "$CREDS" | base64 | tr -d '\n') + kubectl patch secret git-credentials -n crossplane-system \ + --type='json' \ + -p="[{\"op\": \"replace\", \"path\": \"/data/creds\", \"value\": \"${ENCODED}\"}]" + else + kubectl create secret generic git-credentials -n crossplane-system \ + --from-literal=creds="${CREDS}" + fi restartPolicy: OnFailure --- apiVersion: v1 From 8d98d1e1eb2b0824a229af2a83e9477d8c5ceaaa Mon Sep 17 00:00:00 2001 From: mrrishi Date: Thu, 2 Apr 2026 20:27:15 +0530 Subject: [PATCH 37/77] feat: use token refresher --- .../templates/crossplane-components/github-token-refresher.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml b/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml index ff53c58..3a317a5 100644 --- a/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml +++ b/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml @@ -12,7 +12,7 @@ spec: serviceAccountName: github-token-refresher containers: - name: refresher - image: bitnami/kubectl:latest + image: {{ .Values.waitJobImage }} env: - name: VENDING_URL value: "https://{{ .Values.domain }}/api/v1/token" From 46cc74e570903e86836190150331630fc099782c Mon Sep 17 00:00:00 2001 From: mrrishi Date: Thu, 2 Apr 2026 20:31:28 +0530 Subject: [PATCH 38/77] feat: use token refresher --- terraform/civo/modules/project-cluster/main.tf | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/terraform/civo/modules/project-cluster/main.tf b/terraform/civo/modules/project-cluster/main.tf index 97f92a4..056c1d1 100644 --- a/terraform/civo/modules/project-cluster/main.tf +++ b/terraform/civo/modules/project-cluster/main.tf @@ -190,11 +190,24 @@ resource "kubernetes_secret" "preshared_token_mgmt" { token = random_password.cluster_token.result } } + +resource "kubernetes_namespace_v1" "argocd" { + metadata { + name = "argocd" + } +} + +resource "kubernetes_namespace_v1" "crossplane_system" { + metadata { + name = "crossplane-system" + } +} + resource "kubernetes_secret" "preshared_token_argocd" { depends_on = [civo_kubernetes_cluster.project-cluster] metadata { name = "platform-cluster-identity" - namespace = "argocd" + namespace = kubernetes_namespace_v1.argocd.metadata.0.name } data = { token = random_password.cluster_token.result @@ -206,7 +219,7 @@ resource "kubernetes_secret" "preshared_token_crossplane" { depends_on = [civo_kubernetes_cluster.project-cluster] metadata { name = "platform-cluster-identity" - namespace = "crossplane-system" + namespace = kubernetes_namespace_v1.crossplane_system.metadata.0.name } data = { token = random_password.cluster_token.result From bfe39d6459e88ae1a4a61f055de8f1246f8e0c09 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Thu, 2 Apr 2026 20:43:26 +0530 Subject: [PATCH 39/77] feat: use token refresher --- terraform/civo/modules/project-cluster/main.tf | 6 ------ 1 file changed, 6 deletions(-) diff --git a/terraform/civo/modules/project-cluster/main.tf b/terraform/civo/modules/project-cluster/main.tf index 056c1d1..73bf63a 100644 --- a/terraform/civo/modules/project-cluster/main.tf +++ b/terraform/civo/modules/project-cluster/main.tf @@ -197,12 +197,6 @@ resource "kubernetes_namespace_v1" "argocd" { } } -resource "kubernetes_namespace_v1" "crossplane_system" { - metadata { - name = "crossplane-system" - } -} - resource "kubernetes_secret" "preshared_token_argocd" { depends_on = [civo_kubernetes_cluster.project-cluster] metadata { From 7112e74c69292c7b29e9e63c7e6bc5fa43f96441 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Thu, 2 Apr 2026 21:46:37 +0530 Subject: [PATCH 40/77] feat: use token refresher --- .../argocd/github-token-refresher.yaml | 67 +++++++++++++++++- .../github-token-refresher.yaml | 68 ++++++++++++++++++- 2 files changed, 131 insertions(+), 4 deletions(-) diff --git a/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml b/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml index 5f1e4d1..b46d344 100644 --- a/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml +++ b/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml @@ -33,10 +33,9 @@ spec: set -e echo "Requesting GitHub installation token..." RESPONSE=$(curl -sf \ - -X POST "${VENDING_URL}" \ + -X GET "${VENDING_URL}/${ORG_ID}" \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json" \ - -d "{\"orgId\": \"${ORG_ID}\"}") if [ -z "$RESPONSE" ]; then echo "Error: empty response from vending service" @@ -75,6 +74,9 @@ rules: resources: ["secrets"] resourceNames: ["github-repo-creds"] verbs: ["get", "patch"] +- apiGroups: [""] + resources: ["secrets"] + verbs: ["create"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -89,3 +91,64 @@ subjects: - kind: ServiceAccount name: github-token-refresher namespace: argocd +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: github-token-refresher-init + namespace: argocd + annotations: + helm.sh/hook: post-install,post-upgrade + helm.sh/hook-delete-policy: hook-succeeded +spec: + template: + spec: + serviceAccountName: github-token-refresher + containers: + - name: refresher + image: {{ .Values.waitJobImage }} + env: + - name: VENDING_URL + value: "https://{{ .Values.domain }}/api/v1/token" + - name: TOKEN + valueFrom: + secretKeyRef: + name: platform-cluster-identity + key: token + - name: ORG_ID + valueFrom: + secretKeyRef: + name: platform-cluster-identity + key: org_id + command: + - /bin/bash + - -c + - | + set -e + + echo "Requesting GitHub installation token..." + RESPONSE=$(curl -sf \ + -X GET "${VENDING_URL}/${ORG_ID}" \ + -H "Authorization: Bearer ${TOKEN}" \ + -H "Content-Type: application/json" \ + + if [ -z "$RESPONSE" ]; then + echo "Error: empty response from vending service" + exit 1 + fi + + ENCODED=$(echo -n "$RESPONSE" | base64 | tr -d '\n') + + if kubectl get secret github-repo-creds -n argocd &>/dev/null; then + echo "Secret exists, patching..." + kubectl patch secret github-repo-creds -n argocd \ + --type='json' \ + -p="[{\"op\": \"replace\", \"path\": \"/data/password\", \"value\": \"${ENCODED}\"}]" + else + echo "Secret not found, creating..." + kubectl create secret generic github-repo-creds -n argocd \ + --from-literal=password="${RESPONSE}" + fi + + echo "Done." + restartPolicy: OnFailure diff --git a/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml b/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml index 3a317a5..f8a6965 100644 --- a/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml +++ b/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml @@ -34,10 +34,9 @@ spec: echo "Requesting GitHub installation token..." RESPONSE=$(curl -sf \ - -X POST "${VENDING_URL}" \ + -X GET "${VENDING_URL}/${ORG_ID}" \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json" \ - -d "{\"orgId\": \"${ORG_ID}\"}") if [ -z "$RESPONSE" ]; then echo "Error: empty response from vending service" @@ -73,6 +72,9 @@ rules: resources: ["secrets"] resourceNames: ["git-credentials"] verbs: ["get", "patch"] +- apiGroups: [""] + resources: ["secrets"] + verbs: ["create"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -87,3 +89,65 @@ subjects: - kind: ServiceAccount name: github-token-refresher namespace: crossplane-system +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: github-token-refresher-init + namespace: crossplane-system + annotations: + helm.sh/hook: post-install,post-upgrade + helm.sh/hook-delete-policy: hook-succeeded +spec: + template: + spec: + serviceAccountName: github-token-refresher + containers: + - name: refresher + image: {{ .Values.waitJobImage }} + env: + - name: VENDING_URL + value: "https://{{ .Values.domain }}/api/v1/token" + - name: TOKEN + valueFrom: + secretKeyRef: + name: platform-cluster-identity + key: token + - name: ORG_ID + valueFrom: + secretKeyRef: + name: platform-cluster-identity + key: org_id + command: + - /bin/bash + - -c + - | + set -e + + echo "Requesting GitHub installation token..." + RESPONSE=$(curl -sf \ + -X GET "${VENDING_URL}/${ORG_ID}" \ + -H "Authorization: Bearer ${TOKEN}" \ + -H "Content-Type: application/json" \ + + if [ -z "$RESPONSE" ]; then + echo "Error: empty response from vending service" + exit 1 + fi + + CREDS="https://x-access-token:${RESPONSE}@github.com" + + if kubectl get secret git-credentials -n crossplane-system &>/dev/null; then + echo "Secret exists, patching..." + ENCODED=$(echo -n "$CREDS" | base64 | tr -d '\n') + kubectl patch secret git-credentials -n crossplane-system \ + --type='json' \ + -p="[{\"op\": \"replace\", \"path\": \"/data/creds\", \"value\": \"${ENCODED}\"}]" + else + echo "Secret not found, creating..." + kubectl create secret generic git-credentials -n crossplane-system \ + --from-literal=creds="${CREDS}" + fi + + echo "Done." + restartPolicy: OnFailure From b4ff14c48b3ff7c00b1a0643e79215dfc16ca973 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Thu, 2 Apr 2026 22:04:34 +0530 Subject: [PATCH 41/77] feat: use token refresher --- .../templates/argocd/github-token-refresher.yaml | 4 ++-- .../crossplane-components/github-token-refresher.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml b/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml index b46d344..d74c908 100644 --- a/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml +++ b/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml @@ -35,7 +35,7 @@ spec: RESPONSE=$(curl -sf \ -X GET "${VENDING_URL}/${ORG_ID}" \ -H "Authorization: Bearer ${TOKEN}" \ - -H "Content-Type: application/json" \ + -H "Content-Type: application/json") if [ -z "$RESPONSE" ]; then echo "Error: empty response from vending service" @@ -130,7 +130,7 @@ spec: RESPONSE=$(curl -sf \ -X GET "${VENDING_URL}/${ORG_ID}" \ -H "Authorization: Bearer ${TOKEN}" \ - -H "Content-Type: application/json" \ + -H "Content-Type: application/json") if [ -z "$RESPONSE" ]; then echo "Error: empty response from vending service" diff --git a/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml b/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml index f8a6965..257973c 100644 --- a/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml +++ b/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml @@ -36,7 +36,7 @@ spec: RESPONSE=$(curl -sf \ -X GET "${VENDING_URL}/${ORG_ID}" \ -H "Authorization: Bearer ${TOKEN}" \ - -H "Content-Type: application/json" \ + -H "Content-Type: application/json") if [ -z "$RESPONSE" ]; then echo "Error: empty response from vending service" @@ -128,7 +128,7 @@ spec: RESPONSE=$(curl -sf \ -X GET "${VENDING_URL}/${ORG_ID}" \ -H "Authorization: Bearer ${TOKEN}" \ - -H "Content-Type: application/json" \ + -H "Content-Type: application/json") if [ -z "$RESPONSE" ]; then echo "Error: empty response from vending service" From b90e3e790cfaee86857feef096df1976f29d3ba8 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Thu, 2 Apr 2026 22:19:21 +0530 Subject: [PATCH 42/77] feat: use token refresher --- .../argocd/github-token-refresher.yaml | 51 +++++++++-- .../github-token-refresher.yaml | 90 +++++++++++++------ 2 files changed, 103 insertions(+), 38 deletions(-) diff --git a/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml b/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml index d74c908..c5b7d0d 100644 --- a/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml +++ b/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml @@ -15,7 +15,7 @@ spec: image: {{ .Values.waitJobImage }} env: - name: VENDING_URL - value: "https://{{ .Values.domain }}/api/v1/token" + value: "https://{{ .Values.domain }}/api/v1/github-token" - name: TOKEN valueFrom: secretKeyRef: @@ -31,17 +31,32 @@ spec: - -c - | set -e - echo "Requesting GitHub installation token..." - RESPONSE=$(curl -sf \ + + echo "=== ENV CHECK ===" + echo "VENDING_URL: ${VENDING_URL}" + echo "ORG_ID: ${ORG_ID}" + echo "TOKEN length: ${#TOKEN}" + + echo "=== REQUESTING TOKEN ===" + HTTP_CODE=$(curl -s -o /tmp/response.txt -w "%{http_code}" \ -X GET "${VENDING_URL}/${ORG_ID}" \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json") + echo "HTTP status: ${HTTP_CODE}" + + if [ "$HTTP_CODE" != "200" ]; then + echo "Error: non-200 response from vending service" + exit 1 + fi + + RESPONSE=$(cat /tmp/response.txt) if [ -z "$RESPONSE" ]; then - echo "Error: empty response from vending service" + echo "Error: empty response body" exit 1 fi + echo "=== PATCHING SECRET ===" ENCODED=$(echo -n "$RESPONSE" | base64 | tr -d '\n') if kubectl get secret github-repo-creds -n argocd &>/dev/null; then @@ -49,10 +64,12 @@ spec: kubectl patch secret github-repo-creds -n argocd \ --type='json' \ -p="[{\"op\": \"replace\", \"path\": \"/data/password\", \"value\": \"${ENCODED}\"}]" + echo "Secret patched successfully." else echo "Secret not found, creating..." kubectl create secret generic github-repo-creds -n argocd \ --from-literal=password="${RESPONSE}" + echo "Secret created successfully." fi echo "Done." @@ -76,7 +93,7 @@ rules: verbs: ["get", "patch"] - apiGroups: [""] resources: ["secrets"] - verbs: ["create"] + verbs: ["create"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -109,7 +126,7 @@ spec: image: {{ .Values.waitJobImage }} env: - name: VENDING_URL - value: "https://{{ .Values.domain }}/api/v1/token" + value: "https://{{ .Values.domain }}/api/v1/github-token" - name: TOKEN valueFrom: secretKeyRef: @@ -126,17 +143,31 @@ spec: - | set -e - echo "Requesting GitHub installation token..." - RESPONSE=$(curl -sf \ + echo "=== ENV CHECK ===" + echo "VENDING_URL: ${VENDING_URL}" + echo "ORG_ID: ${ORG_ID}" + echo "TOKEN length: ${#TOKEN}" + + echo "=== REQUESTING TOKEN ===" + HTTP_CODE=$(curl -s -o /tmp/response.txt -w "%{http_code}" \ -X GET "${VENDING_URL}/${ORG_ID}" \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json") + echo "HTTP status: ${HTTP_CODE}" + + if [ "$HTTP_CODE" != "200" ]; then + echo "Error: non-200 response from vending service" + exit 1 + fi + + RESPONSE=$(cat /tmp/response.txt) if [ -z "$RESPONSE" ]; then - echo "Error: empty response from vending service" + echo "Error: empty response body" exit 1 fi + echo "=== PATCHING SECRET ===" ENCODED=$(echo -n "$RESPONSE" | base64 | tr -d '\n') if kubectl get secret github-repo-creds -n argocd &>/dev/null; then @@ -144,10 +175,12 @@ spec: kubectl patch secret github-repo-creds -n argocd \ --type='json' \ -p="[{\"op\": \"replace\", \"path\": \"/data/password\", \"value\": \"${ENCODED}\"}]" + echo "Secret patched successfully." else echo "Secret not found, creating..." kubectl create secret generic github-repo-creds -n argocd \ --from-literal=password="${RESPONSE}" + echo "Secret created successfully." fi echo "Done." diff --git a/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml b/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml index 257973c..5a70cb6 100644 --- a/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml +++ b/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml @@ -15,7 +15,7 @@ spec: image: {{ .Values.waitJobImage }} env: - name: VENDING_URL - value: "https://{{ .Values.domain }}/api/v1/token" + value: "https://{{ .Values.domain }}/api/v1/github-token" - name: TOKEN valueFrom: secretKeyRef: @@ -32,50 +32,48 @@ spec: - | set -e - echo "Requesting GitHub installation token..." - RESPONSE=$(curl -sf \ + echo "=== ENV CHECK ===" + echo "VENDING_URL: ${VENDING_URL}" + echo "ORG_ID: ${ORG_ID}" + echo "TOKEN length: ${#TOKEN}" + + echo "=== REQUESTING TOKEN ===" + HTTP_CODE=$(curl -s -o /tmp/response.txt -w "%{http_code}" \ -X GET "${VENDING_URL}/${ORG_ID}" \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json") + echo "HTTP status: ${HTTP_CODE}" + + if [ "$HTTP_CODE" != "200" ]; then + echo "Error: non-200 response from vending service" + exit 1 + fi + + RESPONSE=$(cat /tmp/response.txt) if [ -z "$RESPONSE" ]; then - echo "Error: empty response from vending service" + echo "Error: empty response body" exit 1 fi + echo "=== PATCHING SECRET ===" CREDS="https://x-access-token:${RESPONSE}@github.com" if kubectl get secret git-credentials -n crossplane-system &>/dev/null; then + echo "Secret exists, patching..." ENCODED=$(echo -n "$CREDS" | base64 | tr -d '\n') kubectl patch secret git-credentials -n crossplane-system \ --type='json' \ -p="[{\"op\": \"replace\", \"path\": \"/data/creds\", \"value\": \"${ENCODED}\"}]" else + echo "Secret not found, creating..." kubectl create secret generic git-credentials -n crossplane-system \ --from-literal=creds="${CREDS}" fi + + echo "Done." restartPolicy: OnFailure --- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: github-token-refresher - namespace: crossplane-system ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: github-token-refresher - namespace: crossplane-system -rules: -- apiGroups: [""] - resources: ["secrets"] - resourceNames: ["git-credentials"] - verbs: ["get", "patch"] -- apiGroups: [""] - resources: ["secrets"] - verbs: ["create"] ---- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: @@ -104,10 +102,10 @@ spec: serviceAccountName: github-token-refresher containers: - name: refresher - image: {{ .Values.waitJobImage }} + image: {{ .Values.waitJobImage}} env: - name: VENDING_URL - value: "https://{{ .Values.domain }}/api/v1/token" + value: "https://{{ .Values.domain }}/api/v1/github-token" - name: TOKEN valueFrom: secretKeyRef: @@ -124,17 +122,31 @@ spec: - | set -e - echo "Requesting GitHub installation token..." - RESPONSE=$(curl -sf \ + echo "=== ENV CHECK ===" + echo "VENDING_URL: ${VENDING_URL}" + echo "ORG_ID: ${ORG_ID}" + echo "TOKEN length: ${#TOKEN}" + + echo "=== REQUESTING TOKEN ===" + HTTP_CODE=$(curl -s -o /tmp/response.txt -w "%{http_code}" \ -X GET "${VENDING_URL}/${ORG_ID}" \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json") + echo "HTTP status: ${HTTP_CODE}" + + if [ "$HTTP_CODE" != "200" ]; then + echo "Error: non-200 response from vending service" + exit 1 + fi + + RESPONSE=$(cat /tmp/response.txt) if [ -z "$RESPONSE" ]; then - echo "Error: empty response from vending service" + echo "Error: empty response body" exit 1 fi + echo "=== PATCHING SECRET ===" CREDS="https://x-access-token:${RESPONSE}@github.com" if kubectl get secret git-credentials -n crossplane-system &>/dev/null; then @@ -151,3 +163,23 @@ spec: echo "Done." restartPolicy: OnFailure +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: github-token-refresher + namespace: crossplane-system +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: github-token-refresher + namespace: crossplane-system +rules: +- apiGroups: [""] + resources: ["secrets"] + resourceNames: ["git-credentials"] + verbs: ["get", "patch"] +- apiGroups: [""] + resources: ["secrets"] + verbs: ["create"] From c30b5449419bc010a242ad4dac9f81851ad567a1 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Thu, 2 Apr 2026 22:21:45 +0530 Subject: [PATCH 43/77] feat: use token refresher --- .../civo/project-cluster/templates/argocd/kustomization.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/templates/civo/project-cluster/templates/argocd/kustomization.yaml b/templates/civo/project-cluster/templates/argocd/kustomization.yaml index 4066abf..41f7638 100644 --- a/templates/civo/project-cluster/templates/argocd/kustomization.yaml +++ b/templates/civo/project-cluster/templates/argocd/kustomization.yaml @@ -9,7 +9,8 @@ resources: - argocd-ui-ingress.yaml - application.yaml - rbac.yaml - + - github-token-refresher.yaml + patchesStrategicMerge: - argocd-cmd-params-cm.yaml - argocd-server-sa.yaml From bd4fc4aca04bd02eba37a7f823c1e425cfc45d7e Mon Sep 17 00:00:00 2001 From: mrrishi Date: Sat, 4 Apr 2026 07:15:48 +0530 Subject: [PATCH 44/77] fix: pc terraform module --- templates/civo/project-cluster/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/civo/project-cluster/values.yaml b/templates/civo/project-cluster/values.yaml index b02510c..d746226 100644 --- a/templates/civo/project-cluster/values.yaml +++ b/templates/civo/project-cluster/values.yaml @@ -1,4 +1,4 @@ -workloadClusterTerraformModuleUrl: "git::https://github.com/konstruct-saas/gitops.git//terraform/civo/modules/project-cluster?ref=main" +workloadClusterTerraformModuleUrl: "git::https://github.com/konstructio/konstruct-templates.git//terraform/civo/modules/project-cluster?ref=main" # @input.type: string # @input.description: Alert email address for cert-manager notifications From e4b73ab6d574077f0f0f37e8134debbe20d37ddf Mon Sep 17 00:00:00 2001 From: mrrishi Date: Sun, 12 Apr 2026 22:56:28 +0530 Subject: [PATCH 45/77] feat: migrate to gateway api --- .../templates/20-argocd-connection.yaml | 2 +- .../templates/30-cert-manager.yaml | 4 +- .../30-envoy-gateway-components.yaml | 24 ++++++ .../templates/30-envoy-gateway.yaml | 61 +++++++++++++++ .../templates/30-external-dns.yaml | 30 +++++++- .../templates/30-ingress-nginx.yaml | 32 -------- .../argocd/argocd-cmd-params-cm.yaml | 2 +- .../templates/argocd/argocd-ui-httproute.yaml | 37 +++++++++ .../templates/argocd/argocd-ui-ingress.yaml | 75 ------------------- .../templates/argocd/kustomization.yaml | 2 +- .../cert-issuers/clusterissuers.yaml | 18 +++-- .../templates/crossplane-components/svc.yaml | 57 ++++++++------ .../templates/envoy-gateway/envoy-proxy.yaml | 33 ++++++++ .../envoy-gateway/gateway-class.yaml | 13 ++++ .../templates/envoy-gateway/gateway.yaml | 56 ++++++++++++++ .../envoy-gateway/http-redirect.yaml | 18 +++++ .../templates/envoy-gateway/wait.yaml | 59 +++++++++++++++ .../templates/30-cert-manager.yaml | 4 +- .../templates/30-envoy-gateway.yaml | 61 +++++++++++++++ .../templates/30-ingress-nginx.yaml | 32 -------- 20 files changed, 444 insertions(+), 176 deletions(-) create mode 100644 templates/civo/project-cluster/templates/30-envoy-gateway-components.yaml create mode 100644 templates/civo/project-cluster/templates/30-envoy-gateway.yaml delete mode 100644 templates/civo/project-cluster/templates/30-ingress-nginx.yaml create mode 100644 templates/civo/project-cluster/templates/argocd/argocd-ui-httproute.yaml delete mode 100644 templates/civo/project-cluster/templates/argocd/argocd-ui-ingress.yaml create mode 100644 templates/civo/project-cluster/templates/envoy-gateway/envoy-proxy.yaml create mode 100644 templates/civo/project-cluster/templates/envoy-gateway/gateway-class.yaml create mode 100644 templates/civo/project-cluster/templates/envoy-gateway/gateway.yaml create mode 100644 templates/civo/project-cluster/templates/envoy-gateway/http-redirect.yaml create mode 100644 templates/civo/project-cluster/templates/envoy-gateway/wait.yaml create mode 100644 templates/civo/workload-cluster/templates/30-envoy-gateway.yaml delete mode 100644 templates/civo/workload-cluster/templates/30-ingress-nginx.yaml diff --git a/templates/civo/project-cluster/templates/20-argocd-connection.yaml b/templates/civo/project-cluster/templates/20-argocd-connection.yaml index 4a6e04f..51a1f83 100644 --- a/templates/civo/project-cluster/templates/20-argocd-connection.yaml +++ b/templates/civo/project-cluster/templates/20-argocd-connection.yaml @@ -1,4 +1,4 @@ -apiVersion: "external-secrets.io/v1beta1" +apiVersion: "external-secrets.io/v1" kind: ExternalSecret metadata: name: {{ .Values.workloadClusterName }} diff --git a/templates/civo/project-cluster/templates/30-cert-manager.yaml b/templates/civo/project-cluster/templates/30-cert-manager.yaml index 9a71b7d..ca1ab45 100644 --- a/templates/civo/project-cluster/templates/30-cert-manager.yaml +++ b/templates/civo/project-cluster/templates/30-cert-manager.yaml @@ -11,13 +11,15 @@ spec: project: {{ .Values.workloadClusterName }} source: repoURL: https://charts.jetstack.io - targetRevision: v1.19.3 + targetRevision: v1.20.1 helm: values: |- serviceAccount: create: true name: cert-manager installCRDs: true + extraArgs: + - --enable-gateway-api chart: cert-manager destination: name: {{ .Values.workloadClusterName }} diff --git a/templates/civo/project-cluster/templates/30-envoy-gateway-components.yaml b/templates/civo/project-cluster/templates/30-envoy-gateway-components.yaml new file mode 100644 index 0000000..e9bc690 --- /dev/null +++ b/templates/civo/project-cluster/templates/30-envoy-gateway-components.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-envoy-gateway-components + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: {{ .Values.workloadClusterName }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/envoy-gateway + targetRevision: HEAD + destination: + name: {{ .Values.workloadClusterName }} + namespace: envoy-gateway-system + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/civo/project-cluster/templates/30-envoy-gateway.yaml b/templates/civo/project-cluster/templates/30-envoy-gateway.yaml new file mode 100644 index 0000000..9a02158 --- /dev/null +++ b/templates/civo/project-cluster/templates/30-envoy-gateway.yaml @@ -0,0 +1,61 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-envoy-gateway + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: {{ .Values.workloadClusterName }} + source: + repoURL: docker.io/envoyproxy + chart: gateway-helm + targetRevision: v1.7.0 + helm: + valuesObject: + config: + envoyGateway: + logging: + level: + default: info + gateway: + controllerName: gateway.envoyproxy.io/gatewayclass-controller + podDisruptionBudget: + minAvailable: 1 + deployment: + replicas: 1 + envoyGateway: + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: 500m + memory: 512Mi + pod: + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: kubernetes.io/hostname + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: + control-plane: envoy-gateway + destination: + name: {{ .Values.workloadClusterName }} + namespace: envoy-gateway-system + syncPolicy: + automated: + prune: true + selfHeal: true + allowEmpty: false + syncOptions: + - CreateNamespace=true + - ServerSideApply=true + retry: + limit: 5 + backoff: + duration: 5s + factor: 2 + maxDuration: 3m diff --git a/templates/civo/project-cluster/templates/30-external-dns.yaml b/templates/civo/project-cluster/templates/30-external-dns.yaml index 9371262..c13edf1 100644 --- a/templates/civo/project-cluster/templates/30-external-dns.yaml +++ b/templates/civo/project-cluster/templates/30-external-dns.yaml @@ -11,7 +11,7 @@ spec: project: {{ .Values.workloadClusterName }} source: repoURL: https://kubernetes-sigs.github.io/external-dns - targetRevision: 1.14.4 + targetRevision: 1.20.0 helm: releaseName: external-dns values: | @@ -20,7 +20,11 @@ spec: name: external-dns provider: {{ .Values.externalDnsProviderName }} sources: - - ingress + - service + - gateway-httproute + - gateway-tlsroute + - gateway-tcproute + - gateway-udproute domainFilters: - {{ .Values.domainName }} env: @@ -39,3 +43,25 @@ spec: selfHeal: true syncOptions: - CreateNamespace=true +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: external-dns-gateway +rules: + - apiGroups: ["gateway.networking.k8s.io"] + resources: ["gateways", "httproutes", "grpcroutes", "tlsroutes"] + verbs: ["get", "list", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: external-dns-gateway +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: external-dns-gateway +subjects: + - kind: ServiceAccount + name: external-dns + namespace: external-dns diff --git a/templates/civo/project-cluster/templates/30-ingress-nginx.yaml b/templates/civo/project-cluster/templates/30-ingress-nginx.yaml deleted file mode 100644 index 9b82797..0000000 --- a/templates/civo/project-cluster/templates/30-ingress-nginx.yaml +++ /dev/null @@ -1,32 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: {{ .Values.workloadClusterName }}-ingress-nginx - namespace: argocd - finalizers: - - resources-finalizer.argocd.argoproj.io - annotations: - argocd.argoproj.io/sync-wave: '30' -spec: - project: {{ .Values.workloadClusterName }} - source: - repoURL: https://kubernetes.github.io/ingress-nginx - targetRevision: 4.14.3 - helm: - values: |- - controller: - ingressClass: nginx - publishService: - enabled: true - extraArgs: - enable-ssl-passthrough: true - chart: ingress-nginx - destination: - name: {{ .Values.workloadClusterName }} - namespace: ingress-nginx - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/templates/civo/project-cluster/templates/argocd/argocd-cmd-params-cm.yaml b/templates/civo/project-cluster/templates/argocd/argocd-cmd-params-cm.yaml index 046d327..74a173b 100644 --- a/templates/civo/project-cluster/templates/argocd/argocd-cmd-params-cm.yaml +++ b/templates/civo/project-cluster/templates/argocd/argocd-cmd-params-cm.yaml @@ -6,7 +6,7 @@ metadata: app.kubernetes.io/name: argocd-cmd-params-cm app.kubernetes.io/part-of: argocd data: - # ssl terminated at ingress-nginx and forwarded + # ssl terminated at envoy gateway and forwarded # to allow for cloudflare origin issuer certificates application.namespaces: '*' server.insecure: 'true' diff --git a/templates/civo/project-cluster/templates/argocd/argocd-ui-httproute.yaml b/templates/civo/project-cluster/templates/argocd/argocd-ui-httproute.yaml new file mode 100644 index 0000000..f466bba --- /dev/null +++ b/templates/civo/project-cluster/templates/argocd/argocd-ui-httproute.yaml @@ -0,0 +1,37 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: argocd-server-http + namespace: argocd +spec: + parentRefs: + - name: eg + namespace: default + sectionName: https-argocd + hostnames: + - argocd-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} + rules: + - matches: + - path: + type: PathPrefix + value: / + backendRefs: + - name: argocd-server + port: 80 +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: GRPCRoute +metadata: + name: argocd-server-grpc + namespace: argocd +spec: + parentRefs: + - name: eg + namespace: default + sectionName: https-grpc-argocd + hostnames: + - grpc-{{ .Values.workloadClusterName }}.argocd.{{ .Values.domainName }} + rules: + - backendRefs: + - name: argocd-server + port: 80 diff --git a/templates/civo/project-cluster/templates/argocd/argocd-ui-ingress.yaml b/templates/civo/project-cluster/templates/argocd/argocd-ui-ingress.yaml deleted file mode 100644 index 40b49d5..0000000 --- a/templates/civo/project-cluster/templates/argocd/argocd-ui-ingress.yaml +++ /dev/null @@ -1,75 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: argocd-server-http-ingress - namespace: argocd - annotations: - nginx.ingress.kubernetes.io/force-ssl-redirect: "true" - nginx.ingress.kubernetes.io/backend-protocol: "HTTP" - cert-manager.io/cluster-issuer: letsencrypt-prod - {{- if .Values.certManagerIssuerAnnotation1 }} - {{ .Values.certManagerIssuerAnnotation1 }} - {{- end }} - {{- if .Values.certManagerIssuerAnnotation2 }} - {{ .Values.certManagerIssuerAnnotation2 }} - {{- end }} - {{- if .Values.certManagerIssuerAnnotation3 }} - {{ .Values.certManagerIssuerAnnotation3 }} - {{- end }} - {{- if .Values.certManagerIssuerAnnotation4 }} - {{ .Values.certManagerIssuerAnnotation4 }} - {{- end }} -spec: - ingressClassName: nginx - rules: - - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: argocd-server - port: - name: http - host: argocd-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} - tls: - - hosts: - - argocd-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} - secretName: argocd-ingress-http ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: argocd-server-grpc-ingress - namespace: argocd - annotations: - nginx.ingress.kubernetes.io/backend-protocol: "GRPC" - {{- if .Values.certManagerIssuerAnnotation1 }} - {{ .Values.certManagerIssuerAnnotation1 }} - {{- end }} - {{- if .Values.certManagerIssuerAnnotation2 }} - {{ .Values.certManagerIssuerAnnotation2 }} - {{- end }} - {{- if .Values.certManagerIssuerAnnotation3 }} - {{ .Values.certManagerIssuerAnnotation3 }} - {{- end }} - {{- if .Values.certManagerIssuerAnnotation4 }} - {{ .Values.certManagerIssuerAnnotation4 }} - {{- end }} -spec: - ingressClassName: nginx - rules: - - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: argocd-server - port: - name: https - host: grpc-{{ .Values.workloadClusterName }}.argocd.{{ .Values.domainName }} - tls: - - hosts: - - grpc-argocd-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} - secretName: argocd-ingress-grpc diff --git a/templates/civo/project-cluster/templates/argocd/kustomization.yaml b/templates/civo/project-cluster/templates/argocd/kustomization.yaml index 41f7638..e79db3c 100644 --- a/templates/civo/project-cluster/templates/argocd/kustomization.yaml +++ b/templates/civo/project-cluster/templates/argocd/kustomization.yaml @@ -6,7 +6,7 @@ namespace: argocd # https://github.com/argoproj/argo-cd/tags resources: - github.com:konstructio/manifests.git/argocd/cloud?ref=jokestax-patch-2 - - argocd-ui-ingress.yaml + - argocd-ui-httproute.yaml - application.yaml - rbac.yaml - github-token-refresher.yaml diff --git a/templates/civo/project-cluster/templates/cert-issuers/clusterissuers.yaml b/templates/civo/project-cluster/templates/cert-issuers/clusterissuers.yaml index 185d5fb..a4a1cca 100644 --- a/templates/civo/project-cluster/templates/cert-issuers/clusterissuers.yaml +++ b/templates/civo/project-cluster/templates/cert-issuers/clusterissuers.yaml @@ -9,9 +9,12 @@ spec: privateKeySecretRef: name: letsencrypt-staging solvers: - - http01: - ingress: - class: nginx + - http01: + gatewayHTTPRoute: + parentRefs: + - name: eg + namespace: default + kind: Gateway --- apiVersion: cert-manager.io/v1 kind: ClusterIssuer @@ -24,6 +27,9 @@ spec: privateKeySecretRef: name: letsencrypt-prod solvers: - - http01: - ingress: - class: nginx + - http01: + gatewayHTTPRoute: + parentRefs: + - name: eg + namespace: default + kind: Gateway diff --git a/templates/civo/project-cluster/templates/crossplane-components/svc.yaml b/templates/civo/project-cluster/templates/crossplane-components/svc.yaml index e272c51..5aeb19c 100644 --- a/templates/civo/project-cluster/templates/crossplane-components/svc.yaml +++ b/templates/civo/project-cluster/templates/crossplane-components/svc.yaml @@ -14,31 +14,40 @@ spec: pkg.crossplane.io/provider: provider-terraform pkg.crossplane.io/revision: crossplane-provider-terraform-6fe8d52ff0a1 --- -apiVersion: networking.k8s.io/v1 -kind: Ingress +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute metadata: - annotations: - cert-manager.io/cluster-issuer: letsencrypt-prod - nginx.ingress.kubernetes.io/proxy-buffering: 'off' - nginx.ingress.kubernetes.io/proxy-cache-bypass: '1' - nginx.ingress.kubernetes.io/proxy-read-timeout: '3600' - nginx.ingress.kubernetes.io/proxy-send-timeout: '3600' - name: log-streamer-ingress + name: log-streamer namespace: crossplane-system spec: - ingressClassName: nginx + parentRefs: + - name: eg + namespace: default + sectionName: https-logs + hostnames: + - logs-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} rules: - - host: logs-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} - http: - paths: - - backend: - service: - name: log-streamer-service - port: - number: 9090 - path: / - pathType: Prefix - tls: - - hosts: - - logs-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} - secretName: logs-mgmt-cluster + - matches: + - path: + type: PathPrefix + value: / + backendRefs: + - name: log-streamer-service + port: 9090 +--- +apiVersion: gateway.envoyproxy.io/v1alpha1 +kind: BackendTrafficPolicy +metadata: + name: log-streamer-timeout + namespace: crossplane-system +spec: + targetRefs: + - group: gateway.networking.k8s.io + kind: HTTPRoute + name: log-streamer + timeout: + http: + requestTimeout: "3600s" + idleTimeout: "3600s" + tcp: + connectTimeout: "30s" diff --git a/templates/civo/project-cluster/templates/envoy-gateway/envoy-proxy.yaml b/templates/civo/project-cluster/templates/envoy-gateway/envoy-proxy.yaml new file mode 100644 index 0000000..c5f7d89 --- /dev/null +++ b/templates/civo/project-cluster/templates/envoy-gateway/envoy-proxy.yaml @@ -0,0 +1,33 @@ +apiVersion: gateway.envoyproxy.io/v1alpha1 +kind: EnvoyProxy +metadata: + name: proxy-config + namespace: envoy-gateway-system + annotations: + argocd.argoproj.io/sync-wave: "30" +spec: + provider: + type: Kubernetes + kubernetes: + envoyDeployment: + replicas: 3 + pod: + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: kubernetes.io/hostname + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: + app.kubernetes.io/component: proxy + container: + resources: + requests: + cpu: 200m + memory: 256Mi + limits: + cpu: "1" + memory: 512Mi + concurrency: 0 + shutdown: + drainTimeout: 30s + minDrainDuration: 5s diff --git a/templates/civo/project-cluster/templates/envoy-gateway/gateway-class.yaml b/templates/civo/project-cluster/templates/envoy-gateway/gateway-class.yaml new file mode 100644 index 0000000..f852ba6 --- /dev/null +++ b/templates/civo/project-cluster/templates/envoy-gateway/gateway-class.yaml @@ -0,0 +1,13 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: GatewayClass +metadata: + name: eg + annotations: + argocd.argoproj.io/sync-wave: "30" +spec: + controllerName: gateway.envoyproxy.io/gatewayclass-controller + parametersRef: + group: gateway.envoyproxy.io + kind: EnvoyProxy + name: proxy-config + namespace: envoy-gateway-system diff --git a/templates/civo/project-cluster/templates/envoy-gateway/gateway.yaml b/templates/civo/project-cluster/templates/envoy-gateway/gateway.yaml new file mode 100644 index 0000000..5da54eb --- /dev/null +++ b/templates/civo/project-cluster/templates/envoy-gateway/gateway.yaml @@ -0,0 +1,56 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: Gateway +metadata: + name: eg + namespace: default + annotations: + argocd.argoproj.io/sync-wave: "35" + cert-manager.io/cluster-issuer: "letsencrypt-prod" +spec: + gatewayClassName: eg + listeners: + - name: http + protocol: HTTP + port: 80 + allowedRoutes: + namespaces: + from: All + + - name: https-argocd + hostname: argocd-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} + protocol: HTTPS + port: 443 + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: argocd-ingress-http + allowedRoutes: + namespaces: + from: All + + - name: https-grpc-argocd + hostname: grpc-{{ .Values.workloadClusterName }}.argocd.{{ .Values.domainName }} + protocol: HTTPS + port: 443 + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: argocd-ingress-grpc + allowedRoutes: + namespaces: + from: All + + - name: https-logs + hostname: logs-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} + protocol: HTTPS + port: 443 + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: logs-mgmt-cluster + allowedRoutes: + namespaces: + from: All diff --git a/templates/civo/project-cluster/templates/envoy-gateway/http-redirect.yaml b/templates/civo/project-cluster/templates/envoy-gateway/http-redirect.yaml new file mode 100644 index 0000000..0302ccf --- /dev/null +++ b/templates/civo/project-cluster/templates/envoy-gateway/http-redirect.yaml @@ -0,0 +1,18 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: http-to-https-redirect + namespace: default + annotations: + argocd.argoproj.io/sync-wave: "35" +spec: + parentRefs: + - name: eg + namespace: default + sectionName: http + rules: + - filters: + - type: RequestRedirect + requestRedirect: + scheme: https + statusCode: 301 diff --git a/templates/civo/project-cluster/templates/envoy-gateway/wait.yaml b/templates/civo/project-cluster/templates/envoy-gateway/wait.yaml new file mode 100644 index 0000000..13c099e --- /dev/null +++ b/templates/civo/project-cluster/templates/envoy-gateway/wait.yaml @@ -0,0 +1,59 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: k8s-toolkit-envoy-gateway + namespace: envoy-gateway-system +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: k8s-toolkit-envoy-gateway + namespace: envoy-gateway-system +rules: + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: k8s-toolkit-envoy-gateway + namespace: envoy-gateway-system +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: k8s-toolkit-envoy-gateway +subjects: + - kind: ServiceAccount + name: k8s-toolkit-envoy-gateway + namespace: envoy-gateway-system +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + argocd.argoproj.io/sync-wave: '20' + name: wait-envoy-gateway + namespace: envoy-gateway-system +spec: + template: + spec: + containers: + - args: + - wait-for + - deployment + - --namespace + - envoy-gateway-system + - --label + - app.kubernetes.io/name=gateway-helm + image: ghcr.io/konstructio/kubernetes-toolkit:v0.1.3 + imagePullPolicy: IfNotPresent + name: wait + restartPolicy: OnFailure + serviceAccountName: k8s-toolkit-envoy-gateway diff --git a/templates/civo/workload-cluster/templates/30-cert-manager.yaml b/templates/civo/workload-cluster/templates/30-cert-manager.yaml index d0907e4..197a312 100644 --- a/templates/civo/workload-cluster/templates/30-cert-manager.yaml +++ b/templates/civo/workload-cluster/templates/30-cert-manager.yaml @@ -11,13 +11,15 @@ spec: project: {{ .Values.workloadClusterName }}-platform source: repoURL: https://charts.jetstack.io - targetRevision: v1.19.3 + targetRevision: v1.20.1 helm: values: |- serviceAccount: create: true name: cert-manager installCRDs: true + extraArgs: + - --enable-gateway-api chart: cert-manager destination: name: {{ .Values.workloadClusterName }} diff --git a/templates/civo/workload-cluster/templates/30-envoy-gateway.yaml b/templates/civo/workload-cluster/templates/30-envoy-gateway.yaml new file mode 100644 index 0000000..558132f --- /dev/null +++ b/templates/civo/workload-cluster/templates/30-envoy-gateway.yaml @@ -0,0 +1,61 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-envoy-gateway + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: {{ .Values.workloadClusterName }}-platform + source: + repoURL: docker.io/envoyproxy + chart: gateway-helm + targetRevision: v1.7.0 + helm: + valuesObject: + config: + envoyGateway: + logging: + level: + default: info + gateway: + controllerName: gateway.envoyproxy.io/gatewayclass-controller + podDisruptionBudget: + minAvailable: 1 + deployment: + replicas: 1 + envoyGateway: + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: 500m + memory: 512Mi + pod: + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: kubernetes.io/hostname + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: + control-plane: envoy-gateway + destination: + name: {{ .Values.workloadClusterName }} + namespace: envoy-gateway-system + syncPolicy: + automated: + prune: true + selfHeal: true + allowEmpty: false + syncOptions: + - CreateNamespace=true + - ServerSideApply=true + retry: + limit: 5 + backoff: + duration: 5s + factor: 2 + maxDuration: 3m diff --git a/templates/civo/workload-cluster/templates/30-ingress-nginx.yaml b/templates/civo/workload-cluster/templates/30-ingress-nginx.yaml deleted file mode 100644 index e98503c..0000000 --- a/templates/civo/workload-cluster/templates/30-ingress-nginx.yaml +++ /dev/null @@ -1,32 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: {{ .Values.workloadClusterName }}-ingress-nginx - namespace: argocd - finalizers: - - resources-finalizer.argocd.argoproj.io - annotations: - argocd.argoproj.io/sync-wave: '30' -spec: - project: {{ .Values.workloadClusterName }}-platform - source: - repoURL: https://kubernetes.github.io/ingress-nginx - targetRevision: 4.14.3 - helm: - values: |- - controller: - ingressClass: nginx - publishService: - enabled: true - extraArgs: - enable-ssl-passthrough: true - chart: ingress-nginx - destination: - name: {{ .Values.workloadClusterName }} - namespace: ingress-nginx - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true From 502867d393da5626dcd195f7bee5d0c7854b1b75 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Mon, 13 Apr 2026 02:24:01 +0530 Subject: [PATCH 46/77] feat: migrate to gateway api --- templates/civo/project-cluster/templates/30-external-dns.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/civo/project-cluster/templates/30-external-dns.yaml b/templates/civo/project-cluster/templates/30-external-dns.yaml index c13edf1..d8a46c7 100644 --- a/templates/civo/project-cluster/templates/30-external-dns.yaml +++ b/templates/civo/project-cluster/templates/30-external-dns.yaml @@ -47,7 +47,7 @@ spec: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: external-dns-gateway + name: external-dns-gateway-{{ .Values.workloadClusterName }} rules: - apiGroups: ["gateway.networking.k8s.io"] resources: ["gateways", "httproutes", "grpcroutes", "tlsroutes"] @@ -56,7 +56,7 @@ rules: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: external-dns-gateway + name: external-dns-gateway-{{ .Values.workloadClusterName }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole From d97df00527c776e9117050633722e1a6896c2655 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Mon, 13 Apr 2026 02:25:26 +0530 Subject: [PATCH 47/77] fix: sync wave --- templates/civo/project-cluster/templates/30-envoy-gateway.yaml | 2 +- ...gateway-components.yaml => 35-envoy-gateway-components.yaml} | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) rename templates/civo/project-cluster/templates/{30-envoy-gateway-components.yaml => 35-envoy-gateway-components.yaml} (94%) diff --git a/templates/civo/project-cluster/templates/30-envoy-gateway.yaml b/templates/civo/project-cluster/templates/30-envoy-gateway.yaml index 9a02158..6a49300 100644 --- a/templates/civo/project-cluster/templates/30-envoy-gateway.yaml +++ b/templates/civo/project-cluster/templates/30-envoy-gateway.yaml @@ -6,7 +6,7 @@ metadata: finalizers: - resources-finalizer.argocd.argoproj.io annotations: - argocd.argoproj.io/sync-wave: '10' + argocd.argoproj.io/sync-wave: '30' spec: project: {{ .Values.workloadClusterName }} source: diff --git a/templates/civo/project-cluster/templates/30-envoy-gateway-components.yaml b/templates/civo/project-cluster/templates/35-envoy-gateway-components.yaml similarity index 94% rename from templates/civo/project-cluster/templates/30-envoy-gateway-components.yaml rename to templates/civo/project-cluster/templates/35-envoy-gateway-components.yaml index e9bc690..6fd354c 100644 --- a/templates/civo/project-cluster/templates/30-envoy-gateway-components.yaml +++ b/templates/civo/project-cluster/templates/35-envoy-gateway-components.yaml @@ -6,7 +6,7 @@ metadata: finalizers: - resources-finalizer.argocd.argoproj.io annotations: - argocd.argoproj.io/sync-wave: '10' + argocd.argoproj.io/sync-wave: '35' spec: project: {{ .Values.workloadClusterName }} source: From ea9aa274ec6037904556a511b748cd0a7a0d2b7e Mon Sep 17 00:00:00 2001 From: mrrishi Date: Mon, 13 Apr 2026 02:28:24 +0530 Subject: [PATCH 48/77] fix: sync wave --- .../project-cluster/templates/infrastructure/workspace.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/templates/civo/project-cluster/templates/infrastructure/workspace.yaml b/templates/civo/project-cluster/templates/infrastructure/workspace.yaml index f043c1b..bc90aa5 100644 --- a/templates/civo/project-cluster/templates/infrastructure/workspace.yaml +++ b/templates/civo/project-cluster/templates/infrastructure/workspace.yaml @@ -20,5 +20,3 @@ spec: value: "{{ .Values.workloadNodeType }}" - key: project_name value: "{{ .Values.workloadClusterProjectName }}" - - key: org_id - value: "{{ .Values.workloadClusterOrgId }}" From f92c7db79f32fb9fd2f0fa3d132bcfcda241231c Mon Sep 17 00:00:00 2001 From: mrrishi Date: Mon, 13 Apr 2026 11:06:38 +0530 Subject: [PATCH 49/77] fix: provider name --- templates/civo/project-cluster/values.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/templates/civo/project-cluster/values.yaml b/templates/civo/project-cluster/values.yaml index d746226..bf1efd3 100644 --- a/templates/civo/project-cluster/values.yaml +++ b/templates/civo/project-cluster/values.yaml @@ -14,3 +14,5 @@ waitJobImage: "dtzar/helm-kubectl:3.19.0" # @input.description: Domain for the Argocd # @input.required: false domain: saas.konstruct.io + +externalDnsProviderName: cloudflare From f27356fcc8e594ed162dee316cee8b637c8b7ec3 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Mon, 13 Apr 2026 11:09:49 +0530 Subject: [PATCH 50/77] fix: provider name --- templates/civo/project-cluster/values.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/templates/civo/project-cluster/values.yaml b/templates/civo/project-cluster/values.yaml index bf1efd3..59fc2c0 100644 --- a/templates/civo/project-cluster/values.yaml +++ b/templates/civo/project-cluster/values.yaml @@ -16,3 +16,5 @@ waitJobImage: "dtzar/helm-kubectl:3.19.0" domain: saas.konstruct.io externalDnsProviderName: cloudflare + +externalDnsProviderTokenEnvName: CLOUDFLARE_API_TOKEN From 455b0dad7d0c76aa175d1d4ae154d8091e3a0fa1 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Mon, 13 Apr 2026 11:14:03 +0530 Subject: [PATCH 51/77] fix: provider name --- templates/civo/project-cluster/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/civo/project-cluster/values.yaml b/templates/civo/project-cluster/values.yaml index 59fc2c0..6a1d51e 100644 --- a/templates/civo/project-cluster/values.yaml +++ b/templates/civo/project-cluster/values.yaml @@ -17,4 +17,4 @@ domain: saas.konstruct.io externalDnsProviderName: cloudflare -externalDnsProviderTokenEnvName: CLOUDFLARE_API_TOKEN +externalDnsProviderTokenEnvName: CF_API_TOKEN From 631664cb51a7553ff71b32e1fddad6b104ead5b6 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Mon, 13 Apr 2026 13:08:25 +0530 Subject: [PATCH 52/77] fix: remote url --- templates/civo/project-cluster/values.yaml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/templates/civo/project-cluster/values.yaml b/templates/civo/project-cluster/values.yaml index 6a1d51e..21612c6 100644 --- a/templates/civo/project-cluster/values.yaml +++ b/templates/civo/project-cluster/values.yaml @@ -1,4 +1,4 @@ -workloadClusterTerraformModuleUrl: "git::https://github.com/konstructio/konstruct-templates.git//terraform/civo/modules/project-cluster?ref=main" +workloadClusterTerraformModuleUrl: "git::https://github.com/konstructio/konstruct-templates.git//terraform/civo/modules/project-cluster?ref=saas-rishi" # @input.type: string # @input.description: Alert email address for cert-manager notifications @@ -10,9 +10,7 @@ domainName: konstruct.io # Wait Job Configuration waitJobImage: "dtzar/helm-kubectl:3.19.0" -# @input.type: string -# @input.description: Domain for the Argocd -# @input.required: false + domain: saas.konstruct.io externalDnsProviderName: cloudflare From 9d0a3121e0953e5ee89537a1910dadf24c9d232b Mon Sep 17 00:00:00 2001 From: mrrishi Date: Mon, 13 Apr 2026 13:36:24 +0530 Subject: [PATCH 53/77] fix: domain name --- .../templates/argocd/argocd-ui-httproute.yaml | 4 ++-- .../templates/crossplane-components/svc.yaml | 2 +- .../project-cluster/templates/envoy-gateway/gateway.yaml | 6 +++--- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/templates/civo/project-cluster/templates/argocd/argocd-ui-httproute.yaml b/templates/civo/project-cluster/templates/argocd/argocd-ui-httproute.yaml index f466bba..5049807 100644 --- a/templates/civo/project-cluster/templates/argocd/argocd-ui-httproute.yaml +++ b/templates/civo/project-cluster/templates/argocd/argocd-ui-httproute.yaml @@ -9,7 +9,7 @@ spec: namespace: default sectionName: https-argocd hostnames: - - argocd-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} + - argocd-{{ .Values.workloadClusterName }}.{{ .Values.domain }} rules: - matches: - path: @@ -30,7 +30,7 @@ spec: namespace: default sectionName: https-grpc-argocd hostnames: - - grpc-{{ .Values.workloadClusterName }}.argocd.{{ .Values.domainName }} + - grpc-{{ .Values.workloadClusterName }}.argocd.{{ .Values.domain }} rules: - backendRefs: - name: argocd-server diff --git a/templates/civo/project-cluster/templates/crossplane-components/svc.yaml b/templates/civo/project-cluster/templates/crossplane-components/svc.yaml index 5aeb19c..d140871 100644 --- a/templates/civo/project-cluster/templates/crossplane-components/svc.yaml +++ b/templates/civo/project-cluster/templates/crossplane-components/svc.yaml @@ -25,7 +25,7 @@ spec: namespace: default sectionName: https-logs hostnames: - - logs-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} + - logs-{{ .Values.workloadClusterName }}.{{ .Values.domain }} rules: - matches: - path: diff --git a/templates/civo/project-cluster/templates/envoy-gateway/gateway.yaml b/templates/civo/project-cluster/templates/envoy-gateway/gateway.yaml index 5da54eb..87c371e 100644 --- a/templates/civo/project-cluster/templates/envoy-gateway/gateway.yaml +++ b/templates/civo/project-cluster/templates/envoy-gateway/gateway.yaml @@ -17,7 +17,7 @@ spec: from: All - name: https-argocd - hostname: argocd-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} + hostname: argocd-{{ .Values.workloadClusterName }}.{{ .Values.domain }} protocol: HTTPS port: 443 tls: @@ -30,7 +30,7 @@ spec: from: All - name: https-grpc-argocd - hostname: grpc-{{ .Values.workloadClusterName }}.argocd.{{ .Values.domainName }} + hostname: grpc-{{ .Values.workloadClusterName }}.argocd.{{ .Values.domain }} protocol: HTTPS port: 443 tls: @@ -43,7 +43,7 @@ spec: from: All - name: https-logs - hostname: logs-{{ .Values.workloadClusterName }}.{{ .Values.domainName }} + hostname: logs-{{ .Values.workloadClusterName }}.{{ .Values.domain }} protocol: HTTPS port: 443 tls: From 42c50f23ba900259c871b1e0a80728e3514ccc75 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Mon, 13 Apr 2026 20:01:12 +0530 Subject: [PATCH 54/77] fix: path --- templates/civo/project-cluster/templates/30-clusterissuers.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/civo/project-cluster/templates/30-clusterissuers.yaml b/templates/civo/project-cluster/templates/30-clusterissuers.yaml index 97980fd..fea3279 100644 --- a/templates/civo/project-cluster/templates/30-clusterissuers.yaml +++ b/templates/civo/project-cluster/templates/30-clusterissuers.yaml @@ -11,7 +11,7 @@ spec: project: {{ .Values.workloadClusterName }} source: repoURL: {{ .Values.gitopsRepoUrl }} - path: registry/clusters/{{ .Values.workloadClusterName }}/cert-issuers + path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/cert-issuers targetRevision: HEAD destination: name: {{ .Values.workloadClusterName }} From fbdb740933ce3a45f0e2ffb7e77d36e24a212830 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Mon, 13 Apr 2026 20:07:08 +0530 Subject: [PATCH 55/77] fix: path --- .../templates/argocd/github-token-refresher.yaml | 2 +- .../templates/crossplane-components/github-token-refresher.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml b/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml index c5b7d0d..5f23d38 100644 --- a/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml +++ b/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml @@ -15,7 +15,7 @@ spec: image: {{ .Values.waitJobImage }} env: - name: VENDING_URL - value: "https://{{ .Values.domain }}/api/v1/github-token" + value: "https://konstruct.{{ .Values.domain }}/api/v1/github-token" - name: TOKEN valueFrom: secretKeyRef: diff --git a/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml b/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml index 5a70cb6..7e1d1f9 100644 --- a/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml +++ b/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml @@ -15,7 +15,7 @@ spec: image: {{ .Values.waitJobImage }} env: - name: VENDING_URL - value: "https://{{ .Values.domain }}/api/v1/github-token" + value: "https://konstruct.{{ .Values.domain }}/api/v1/github-token" - name: TOKEN valueFrom: secretKeyRef: From 22fc0a8a05f21e41559f90e3256a802e9b62649b Mon Sep 17 00:00:00 2001 From: mrrishi Date: Mon, 13 Apr 2026 20:21:45 +0530 Subject: [PATCH 56/77] fix: env --- .../argocd/github-token-refresher.yaml | 108 ++++++++++++------ 1 file changed, 71 insertions(+), 37 deletions(-) diff --git a/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml b/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml index 5f23d38..e0b0e4c 100644 --- a/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml +++ b/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml @@ -1,3 +1,37 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: github-token-refresher + namespace: argocd +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: github-token-refresher + namespace: argocd +rules: +- apiGroups: [""] + resources: ["secrets"] + resourceNames: ["github-repo-creds"] + verbs: ["get", "patch"] +- apiGroups: [""] + resources: ["secrets"] + verbs: ["create"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: github-token-refresher + namespace: argocd +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: github-token-refresher +subjects: +- kind: ServiceAccount + name: github-token-refresher + namespace: argocd +--- apiVersion: batch/v1 kind: CronJob metadata: @@ -26,6 +60,10 @@ spec: secretKeyRef: name: platform-cluster-identity key: org_id + - name: ORG_NAME + value: "{{ .Values.orgName }}" + - name: REPO_NAME + value: "{{ .Values.repoName }}" command: - /bin/bash - -c @@ -35,6 +73,7 @@ spec: echo "=== ENV CHECK ===" echo "VENDING_URL: ${VENDING_URL}" echo "ORG_ID: ${ORG_ID}" + echo "GITHUB_REPO_URL: https://github.com/${ORG_NAME}/${REPO_NAME}.git" echo "TOKEN length: ${#TOKEN}" echo "=== REQUESTING TOKEN ===" @@ -47,6 +86,7 @@ spec: if [ "$HTTP_CODE" != "200" ]; then echo "Error: non-200 response from vending service" + cat /tmp/response.txt exit 1 fi @@ -57,58 +97,35 @@ spec: fi echo "=== PATCHING SECRET ===" + GITHUB_REPO_URL="https://github.com/${ORG_NAME}/${REPO_NAME}.git" ENCODED=$(echo -n "$RESPONSE" | base64 | tr -d '\n') if kubectl get secret github-repo-creds -n argocd &>/dev/null; then - echo "Secret exists, patching..." + echo "Secret exists, patching password..." kubectl patch secret github-repo-creds -n argocd \ --type='json' \ -p="[{\"op\": \"replace\", \"path\": \"/data/password\", \"value\": \"${ENCODED}\"}]" + kubectl label secret github-repo-creds -n argocd \ + argocd.argoproj.io/secret-type=repository --overwrite echo "Secret patched successfully." else echo "Secret not found, creating..." kubectl create secret generic github-repo-creds -n argocd \ + --from-literal=type=git \ + --from-literal=url="${GITHUB_REPO_URL}" \ + --from-literal=username=x-access-token \ --from-literal=password="${RESPONSE}" + kubectl label secret github-repo-creds -n argocd \ + argocd.argoproj.io/secret-type=repository echo "Secret created successfully." fi + echo "=== VERIFYING SECRET ===" + kubectl get secret github-repo-creds -n argocd -o jsonpath='{.metadata.labels}' && echo "" + echo "Done." restartPolicy: OnFailure --- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: github-token-refresher - namespace: argocd ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: github-token-refresher - namespace: argocd -rules: -- apiGroups: [""] - resources: ["secrets"] - resourceNames: ["github-repo-creds"] - verbs: ["get", "patch"] -- apiGroups: [""] - resources: ["secrets"] - verbs: ["create"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: github-token-refresher - namespace: argocd -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: github-token-refresher -subjects: -- kind: ServiceAccount - name: github-token-refresher - namespace: argocd ---- apiVersion: batch/v1 kind: Job metadata: @@ -126,7 +143,7 @@ spec: image: {{ .Values.waitJobImage }} env: - name: VENDING_URL - value: "https://{{ .Values.domain }}/api/v1/github-token" + value: "https://konstruct.{{ .Values.domain }}/api/v1/github-token" - name: TOKEN valueFrom: secretKeyRef: @@ -137,6 +154,10 @@ spec: secretKeyRef: name: platform-cluster-identity key: org_id + - name: ORG_NAME + value: "{{ .Values.orgName }}" + - name: REPO_NAME + value: "{{ .Values.repoName }}" command: - /bin/bash - -c @@ -146,6 +167,7 @@ spec: echo "=== ENV CHECK ===" echo "VENDING_URL: ${VENDING_URL}" echo "ORG_ID: ${ORG_ID}" + echo "GITHUB_REPO_URL: https://github.com/${ORG_NAME}/${REPO_NAME}.git" echo "TOKEN length: ${#TOKEN}" echo "=== REQUESTING TOKEN ===" @@ -158,6 +180,7 @@ spec: if [ "$HTTP_CODE" != "200" ]; then echo "Error: non-200 response from vending service" + cat /tmp/response.txt exit 1 fi @@ -168,20 +191,31 @@ spec: fi echo "=== PATCHING SECRET ===" + GITHUB_REPO_URL="https://github.com/${ORG_NAME}/${REPO_NAME}.git" ENCODED=$(echo -n "$RESPONSE" | base64 | tr -d '\n') if kubectl get secret github-repo-creds -n argocd &>/dev/null; then - echo "Secret exists, patching..." + echo "Secret exists, patching password..." kubectl patch secret github-repo-creds -n argocd \ --type='json' \ -p="[{\"op\": \"replace\", \"path\": \"/data/password\", \"value\": \"${ENCODED}\"}]" + kubectl label secret github-repo-creds -n argocd \ + argocd.argoproj.io/secret-type=repository --overwrite echo "Secret patched successfully." else echo "Secret not found, creating..." kubectl create secret generic github-repo-creds -n argocd \ + --from-literal=type=git \ + --from-literal=url="${GITHUB_REPO_URL}" \ + --from-literal=username=x-access-token \ --from-literal=password="${RESPONSE}" + kubectl label secret github-repo-creds -n argocd \ + argocd.argoproj.io/secret-type=repository echo "Secret created successfully." fi + echo "=== VERIFYING SECRET ===" + kubectl get secret github-repo-creds -n argocd -o jsonpath='{.metadata.labels}' && echo "" + echo "Done." restartPolicy: OnFailure From b4d0b2991d11a4213b03e9c9adebd49c7edf2630 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Tue, 14 Apr 2026 05:18:48 +0530 Subject: [PATCH 57/77] feat: add more gitops catalog --- gitops-catalog/gpu-operator-base/Chart.yaml | 6 + .../templates/application.yaml | 41 ++++++ gitops-catalog/gpu-operator-base/values.yaml | 88 +++++++++++++ gitops-catalog/metrics-server/Chart.yaml | 6 + .../metrics-server/templates/application.yaml | 41 ++++++ gitops-catalog/metrics-server/values.yaml | 94 ++++++++++++++ gitops-catalog/ollama-openwebui/Chart.yaml | 6 + .../templates/application.yaml | 56 +++++++++ gitops-catalog/ollama-openwebui/values.yaml | 118 ++++++++++++++++++ 9 files changed, 456 insertions(+) create mode 100644 gitops-catalog/gpu-operator-base/Chart.yaml create mode 100644 gitops-catalog/gpu-operator-base/templates/application.yaml create mode 100644 gitops-catalog/gpu-operator-base/values.yaml create mode 100644 gitops-catalog/metrics-server/Chart.yaml create mode 100644 gitops-catalog/metrics-server/templates/application.yaml create mode 100644 gitops-catalog/metrics-server/values.yaml create mode 100644 gitops-catalog/ollama-openwebui/Chart.yaml create mode 100644 gitops-catalog/ollama-openwebui/templates/application.yaml create mode 100644 gitops-catalog/ollama-openwebui/values.yaml diff --git a/gitops-catalog/gpu-operator-base/Chart.yaml b/gitops-catalog/gpu-operator-base/Chart.yaml new file mode 100644 index 0000000..be2e1d9 --- /dev/null +++ b/gitops-catalog/gpu-operator-base/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: gpu-operator-base +description: A Helm chart for deploying NVIDIA GPU Operator with ArgoCD for GPU workload support on Kubernetes +type: application +version: 0.1.0 +appVersion: "24.9.2" diff --git a/gitops-catalog/gpu-operator-base/templates/application.yaml b/gitops-catalog/gpu-operator-base/templates/application.yaml new file mode 100644 index 0000000..004d0d8 --- /dev/null +++ b/gitops-catalog/gpu-operator-base/templates/application.yaml @@ -0,0 +1,41 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-gpu-operator + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: gpu-operator-base + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + chart: gpu-operator + repoURL: https://helm.ngc.nvidia.com/nvidia + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: gpu-operator + values: | + driver: + enabled: {{ .Values.driverEnabled }} + toolkit: + enabled: {{ .Values.toolkitEnabled }} + devicePlugin: + enabled: {{ .Values.devicePluginEnabled }} + gfd: + enabled: {{ .Values.gfdEnabled }} + operator: + defaultRuntime: "{{ .Values.defaultRuntime }}" + validator: + cuda: + runtimeClassName: "{{ .Values.cudaRuntimeClassName }}" + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/gpu-operator-base/values.yaml b/gitops-catalog/gpu-operator-base/values.yaml new file mode 100644 index 0000000..d44451b --- /dev/null +++ b/gitops-catalog/gpu-operator-base/values.yaml @@ -0,0 +1,88 @@ +# NVIDIA GPU Operator Base Configuration +# This values file contains all configurable parameters for deploying NVIDIA GPU Operator via ArgoCD + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for GPU Operator deployment +# @input.required: true +# @input.default: gpu-operator +namespace: gpu-operator + +# @input.type: string +# @input.description: NVIDIA GPU Operator Helm chart version +# @input.required: true +# @input.default: 24.9.2 +chartVersion: 24.9.2 + +# ============================================================================= +# GPU OPERATOR CONFIGURATION +# ============================================================================= + +# @input.type: enum +# @input.description: Enable NVIDIA driver installation on nodes +# @input.options: true,false +# @input.required: true +# @input.default: true +driverEnabled: true + +# @input.type: enum +# @input.description: Enable NVIDIA container toolkit +# @input.options: true,false +# @input.required: true +# @input.default: false +toolkitEnabled: false + +# @input.type: enum +# @input.description: Enable NVIDIA device plugin for GPU scheduling +# @input.options: true,false +# @input.required: true +# @input.default: true +devicePluginEnabled: true + +# @input.type: enum +# @input.description: Enable GPU Feature Discovery for node labeling +# @input.options: true,false +# @input.required: true +# @input.default: true +gfdEnabled: true + +# @input.type: string +# @input.description: Default container runtime for the operator +# @input.required: true +# @input.default: containerd +defaultRuntime: containerd + +# @input.type: string +# @input.description: RuntimeClassName for CUDA validation +# @input.required: true +# @input.default: nvidia +cudaRuntimeClassName: nvidia diff --git a/gitops-catalog/metrics-server/Chart.yaml b/gitops-catalog/metrics-server/Chart.yaml new file mode 100644 index 0000000..ca3ee82 --- /dev/null +++ b/gitops-catalog/metrics-server/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: metrics-server +description: A Helm chart for deploying Kubernetes Metrics Server with ArgoCD for cluster resource metrics (CPU/memory) used by HPA and kubectl top +type: application +version: 0.1.0 +appVersion: "0.8.0" diff --git a/gitops-catalog/metrics-server/templates/application.yaml b/gitops-catalog/metrics-server/templates/application.yaml new file mode 100644 index 0000000..45e984e --- /dev/null +++ b/gitops-catalog/metrics-server/templates/application.yaml @@ -0,0 +1,41 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-metrics-server + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: metrics-server + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + chart: metrics-server + repoURL: https://kubernetes-sigs.github.io/metrics-server/ + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: metrics-server + values: | + replicas: {{ .Values.replicas }} + hostNetwork: + enabled: {{ .Values.hostNetwork }} + args: + - --kubelet-preferred-address-types={{ .Values.kubeletPreferredAddressType }} + - --metric-resolution={{ .Values.metricResolution }} + {{- if .Values.kubeletInsecureTls }} + - --kubelet-insecure-tls + {{- end }} + podDisruptionBudget: + enabled: {{ .Values.pdbEnabled }} + serviceMonitor: + enabled: {{ .Values.serviceMonitorEnabled }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/metrics-server/values.yaml b/gitops-catalog/metrics-server/values.yaml new file mode 100644 index 0000000..3cf42c9 --- /dev/null +++ b/gitops-catalog/metrics-server/values.yaml @@ -0,0 +1,94 @@ +# Kubernetes Metrics Server Configuration +# This values file contains all configurable parameters for deploying Metrics Server via ArgoCD + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for Metrics Server deployment +# @input.required: true +# @input.default: kube-system +namespace: kube-system + +# @input.type: string +# @input.description: Metrics Server Helm chart version +# @input.required: true +# @input.default: 3.12.2 +chartVersion: 3.12.2 + +# ============================================================================= +# METRICS SERVER CONFIGURATION +# ============================================================================= + +# @input.type: number +# @input.description: Number of Metrics Server replicas (use 2+ for HA on multi-node clusters) +# @input.required: true +# @input.default: 1 +replicas: 1 + +# @input.type: enum +# @input.description: Skip kubelet TLS verification (required on clusters with self-signed kubelet certs, e.g. kubeadm/kind/Civo) +# @input.options: true,false +# @input.required: true +# @input.default: true +kubeletInsecureTls: true + +# @input.type: string +# @input.description: Preferred kubelet address type for metric scraping +# @input.required: true +# @input.default: InternalIP +kubeletPreferredAddressType: InternalIP + +# @input.type: string +# @input.description: Metric resolution interval (how often metrics are scraped) +# @input.required: true +# @input.default: 15s +metricResolution: 15s + +# @input.type: enum +# @input.description: Enable host network (set to true for clusters using CNI plugins that don't reach pods from the control plane, e.g. EKS with custom CNI) +# @input.options: true,false +# @input.required: true +# @input.default: false +hostNetwork: false + +# @input.type: enum +# @input.description: Create a PodDisruptionBudget for Metrics Server +# @input.options: true,false +# @input.required: true +# @input.default: false +pdbEnabled: false + +# @input.type: enum +# @input.description: Enable ServiceMonitor for Prometheus scraping (requires prometheus-operator CRDs) +# @input.options: true,false +# @input.required: true +# @input.default: false +serviceMonitorEnabled: false diff --git a/gitops-catalog/ollama-openwebui/Chart.yaml b/gitops-catalog/ollama-openwebui/Chart.yaml new file mode 100644 index 0000000..07bc657 --- /dev/null +++ b/gitops-catalog/ollama-openwebui/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: ollama-openwebui +description: A Helm chart for deploying Ollama + Open WebUI with ArgoCD for running and interacting with local LLMs on Kubernetes (GPU-enabled by default via the CUDA image) +type: application +version: 0.1.0 +appVersion: "3.1.19" diff --git a/gitops-catalog/ollama-openwebui/templates/application.yaml b/gitops-catalog/ollama-openwebui/templates/application.yaml new file mode 100644 index 0000000..b4f2f93 --- /dev/null +++ b/gitops-catalog/ollama-openwebui/templates/application.yaml @@ -0,0 +1,56 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-openwebui + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: ollama-openwebui + kubefirst.konstruct.io/source: catalog-templates + argocd.argoproj.io/sync-wave: '50' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + repoURL: https://helm.openwebui.com/ + chart: open-webui + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: open-webui + values: | + image: + repository: {{ .Values.imageRepository }} + tag: "{{ .Values.imageTag }}" + serviceAccount: + create: true + name: openwebui-sa + ollama: + enabled: {{ .Values.ollamaEnabled }} + {{- if .Values.gpuEnabled }} + extraArgs: + - "--gpus all" + extraHosts: + - "host.docker.internal:host-gateway" + {{- end }} + persistentVolume: + enabled: true + size: {{ .Values.persistentVolumeSize }} + ingress: + enabled: {{ .Values.ingressEnabled }} + class: "{{ .Values.ingressClassName }}" + annotations: + nginx.ingress.kubernetes.io/force-ssl-redirect: "true" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" + cert-manager.io/cluster-issuer: "{{ .Values.clusterIssuer }}" + host: "ollama.{{ .Values.domainName }}" + tls: true + existingSecret: "{{ .Values.clusterName }}-{{ .Values.tlsSecretName }}" + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/ollama-openwebui/values.yaml b/gitops-catalog/ollama-openwebui/values.yaml new file mode 100644 index 0000000..1bbaec9 --- /dev/null +++ b/gitops-catalog/ollama-openwebui/values.yaml @@ -0,0 +1,118 @@ +# Ollama + Open WebUI Configuration +# This values file contains all configurable parameters for deploying +# Ollama + Open WebUI via ArgoCD. The Open WebUI Helm chart bundles +# Ollama as an optional subchart - toggle with `ollamaEnabled`. + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for Open WebUI and Ollama deployment +# @input.required: true +# @input.default: openwebui +namespace: openwebui + +# @input.type: string +# @input.description: Open WebUI Helm chart version (from https://helm.openwebui.com) +# @input.required: true +# @input.default: 6.38.0 +chartVersion: 6.38.0 + +# ============================================================================= +# OPEN WEBUI CONFIGURATION +# ============================================================================= + +# @input.type: string +# @input.description: Open WebUI container image repository +# @input.required: true +# @input.default: ghcr.io/open-webui/open-webui +imageRepository: ghcr.io/open-webui/open-webui + +# @input.type: enum +# @input.description: Image tag - "cuda" for NVIDIA GPU support, "main" for CPU-only +# @input.options: cuda,main,ollama +# @input.required: true +# @input.default: cuda +imageTag: cuda + +# @input.type: enum +# @input.description: Enable Ollama as a bundled subchart (runs alongside Open WebUI in the same namespace) +# @input.options: true,false +# @input.required: true +# @input.default: true +ollamaEnabled: true + +# @input.type: enum +# @input.description: Enable NVIDIA GPU access for the Open WebUI pod (requires NVIDIA GPU Operator installed on the cluster) +# @input.options: true,false +# @input.required: true +# @input.default: true +gpuEnabled: true + +# @input.type: string +# @input.description: Persistent volume size for model and conversation storage +# @input.required: true +# @input.default: 50Gi +persistentVolumeSize: 50Gi + +# ============================================================================= +# INGRESS CONFIGURATION +# ============================================================================= + +# @input.type: enum +# @input.description: Expose Open WebUI via an Ingress +# @input.options: true,false +# @input.required: true +# @input.default: true +ingressEnabled: true + +# @input.type: string +# @input.description: Base domain name for the Ingress host (final host is "ollama.") +# @input.required: true +# @input.default: example.com +domainName: example.com + +# @input.type: string +# @input.description: Ingress class name (controller that will serve the route) +# @input.required: true +# @input.default: nginx +ingressClassName: nginx + +# @input.type: string +# @input.description: cert-manager ClusterIssuer used to provision the TLS certificate +# @input.required: true +# @input.default: letsencrypt-prod +clusterIssuer: letsencrypt-prod + +# @input.type: string +# @input.description: Secret name that will hold the TLS certificate +# @input.required: true +# @input.default: ollama-http-ingress +tlsSecretName: ollama-http-ingress From f57241b353ac078a6a37efca740196dd1d57b954 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Tue, 14 Apr 2026 05:19:43 +0530 Subject: [PATCH 58/77] feat: add more gitops catalog --- gitops-catalog/ollama-openwebui/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitops-catalog/ollama-openwebui/values.yaml b/gitops-catalog/ollama-openwebui/values.yaml index 1bbaec9..8a366f4 100644 --- a/gitops-catalog/ollama-openwebui/values.yaml +++ b/gitops-catalog/ollama-openwebui/values.yaml @@ -90,8 +90,8 @@ persistentVolumeSize: 50Gi # @input.description: Expose Open WebUI via an Ingress # @input.options: true,false # @input.required: true -# @input.default: true -ingressEnabled: true +# @input.default: false +ingressEnabled: false # @input.type: string # @input.description: Base domain name for the Ingress host (final host is "ollama.") From 4979c1e302ffcf8f1162d2e773b6dac5516e8c85 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Wed, 15 Apr 2026 00:24:21 +0530 Subject: [PATCH 59/77] fix: perm --- .../workload-cluster/templates/workloadcluster-project.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/civo/workload-cluster/templates/workloadcluster-project.yaml b/templates/civo/workload-cluster/templates/workloadcluster-project.yaml index 5c6adc2..b9d63c1 100644 --- a/templates/civo/workload-cluster/templates/workloadcluster-project.yaml +++ b/templates/civo/workload-cluster/templates/workloadcluster-project.yaml @@ -11,7 +11,7 @@ spec: description: {{ .Values.workloadClusterName }} description sourceNamespaces: ["{{ .Values.workloadClusterName }}-environment"] sourceRepos: - - '{{ .Values.teamGitopsRepoUrl }}' + - '*' destinations: - name: {{ .Values.workloadClusterName }} namespace: '*' From 433e1659f9b08967931301082f17170fcc5012fa Mon Sep 17 00:00:00 2001 From: mrrishi Date: Wed, 15 Apr 2026 01:52:53 +0530 Subject: [PATCH 60/77] fix: prefix --- .../templates/crossplane-components/github-token-refresher.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml b/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml index 7e1d1f9..12999ed 100644 --- a/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml +++ b/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml @@ -105,7 +105,7 @@ spec: image: {{ .Values.waitJobImage}} env: - name: VENDING_URL - value: "https://{{ .Values.domain }}/api/v1/github-token" + value: "https://konstruct.{{ .Values.domain }}/api/v1/github-token" - name: TOKEN valueFrom: secretKeyRef: From ae1ecac8ab425a65c15fa10e9c9207ab116a8285 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Wed, 15 Apr 2026 12:29:29 +0530 Subject: [PATCH 61/77] upgrade k8s version --- terraform/civo/modules/project-cluster/main.tf | 2 +- terraform/civo/modules/workload-cluster/main.tf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/terraform/civo/modules/project-cluster/main.tf b/terraform/civo/modules/project-cluster/main.tf index 73bf63a..246d188 100644 --- a/terraform/civo/modules/project-cluster/main.tf +++ b/terraform/civo/modules/project-cluster/main.tf @@ -29,7 +29,7 @@ resource "civo_kubernetes_cluster" "project-cluster" { firewall_id = civo_firewall.project-cluster.id write_kubeconfig = true cluster_type = "k3s" - kubernetes_version = "1.32.5-k3s1" + kubernetes_version = "1.34.2-k3s1" pools { label = var.cluster_name size = var.node_type diff --git a/terraform/civo/modules/workload-cluster/main.tf b/terraform/civo/modules/workload-cluster/main.tf index 58ccb88..3a54b0b 100644 --- a/terraform/civo/modules/workload-cluster/main.tf +++ b/terraform/civo/modules/workload-cluster/main.tf @@ -14,7 +14,7 @@ resource "civo_kubernetes_cluster" "kubefirst" { firewall_id = civo_firewall.kubefirst.id write_kubeconfig = true cluster_type = "k3s" - kubernetes_version = "1.32.5-k3s1" + kubernetes_version = "1.34.2-k3s1" pools { label = var.cluster_name size = var.node_type From 3536675242768ccd404f9f20caab1500c22c0500 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Wed, 15 Apr 2026 12:52:55 +0530 Subject: [PATCH 62/77] upgrade k8s version --- terraform/civo/modules/project-cluster/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/terraform/civo/modules/project-cluster/main.tf b/terraform/civo/modules/project-cluster/main.tf index 246d188..26dc5d4 100644 --- a/terraform/civo/modules/project-cluster/main.tf +++ b/terraform/civo/modules/project-cluster/main.tf @@ -29,7 +29,7 @@ resource "civo_kubernetes_cluster" "project-cluster" { firewall_id = civo_firewall.project-cluster.id write_kubeconfig = true cluster_type = "k3s" - kubernetes_version = "1.34.2-k3s1" + kubernetes_version = "1.33.6-k3s1" pools { label = var.cluster_name size = var.node_type From a845c31e52d445e18de0b43c014206da6503f6b5 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Wed, 15 Apr 2026 12:53:01 +0530 Subject: [PATCH 63/77] upgrade k8s version --- .../templates/35-cert-manager.yaml | 32 +++++++++++++++++++ .../templates/35-clusterissuers.yaml | 24 ++++++++++++++ .../templates/35-cert-manager.yaml | 32 +++++++++++++++++++ 3 files changed, 88 insertions(+) create mode 100644 templates/civo/project-cluster/templates/35-cert-manager.yaml create mode 100644 templates/civo/project-cluster/templates/35-clusterissuers.yaml create mode 100644 templates/civo/workload-cluster/templates/35-cert-manager.yaml diff --git a/templates/civo/project-cluster/templates/35-cert-manager.yaml b/templates/civo/project-cluster/templates/35-cert-manager.yaml new file mode 100644 index 0000000..83b610f --- /dev/null +++ b/templates/civo/project-cluster/templates/35-cert-manager.yaml @@ -0,0 +1,32 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-cert-manager + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '35' +spec: + project: {{ .Values.workloadClusterName }} + source: + repoURL: https://charts.jetstack.io + targetRevision: v1.20.1 + helm: + values: |- + serviceAccount: + create: true + name: cert-manager + installCRDs: true + extraArgs: + - --enable-gateway-api + chart: cert-manager + destination: + name: {{ .Values.workloadClusterName }} + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/civo/project-cluster/templates/35-clusterissuers.yaml b/templates/civo/project-cluster/templates/35-clusterissuers.yaml new file mode 100644 index 0000000..755d930 --- /dev/null +++ b/templates/civo/project-cluster/templates/35-clusterissuers.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-cert-issuers + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '36' +spec: + project: {{ .Values.workloadClusterName }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/cert-issuers + targetRevision: HEAD + destination: + name: {{ .Values.workloadClusterName }} + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/civo/workload-cluster/templates/35-cert-manager.yaml b/templates/civo/workload-cluster/templates/35-cert-manager.yaml new file mode 100644 index 0000000..db26457 --- /dev/null +++ b/templates/civo/workload-cluster/templates/35-cert-manager.yaml @@ -0,0 +1,32 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-cert-manager + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '35' +spec: + project: {{ .Values.workloadClusterName }}-platform + source: + repoURL: https://charts.jetstack.io + targetRevision: v1.20.1 + helm: + values: |- + serviceAccount: + create: true + name: cert-manager + installCRDs: true + extraArgs: + - --enable-gateway-api + chart: cert-manager + destination: + name: {{ .Values.workloadClusterName }} + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true From a32c7e2e5dc7331f0df0e7ecb13c03965c7f5827 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Wed, 15 Apr 2026 13:25:33 +0530 Subject: [PATCH 64/77] upgrade k8s version --- terraform/civo/modules/project-cluster/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/terraform/civo/modules/project-cluster/main.tf b/terraform/civo/modules/project-cluster/main.tf index 26dc5d4..246d188 100644 --- a/terraform/civo/modules/project-cluster/main.tf +++ b/terraform/civo/modules/project-cluster/main.tf @@ -29,7 +29,7 @@ resource "civo_kubernetes_cluster" "project-cluster" { firewall_id = civo_firewall.project-cluster.id write_kubeconfig = true cluster_type = "k3s" - kubernetes_version = "1.33.6-k3s1" + kubernetes_version = "1.34.2-k3s1" pools { label = var.cluster_name size = var.node_type From 2154302689670d1d8ecfe58a44d766212ccc352a Mon Sep 17 00:00:00 2001 From: John Dietz Date: Sat, 18 Apr 2026 03:51:06 -0400 Subject: [PATCH 65/77] feat: GPU cluster template + catalog items (#33) * feat: add GPU cluster template and catalog items for Friday demo - Create templates/civo/gpu-cluster/ with isGpu=true and is_gpu Terraform var - Backfill is_gpu=false on workload-cluster template for consistency - Add nvidia-nim-operator catalog item (k8s-nim-operator v3.0.2) - Add runai catalog item (control-plane + cluster-agent v2.20.0) Closes #35, Closes #36, Closes #37, Closes #38 * feat: add konstruct.yaml metadata to gpu-cluster and workload-cluster templates Required for template registration via Konstruct UI/API. * fix: correct terraform module path in template default URLs The module lives under civo-github/, not at the repo root. * fix: update open-webui default chart version to 13.3.1 * fix: cert-manager template fixes from gpu cluster dry run - Downgrade cert-manager from v1.20.1 to v1.16.5 (selectableFields CRD incompatibility with older K8s versions) - Disable startupapicheck (hangs on Talos clusters) - Add ServerSideApply=true sync option (required for CRD apply) - Remove duplicate 35-cert-manager.yaml (caused ArgoCD warnings) - Add ServerSideApply to ollama-openwebui catalog app * fix: add ServerSideApply to NIM operator and Run.ai catalog apps Learned from dry run that CRD-heavy charts need ServerSideApply to avoid annotation size limits during ArgoCD sync. * fix: update Run.ai catalog to use public runai-cluster chart - Switch from JFrog control-plane chart to GCS runai-cluster chart (publicly accessible, no auth required) - Simplify to single Application (cluster agent only, no separate control-plane chart needed) - Update chart version to 2.16.79 - Replace domain/TLS config with cluster URL/UID inputs * fix(runai): restructure catalog for ArgoCD hook compatibility ArgoCD interprets helm.sh/hook annotations as hooks and blocks sync. Restructured Run.ai catalog to use pre-rendered manifests (hooks stripped) instead of direct Helm chart source. Catalog now outputs 3 Applications: - Parent app (wave 47): points at runai environment dir - Prereqs app (wave 49): creates runai, monitoring, runai-scale-adjust, runai-reservation namespaces - Manifests app (wave 50): deploys rendered runai-cluster 2.16.79 chart Static files in static/ dir are copied to gitops repo alongside rendered templates. Manifests use and token placeholders for cluster-specific values. * fix: set civo-gpu demo defaults in NIM and Run.ai catalog values * fix(nim): disable upgradeCRD hook in catalog template ArgoCD blocks on helm.sh/hook pre-upgrade Job. Setting operator.upgradeCRD=false prevents the hook from being rendered. --- gitops-catalog/nvidia-nim-operator/Chart.yaml | 6 + .../templates/application.yaml | 38 + .../nvidia-nim-operator/values.yaml | 77 + gitops-catalog/ollama-openwebui/Chart.yaml | 2 +- .../templates/application.yaml | 1 + gitops-catalog/ollama-openwebui/values.yaml | 2 +- gitops-catalog/runai/Chart.yaml | 6 + .../runai/static/manifests/runai-cluster.yaml | 7958 +++++++++++++++++ .../runai/static/prereqs/namespaces.yaml | 19 + .../runai/templates/application.yaml | 26 + .../templates/manifests-application.yaml | 27 + .../runai/templates/prereqs-application.yaml | 25 + gitops-catalog/runai/values.yaml | 51 + templates/civo/gpu-cluster/Chart.yaml | 15 + templates/civo/gpu-cluster/konstruct.yaml | 2 + .../templates/0-providerconfig.yaml | 24 + .../templates/10-infrastructure.yaml | 24 + .../templates/30-cert-manager.yaml} | 7 +- .../templates/30-envoy-gateway.yaml | 61 + .../gpu-cluster/templates/30-reloader.yaml | 31 + .../gpu-cluster/templates/45-environment.yaml | 24 + .../templates/infrastructure/wait.yaml | 21 + .../templates/infrastructure/workspace.yaml | 24 + .../provider-config/providerconfig.yaml | 45 + .../templates/registry-workload-cluster.yaml | 30 + .../workloadcluster-environment-project.yaml | 26 + .../workloadcluster-platform-project.yaml | 26 + .../templates/workloadcluster-project.yaml | 27 + templates/civo/gpu-cluster/values.yaml | 11 + .../civo/workload-cluster/konstruct.yaml | 2 + .../templates/30-cert-manager.yaml | 5 +- .../templates/infrastructure/workspace.yaml | 2 + templates/civo/workload-cluster/values.yaml | 5 +- 33 files changed, 8644 insertions(+), 6 deletions(-) create mode 100644 gitops-catalog/nvidia-nim-operator/Chart.yaml create mode 100644 gitops-catalog/nvidia-nim-operator/templates/application.yaml create mode 100644 gitops-catalog/nvidia-nim-operator/values.yaml create mode 100644 gitops-catalog/runai/Chart.yaml create mode 100644 gitops-catalog/runai/static/manifests/runai-cluster.yaml create mode 100644 gitops-catalog/runai/static/prereqs/namespaces.yaml create mode 100644 gitops-catalog/runai/templates/application.yaml create mode 100644 gitops-catalog/runai/templates/manifests-application.yaml create mode 100644 gitops-catalog/runai/templates/prereqs-application.yaml create mode 100644 gitops-catalog/runai/values.yaml create mode 100644 templates/civo/gpu-cluster/Chart.yaml create mode 100644 templates/civo/gpu-cluster/konstruct.yaml create mode 100644 templates/civo/gpu-cluster/templates/0-providerconfig.yaml create mode 100644 templates/civo/gpu-cluster/templates/10-infrastructure.yaml rename templates/civo/{workload-cluster/templates/35-cert-manager.yaml => gpu-cluster/templates/30-cert-manager.yaml} (83%) create mode 100644 templates/civo/gpu-cluster/templates/30-envoy-gateway.yaml create mode 100644 templates/civo/gpu-cluster/templates/30-reloader.yaml create mode 100644 templates/civo/gpu-cluster/templates/45-environment.yaml create mode 100644 templates/civo/gpu-cluster/templates/infrastructure/wait.yaml create mode 100644 templates/civo/gpu-cluster/templates/infrastructure/workspace.yaml create mode 100644 templates/civo/gpu-cluster/templates/provider-config/providerconfig.yaml create mode 100644 templates/civo/gpu-cluster/templates/registry-workload-cluster.yaml create mode 100644 templates/civo/gpu-cluster/templates/workloadcluster-environment-project.yaml create mode 100644 templates/civo/gpu-cluster/templates/workloadcluster-platform-project.yaml create mode 100644 templates/civo/gpu-cluster/templates/workloadcluster-project.yaml create mode 100644 templates/civo/gpu-cluster/values.yaml create mode 100644 templates/civo/workload-cluster/konstruct.yaml diff --git a/gitops-catalog/nvidia-nim-operator/Chart.yaml b/gitops-catalog/nvidia-nim-operator/Chart.yaml new file mode 100644 index 0000000..808f173 --- /dev/null +++ b/gitops-catalog/nvidia-nim-operator/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: nvidia-nim-operator +description: A Helm chart for deploying NVIDIA NIM Operator with ArgoCD for GPU-accelerated inference microservices +type: application +version: 0.1.0 +appVersion: "3.0.2" diff --git a/gitops-catalog/nvidia-nim-operator/templates/application.yaml b/gitops-catalog/nvidia-nim-operator/templates/application.yaml new file mode 100644 index 0000000..b7c90da --- /dev/null +++ b/gitops-catalog/nvidia-nim-operator/templates/application.yaml @@ -0,0 +1,38 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-nim-operator + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: nvidia-nim-operator + kubefirst.konstruct.io/source: catalog-templates + argocd.argoproj.io/sync-wave: '50' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + repoURL: https://helm.ngc.nvidia.com/nvidia + chart: k8s-nim-operator + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: nim-operator + values: | + operator: + upgradeCRD: false + image: + repository: nvcr.io/nvidia/cloud-native/k8s-nim-operator + admissionController: + enabled: {{ .Values.admissionControllerEnabled }} + certManager: + enabled: {{ .Values.certManagerEnabled }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/gitops-catalog/nvidia-nim-operator/values.yaml b/gitops-catalog/nvidia-nim-operator/values.yaml new file mode 100644 index 0000000..dcac604 --- /dev/null +++ b/gitops-catalog/nvidia-nim-operator/values.yaml @@ -0,0 +1,77 @@ +# NVIDIA NIM Operator Configuration +# This values file contains all configurable parameters for deploying +# NVIDIA NIM Operator via ArgoCD. NIM enables deployment and management +# of GPU-accelerated inference microservices. + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: civo-gpu +clusterName: civo-gpu + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/civonetes/demo-organization-gitops.git +gitopsRepoUrl: https://github.com/civonetes/demo-organization-gitops.git + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/civo-gpu +registryPath: registry/clusters/civo-gpu + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: civo-gpu +clusterDestination: civo-gpu + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: civo-gpu +project: civo-gpu + +# @input.type: string +# @input.description: Namespace for NIM Operator deployment +# @input.required: true +# @input.default: nim-operator +namespace: nim-operator + +# @input.type: string +# @input.description: NVIDIA NIM Operator Helm chart version +# @input.required: true +# @input.default: 3.0.2 +chartVersion: 3.0.2 + +# ============================================================================= +# NIM OPERATOR CONFIGURATION +# ============================================================================= + +# @input.type: enum +# @input.description: Enable the NIM admission controller webhook +# @input.options: true,false +# @input.required: true +# @input.default: true +admissionControllerEnabled: true + +# @input.type: enum +# @input.description: Enable cert-manager integration for webhook TLS +# @input.options: true,false +# @input.required: true +# @input.default: true +certManagerEnabled: true + +# ============================================================================= +# NGC CREDENTIALS - Required to pull NIM container images +# ============================================================================= + +# @input.type: secret +# @input.description: NVIDIA NGC API key for pulling NIM container images (get from ngc.nvidia.com) +# @input.required: true +# @input.secretKey: ngc-api-key +# @input.secretEnv: NGC_API_KEY +# @input.secretBackend: vault +# @input.secretPath: /nvidia-nim +ngcApiKey: "" diff --git a/gitops-catalog/ollama-openwebui/Chart.yaml b/gitops-catalog/ollama-openwebui/Chart.yaml index 07bc657..7905b06 100644 --- a/gitops-catalog/ollama-openwebui/Chart.yaml +++ b/gitops-catalog/ollama-openwebui/Chart.yaml @@ -3,4 +3,4 @@ name: ollama-openwebui description: A Helm chart for deploying Ollama + Open WebUI with ArgoCD for running and interacting with local LLMs on Kubernetes (GPU-enabled by default via the CUDA image) type: application version: 0.1.0 -appVersion: "3.1.19" +appVersion: "0.8.12" diff --git a/gitops-catalog/ollama-openwebui/templates/application.yaml b/gitops-catalog/ollama-openwebui/templates/application.yaml index b4f2f93..e7da425 100644 --- a/gitops-catalog/ollama-openwebui/templates/application.yaml +++ b/gitops-catalog/ollama-openwebui/templates/application.yaml @@ -54,3 +54,4 @@ spec: selfHeal: true syncOptions: - CreateNamespace=true + - ServerSideApply=true diff --git a/gitops-catalog/ollama-openwebui/values.yaml b/gitops-catalog/ollama-openwebui/values.yaml index 8a366f4..a9f5e84 100644 --- a/gitops-catalog/ollama-openwebui/values.yaml +++ b/gitops-catalog/ollama-openwebui/values.yaml @@ -43,7 +43,7 @@ namespace: openwebui # @input.description: Open WebUI Helm chart version (from https://helm.openwebui.com) # @input.required: true # @input.default: 6.38.0 -chartVersion: 6.38.0 +chartVersion: 13.3.1 # ============================================================================= # OPEN WEBUI CONFIGURATION diff --git a/gitops-catalog/runai/Chart.yaml b/gitops-catalog/runai/Chart.yaml new file mode 100644 index 0000000..cd5a6aa --- /dev/null +++ b/gitops-catalog/runai/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: runai +description: A Helm chart for deploying Run.ai GPU orchestration platform with ArgoCD for GPU resource scheduling and management +type: application +version: 0.1.0 +appVersion: "2.16.79" diff --git a/gitops-catalog/runai/static/manifests/runai-cluster.yaml b/gitops-catalog/runai/static/manifests/runai-cluster.yaml new file mode 100644 index 0000000..8657fb6 --- /dev/null +++ b/gitops-catalog/runai/static/manifests/runai-cluster.yaml @@ -0,0 +1,7958 @@ +--- +# Source: runai-cluster/charts/runai-engine/templates/priorityclasses/critical-priority-class.yaml +apiVersion: scheduling.k8s.io/v1 +kind: PriorityClass +metadata: + name: runai-engine-critical +value: 1000000000 +--- +# Source: runai-cluster/templates/priorityclasses/build-priority-class.yaml +apiVersion: scheduling.k8s.io/v1 +kind: PriorityClass +metadata: + name: build + namespace: runai +value: 100 +--- +# Source: runai-cluster/templates/priorityclasses/critical-priority-class.yaml +apiVersion: scheduling.k8s.io/v1 +kind: PriorityClass +metadata: + name: runai-critical + namespace: runai +value: 1000000000 +--- +# Source: runai-cluster/templates/priorityclasses/inference-priority-class.yaml +apiVersion: scheduling.k8s.io/v1 +kind: PriorityClass +metadata: + name: inference + namespace: runai +value: 125 +--- +# Source: runai-cluster/templates/priorityclasses/interactive-preemptible-priority-class.yaml +apiVersion: scheduling.k8s.io/v1 +kind: PriorityClass +metadata: + name: interactive-preemptible + namespace: runai +value: 75 +--- +# Source: runai-cluster/templates/priorityclasses/train-critical-priority-class.yaml +apiVersion: scheduling.k8s.io/v1 +kind: PriorityClass +metadata: + name: train-critical + namespace: runai +value: 60 +--- +# Source: runai-cluster/templates/priorityclasses/train-high-priority-class.yaml +apiVersion: scheduling.k8s.io/v1 +kind: PriorityClass +metadata: + name: train-high + namespace: runai +value: 55 +--- +# Source: runai-cluster/templates/priorityclasses/train-priority-class.yaml +apiVersion: scheduling.k8s.io/v1 +kind: PriorityClass +metadata: + name: train + namespace: runai +value: 50 +--- +# Source: runai-cluster/charts/runai-engine/templates/operator/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: engine-operator + namespace: runai +--- +# Source: runai-cluster/charts/runai-engine/templates/resource-reservation-namespace.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: runai-reservation-engine + namespace: runai-reservation +--- +# Source: runai-cluster/templates/rbac.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: runai-operator + namespace: runai +--- +# Source: runai-cluster/charts/runai-engine/templates/operator/rbac/role.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-engine-operator +rules: +- apiGroups: + - "" + resources: + - configmaps + - secrets + - serviceaccounts + - services + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch +- apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - apps + resources: + - daemonsets + - deployments + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - engine.run.ai + resources: + - configs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - engine.run.ai + resources: + - configs/finalizers + verbs: + - update +- apiGroups: + - engine.run.ai + resources: + - configs/status + verbs: + - get + - patch + - update +- apiGroups: + - engine.run.ai + resources: + - schedulingshards + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - engine.run.ai + resources: + - schedulingshards/finalizers + verbs: + - update +- apiGroups: + - engine.run.ai + resources: + - schedulingshards/status + verbs: + - get + - patch + - update +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/binder-ro.yaml +# Run:AI Binder +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-binder-ro +rules: + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/binder.yaml +# A Kubernetes Pod Binder with Admission Webhook +# Responsible for the management of Job submission policies and the validation of the input provided to submit the Job +# This ClusterRole has no associated ClusterRoleBinding (only RoleBinding at the project level) +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-binder-project-engine +rules: + - apiGroups: + - "" + resources: + - configmaps + - pods/finalizers + verbs: + - create + - update + - apiGroups: + - apps + resources: + - statefulsets/finalizers + - deployments/finalizers + - replicasets/finalizers + verbs: + - create + - update + - apiGroups: + - batch + resources: + - jobs/finalizers + verbs: + - create + - update + - apiGroups: + - run.ai + resources: + - runaijobs/finalizers + verbs: + - create + - update + - apiGroups: + - kubeflow.org + resources: + - mpijobs/finalizers + - notebooks/finalizers + - pytorchjobs/finalizers + - tfjobs/finalizers + - xgboostjobs/finalizers + verbs: + - create + - update +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/pod-group-controller.yaml +# Run:AI Pod Grouper +# Responsible to watch pods in the cluster and group them to podgroups according to their job type +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: pod-group-controller +rules: + - apiGroups: + - "" + resources: + - pods + - nodes + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.k8s.io + resources: + - priorityclasses + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.run.ai + resources: + - podgroups + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.run.ai + resources: + - podgroups/status + verbs: + - get + - list + - watch + - update + - patch +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/pod-group-controller.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: pod-group-controller-ro +rules: + - apiGroups: + - "" + resources: + - pods + - nodes + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.k8s.io + resources: + - priorityclasses + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.run.ai + resources: + - podgroups + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.run.ai + resources: + - podgroups/status + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/pod-grouper.yaml +# Run:AI Pod Grouper +# Responsible to watch pods in the cluster and group them to podgroups according to their job type +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: pod-grouper-engine +rules: + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + - update + - patch + - create + - apiGroups: + - scheduling.run.ai + resources: + - podgroups + verbs: + - get + - list + - watch + - update + - patch + - create + - apiGroups: + - "" + resources: + - pods/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - apps + resources: + - replicasets + - deployments + - statefulsets + verbs: + - get + - list + - watch + - apiGroups: + - apps + resources: + - replicasets/finalizers + - deployments/finalizers + - statefulsets/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - batch + resources: + - jobs + - cronjobs + verbs: + - get + - list + - watch + - apiGroups: + - batch + resources: + - jobs/finalizers + - cronjobs/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - run.ai + resources: + - runaijobs + verbs: + - get + - list + - watch + - apiGroups: + - run.ai + resources: + - runaijobs/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - kubeflow.org + resources: + - mpijobs + - notebooks + - pytorchjobs + - tfjobs + - xgboostjobs + - scheduledworkflows + verbs: + - get + - list + - watch + - apiGroups: + - kubeflow.org + resources: + - mpijobs/finalizers + - notebooks/finalizers + - pytorchjobs/finalizers + - tfjobs/finalizers + - xgboostjobs/finalizers + - scheduledworkflows/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - machinelearning.seldon.io + resources: + - seldondeployments + verbs: + - get + - list + - watch + - apiGroups: + - machinelearning.seldon.io + resources: + - seldondeployments/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - serving.knative.dev + resources: + - revisions + - configurations + - services + verbs: + - get + - list + - watch + - apiGroups: + - serving.knative.dev + resources: + - revisions/finalizers + - configurations/finalizers + - services/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - kubevirt.io + resources: + - virtualmachines + - virtualmachineinstances + verbs: + - get + - list + - watch + - apiGroups: + - kubevirt.io + resources: + - virtualmachines/finalizers + - virtualmachineinstances/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - amlarc.azureml.com + resources: + - amljobs + verbs: + - get + - list + - watch + - apiGroups: + - amlarc.azureml.com + resources: + - amljobs/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - ray.io + resources: + - rayclusters + - rayjobs + - rayservices + verbs: + - get + - list + - watch + - apiGroups: + - ray.io + resources: + - rayclusters/finalizers + - rayjobs/finalizers + - rayservices/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - workspace.devfile.io + resources: + - devworkspaces + verbs: + - get + - list + - watch + - apiGroups: + - workspace.devfile.io + resources: + - devworkspaces/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - get + - list + - watch + - apiGroups: + - argoproj.io + resources: + - workflows/finalizers + verbs: + - patch + - update + - create + - apiGroups: + - tekton.dev + resources: + - pipelineruns + - taskruns + verbs: + - get + - list + - watch + - apiGroups: + - tekton.dev + resources: + - pipelineruns/finalizers + - taskruns/finalizers + verbs: + - patch + - update + - create +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/queue-controller.yaml +# Run:AI Queue Controller +# Responsible to convert queue versions and update queue status based on other queues and podgroups +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: queue-controller-engine +rules: + - apiGroups: + - scheduling.run.ai + resources: + - podgroups + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.run.ai + resources: + - queues + verbs: + - get + - list + - patch + - update + - watch + - apiGroups: + - scheduling.run.ai + resources: + - queues/finalizers + verbs: + - update + - apiGroups: + - scheduling.run.ai + resources: + - queues/status + verbs: + - get + - patch + - update +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/scheduler.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-engine-scheduler-cluster-wide +rules: + - apiGroups: + - "" + resources: + - configmaps + - events + - persistentvolumeclaims + - pods + - pods/status + - pods/binding + - services + - persistentvolumes + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.run.ai + resources: + - podgroups + - podgroups/status + - queues + - runaijobs + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch + - patch + - apiGroups: + - storage.k8s.io + resources: + - storageclasses + - csinodes + - csidrivers + - csistoragecapacities + verbs: + - get + - list + - watch + - apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.k8s.io + resources: + - priorityclasses + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/scheduler.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-scheduler-rw-engine +rules: + - apiGroups: + - "" + resources: + - configmaps + - events + - persistentvolumeclaims + - pods + - pods/status + - pods/binding + - pods/finalizers + - services + - services/finalizers + verbs: + - create + - delete + - get + - list + - patch + - update + - apiGroups: + - batch.volcano.sh + resources: + - jobs + - podgroups + - podgroups/status + verbs: + - create + - delete + - get + - list + - patch + - update + - apiGroups: + - scheduling.run.ai + resources: + - podgroups + - podgroups/status + verbs: + - create + - delete + - get + - list + - patch + - update +--- +# Source: runai-cluster/templates/clusterroles/accessrule-controller.yaml +# Run:AI AccessRule Controller +# Allows the reading of accessrule related data, reasding other Run:AI related CRDs, and CRUD of RoleBindings. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-accessrule-controller +rules: + - apiGroups: + - run.ai + resources: + - accessrules + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - run.ai + resources: + - accessrules/status + verbs: + - get + - update + - patch + - watch + - apiGroups: + - run.ai + resources: + - accessrules/finalizers + verbs: + - update + - patch + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + - clusterrolebindings + - rolebindings + verbs: + - get + - list + - watch + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterrolebindings + - clusterroles + resourceNames: + - runai-compute-resource-administrator + - runai-credentials-administrator + - runai-data-source-administrator + - runai-department-administrator + - runai-department-viewer + - runai-editor + - runai-environment-administrator + - runai-l1-researcher + - runai-l2-researcher + - runai-ml-engineer + - runai-research-manager + - runai-system-administrator + - runai-template-administrator + - runai-viewer + verbs: + - bind + - update + - patch + - apiGroups: + - run.ai + resources: + - projects + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.run.ai + resources: + - departments + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - namespaces + - serviceaccounts + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/accessrule-controller.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-accessrule-controller-project +rules: + - apiGroups: + - rbac.authorization.k8s.io + resources: + - rolebindings + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + verbs: + - bind +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/compute-resource-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-compute-resource-administrator +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - departments + - projects + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/compute-resource-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-compute-resource-administrator-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/compute-resource-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-compute-resource-administrator-runai +rules: + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/credentials-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-credentials-administrator +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - projects + - departments + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/credentials-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-credentials-administrator-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/credentials-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-credentials-administrator-runai +rules: + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/credentials-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-credentials-administrator-runai-cs +rules: + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/data-source-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-data-source-administrator +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - departments + - projects + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/data-source-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-data-source-administrator-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/data-source-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-data-source-administrator-runai +rules: + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/data-source-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-data-source-administrator-runai-cs +rules: + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-department-administrator +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - accessrules + - nodepools + - projects + - departments + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-department-administrator-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - create + - delete + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-department-administrator-runai +rules: + - apiGroups: + - "" + resources: + - configmaps + resourceNames: + - runai-cli-index + verbs: + - update + - patch + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-department-administrator-runai-cs +rules: + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-viewer.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-department-viewer +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - nodepools + - projects + - departments + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-viewer.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-department-viewer-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-viewer.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-department-viewer-runai +rules: + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/editor.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-editor +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - projects + - departments + - nodepools + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/editor.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-editor-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/editor.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-editor-runai +rules: + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/editor.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-editor-runai-cs +rules: + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/environment-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-environment-administrator +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - projects + - departments + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/environment-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-environment-administrator-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/environment-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-environment-administrator-runai +rules: + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l1-researcher.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-l1-researcher +rules: + - apiGroups: + - run.ai + resources: + - projects + - nodepools + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l1-researcher.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-l1-researcher-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - create + - delete + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l1-researcher.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-l1-researcher-runai +rules: + - apiGroups: + - "" + resources: + - configmaps + resourceNames: + - runai-cli-index + verbs: + - update + - patch + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l1-researcher.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-l1-researcher-runai-cs +rules: + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l2-researcher.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-l2-researcher +rules: + - apiGroups: + - run.ai + resources: + - projects + - nodepools + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l2-researcher.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-l2-researcher-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - create + - delete + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l2-researcher.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-l2-researcher-runai +rules: + - apiGroups: + - "" + resources: + - configmaps + resourceNames: + - runai-cli-index + verbs: + - update + - patch + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/ml-engineer.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-ml-engineer +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - projects + - nodepools + - departments + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/ml-engineer.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-ml-engineer-ns +rules: + - apiGroups: + - scheduling.run.ai + - run.ai + - apps + resources: + - runaijobs + - podgroups + - inferenceworkloads + - statefulsets + - replicasets + - deployments + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/ml-engineer.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-ml-engineer-runai +rules: + - apiGroups: + - "" + resources: + - configmaps + resourceNames: + - runai-cli-index + verbs: + - update + - patch + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/research-manager.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-research-manager +rules: + - apiGroups: + - run.ai + resources: + - projects + - nodepools + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/research-manager.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-research-manager-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/research-manager.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-research-manager-runai +rules: + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/research-manager.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-research-manager-runai-cs +rules: + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/system-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-system-administrator +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - projects + - nodepools + - accessrules + - departments + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/system-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-system-administrator-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/system-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-system-administrator-runai +rules: + - apiGroups: + - "" + resources: + - configmaps + resourceNames: + - runai-cli-index + verbs: + - update + - patch + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/system-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-system-administrator-runai-cs +rules: + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/template-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-template-administrator +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - projects + - departments + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/template-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-template-administrator-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - apiGroups: + - run.ai + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/template-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-template-administrator-runai +rules: + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/template-administrator.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-template-administrator-runai-cs +rules: + - apiGroups: + - run.ai + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/viewer.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-viewer +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - projects + - nodepools + - departments + verbs: + - get + - list + - apiGroups: + - "" + - run.ai + - storage.k8s.io + resources: + - namespaces + - nodes + - services/proxy + - projects + - nodepools + - storageclasses + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/viewer.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-viewer-ns +rules: + - apiGroups: + - run.ai + - scheduling.run.ai + - batch + - kubeflow.org + - apps + - "" + resources: + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + - jobs + - mpijobs + - tfjobs + - pytorchjobs + - xgboostjobs + - statefulsets + - replicasets + - deployments + - pods + - pods/log + - pods/exec + - pods/attach + - pods/portforward + verbs: + - get + - list + - apiGroups: + - run.ai + - scheduling.run.ai + resources: + - runaijobs + - podgroups + verbs: + - get + - list + - apiGroups: + - "" + - discovery.k8s.io + - route.openshift.io + - "" + - extensions + - networking.k8s.io + - route.openshift.io + resources: + - endpoints + - events + - endpointslices + - routes + - configmaps + - services + - ingresses + - routes + - routes/custom-host + verbs: + - get + - list + - apiGroups: + - "" + resources: + - pods/log + verbs: + - watch + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + verbs: + - get + - list + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/viewer.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-viewer-runai +rules: + - apiGroups: + - run.ai + resources: + - interactivepolicies + - trainingpolicies + - inferencepolicies + - distributedpolicies + - interactiveworkloads + - trainingworkloads + - inferenceworkloads + - distributedworkloads + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# Installs and maintains Run:AI installation +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-operator +rules: + - apiGroups: + - "apps" + resources: + - deployments + - daemonsets + verbs: + - list + - apiGroups: + - "" + resources: + - services + verbs: + - list + - apiGroups: + - apiextensions.k8s.io + resourceNames: + - queues.scheduling.run.ai + resources: + - customresourcedefinitions + verbs: + - get + - update + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - watch + - list + - apiGroups: + - engine.run.ai + resources: + - configs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - node.k8s.io + resources: + - runtimeclasses + verbs: + - get + - list + - create + - update + - watch + - patch + - delete + - apiGroups: + - cert-manager.io + resources: + - issuers + - certificates + verbs: + - get + - list + - create + - delete + - update + - watch + - patch + - update + - apiGroups: + - run.ai + resources: + - nodepools + - accessrules + verbs: + - delete + - get + - list + - watch + - deletecollection + - update + - apiGroups: + - run.ai + resources: + - runaiconfigs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - run.ai + resources: + - runaiconfigs/finalizers + verbs: + - update + - apiGroups: + - run.ai + resources: + - runaiconfigs/status + verbs: + - get + - patch + - update + - apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + - validatingwebhookconfigurations + verbs: + - get + - watch + - list + - create + - update + - patch + - delete +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# Researcher User interface used to create Jobs and view Projects. +# Read-only cluster role +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: researcher-service-ro +rules: + - apiGroups: + - "" + - amlarc.azureml.com + - apps + - run.ai + - scheduling.run.ai + - kubeflow.org + resources: + - amljob + - configmaps + - namespaces + - projects + - departments + - runaijobs + - statefulsets + - deployments + - mpijobs + - pytorchjobs + - tfjobs + - xgboostjobs + - nodes + - nodepools + - trainingworkloads + - interactiveworkloads + - inferenceworkloads + - distributedworkloads + - trainingpolicies + - interactivepolicies + - inferencepolicies + - distributedpolicies + - persistentvolumeclaims + verbs: + - get + - list + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create + - apiGroups: + - run.ai + resources: + - accessrules + - projects + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# Researcher User interface used to create Jobs and view Projects +# This ClusterRole has no associated ClusterRoleBinding (only RoleBinding at the project level) +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: researcher-service-rw +rules: + - apiGroups: + - "" + - amlarc.azureml.com + - apps + - batch + - batch.volcano.sh + - run.ai + - kubeflow.org + - extensions + - networking.k8s.io + - serving.knative.dev + resources: + - amljobs + - configmaps + - namespaces + - pods + - pods/log + - jobs + - projects + - runaijobs + - statefulsets + - mpijobs + - deployments + - services + - ingresses + - trainingworkloads + - trainingpolicies + - interactiveworkloads + - interactivepolicies + - inferenceworkloads + - inferencepolicies + - distributedworkloads + - distributedpolicies + verbs: + - create + - delete + - get + - list + - patch + - update + - apiGroups: + - route.openshift.io + resources: + - routes + - routes/custom-host + verbs: + - create + - delete +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# workload-controller is used to create runaijobs based on workloads and policies. +# This ClusterRole has no associated ClusterRoleBinding (only RoleBinding at the project level) +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: workload-controller-rw +rules: + - apiGroups: + - "" + - amlarc.azureml.com + - apps + - run.ai + - kubeflow.org + - networking.k8s.io + - serving.knative.dev + resources: + - amljobs + - configmaps + - deployments + - runaijobs + - mpijobs + - pytorchjobs + - tfjobs + - xgboostjobs + - services + - persistentvolumeclaims + - ingresses + - interactivepolicies + - interactivepolicies/status + - interactiveworkloads + - interactiveworkloads/status + - interactiveworkloads/finalizers + - trainingpolicies + - trainingpolicies/status + - trainingworkloads + - trainingworkloads/status + - trainingworkloads/finalizers + - inferencepolicies + - inferencepolicies/status + - inferenceworkloads + - inferenceworkloads/status + - inferenceworkloads/finalizers + - distributedpolicies + - distributedpolicies/status + - distributedworkloads + - distributedworkloads/status + - distributedworkloads/finalizers + verbs: + - create + - delete + - get + - list + - patch + - watch + - update + - apiGroups: + - route.openshift.io + resources: + - routes + - routes/custom-host + verbs: + - create + - delete + - watch + - list + - get + - update + - patch + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: workload-controller-ro +rules: + - apiGroups: + - "" + - run.ai + - scheduling.run.ai + - networking.k8s.io + - kubeflow.org + resources: + - runaijobs + - mpijobs + - pytorchjobs + - tfjobs + - xgboostjobs + - projects + - departments + - accessrules + - configmaps + - namespaces + - interactivepolicies + - interactivepolicies/status + - interactivepolicies/finalizers + - interactiveworkloads + - interactiveworkloads/status + - interactiveworkloads/finalizers + - trainingpolicies + - trainingpolicies/status + - trainingpolicies/finalizers + - trainingworkloads + - trainingworkloads/status + - trainingworkloads/finalizers + - inferencepolicies + - inferencepolicies/status + - inferenceworkloads + - inferenceworkloads/status + - inferenceworkloads/finalizers + - distributedpolicies + - distributedpolicies/status + - distributedworkloads + - distributedworkloads/status + - distributedworkloads/finalizers + - persistentvolumeclaims + - serviceaccounts + - nodepools + - nodes + - services + - ingresses + - pods + verbs: + - get + - list + - watch + - apiGroups: + - route.openshift.io + resources: + - routes + - routes/custom-host + verbs: + - create + - delete + - watch + - list + - get + - update + - patch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# Run:AI Scheduler reader +# Allow the reading of the current state of the cluster (pods, nodes, pod-groups, jobs, StatefulSets, deployments) to make optimal scheduling decisions. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-scheduler-ro +rules: + - apiGroups: + - "" + - amlarc.azureml.com + - batch + - batch.volcano.sh + - kubeflow.org + - machinelearning.seldon.io + - policy + - run.ai + - scheduling.k8s.io + - scheduling.run.ai + - scheduling.incubator.k8s.io + - storage.k8s.io + - serving.knative.dev + - serving.kserve.io + - apps + resources: + - amljobs + - deployments + - configmaps + - jobs + - mpijobs + - pytorchjobs + - tfjobs + - namespaces + - xgboostjobs + - nodes + - persistentvolumes + - persistentvolumeclaims + - poddisruptionbudgets + - podgroups + - pods + - priorityclasses + - queues + - replicasets + - runaijobs + - seldondeployments + - storageclasses + - revisions + - configurations + - services + - inferenceservices + - csinodes + - csidrivers + - csistoragecapacities + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + - update + - patch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-scheduler-ro-kubevirt +rules: + - apiGroups: + - "" + - kubevirt.io + resources: + - virtualmachineinstances + - virtualmachines + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: workload-overseer +rules: + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - apiGroups: + - run.ai + resources: + - trainingworkloads + - interactiveworkloads + verbs: + - get + - list + - update + - watch + - delete + - apiGroups: + - run.ai + resources: + - projects + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# Allow the reading of the current state of pods & workloads to sync backend +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cluster-sync +rules: + - apiGroups: + - "" + - kubeflow.org + - scheduling.run.ai + - run.ai + - apps + - serving.knative.dev + - knative.dev + - storage.k8s.io + - machinelearning.seldon.io + - kubevirt.io + - amlarc.azureml.com + - batch + resources: + - nodes + - pods + - podgroups + - namespaces + - runaijobs + - mpijobs + - pytorchjobs + - tfjobs + - xgboostjobs + - notebooks + - seldondeployments + - virtualmachines + - virtualmachineinstances + - statefulsets + - replicasets + - amljobs + - revisions + - configurations + - cronjobs + - deployments + - jobs + - services + - nodepools + - projects + - interactiveworkloads + - trainingworkloads + - distributedworkloads + - persistentvolumeclaims + - storageclasses + - events + - externalworkloads + - interactivepolicies + - trainingpolicies + - scheduledworkflows + verbs: + - get + - list + - watch + - apiGroups: + - "workspace.devfile.io" + resources: + - devworkspaces + verbs: + - get + - list + - watch + - apiGroups: + - ray.io + resources: + - rayclusters + - rayjobs + - rayservices + verbs: + - get + - list + - watch + - apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - get + - list + - watch + - apiGroups: + - tekton.dev + resources: + - pipelineruns + - taskruns + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - secrets + verbs: + - list + - watch + - apiGroups: + - scheduling.k8s.io + resources: + - priorityclasses + verbs: + - get + - list + - watch + - apiGroups: + - run.ai + resources: + - externalworkloads/status + - interactiveworkloads/status + - trainingworkloads/status + - distributedworkloads/status + verbs: + - update + - patch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# This ClusterRole has no associated ClusterRoleBinding (only RoleBinding at the project level) +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cluster-sync-project +rules: + - apiGroups: + - "" + - run.ai + resources: + - externalworkloads + - trainingworkloads + - interactiveworkloads + - distributedworkloads + verbs: + - patch + - update +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: assets-sync +rules: + - apiGroups: + - "" + resources: + - secrets + - persistentvolumeclaims + - serviceaccounts + verbs: + - get + - list + - delete + - update + - create +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: assets-sync-cluster +rules: + - apiGroups: + - "" + - scheduling.run.ai + resources: + - namespaces + - departments + verbs: + - get + - list +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# Run:AI Mig Parted +# Allow the reading of the current state of the nodes to make changes in mig configuration. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-mig-parted +rules: + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch + - update + - patch + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + - delete +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# Run:AI Scheduler writer +# Allows the applying of scheduling decisions to the cluster, like updating pod, creating pod-group, etc. +# This ClusterRole has no associated ClusterRoleBinding (only RoleBinding at the project level) +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-scheduler-rw +rules: + - apiGroups: + - "" + - amlarc.azureml.com + - apps + - batch + - batch.volcano.sh + - kubeflow.org + - run.ai + - scheduling.run.ai + - scheduling.incubator.k8s.io + - serving.knative.dev + - apps + resources: + - amljobs + - configmaps + - events + - jobs + - mpijobs + - pytorchjobs + - tfjobs + - xgboostjobs + - persistentvolumeclaims + - podgroups + - podgroups/status + - pods + - pods/status + - pods/binding + - runaijobs + - statefulsets + - statefulsets/finalizers + - jobs/finalizers + - deployments + - deployments/finalizers + - runaijobs/finalizers + - mpijobs/finalizers + - pytorchjobs/finalizers + - tfjobs/finalizers + - xgboostjobs/finalizers + - replicasets/finalizers + - pods/finalizers + - revisions + - revisions/finalizers + - services + - services/finalizers + verbs: + - create + - delete + - get + - list + - patch + - update +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# Run:AI Agent +# Connects between the Run:AI GPU cluster and the Run:AI Backend. Creates Project CRDs +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-agent +rules: + - apiGroups: + - "" + resources: + - configmaps + verbs: + - list + - get + - update + - create + - watch + - apiGroups: + - "" + resources: + - namespaces + verbs: + - list + - apiGroups: + - run.ai + resources: + - projects + - nodepools + - nodepools/status + - accessrules + - accessrules/status + - trainingpolicies + - interactivepolicies + verbs: + - create + - delete + - get + - list + - update + - watch + - apiGroups: + - scheduling.run.ai + - scheduling.incubator.k8s.io + resources: + - departments + verbs: + - create + - delete + - get + - list + - update + - watch + - apiGroups: + - run.ai + resources: + - runaiconfigs + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# A Kubernetes Admission Controller +# Responsible for the management of Job submission policies and the validation of the input provided to submit the Job +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-admission-controller-ro +rules: + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - watch + - apiGroups: + - "" + - apps + - batch + - kubeflow.org + - run.ai + resources: + - configmaps + - statefulsets/finalizers + - jobs/finalizers + - deployments/finalizers + - runaijobs/finalizers + - mpijobs/finalizers + - pytorchjobs/finalizers + - tfjobs/finalizers + - xgboostjobs/finalizers + - replicasets/finalizers + - pods/finalizers + verbs: + - get + - apiGroups: + - run.ai + resources: + - nodepools + - projects + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# A Kubernetes Pod Binder with Admission Webhook +# Responsible for the management of Job submission policies and the validation of the input provided to submit the Job +# This ClusterRole has no associated ClusterRoleBinding (only RoleBinding at the project level) +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-binder-project +rules: + - apiGroups: + - "" + - apps + - batch + - kubeflow.org + - run.ai + resources: + - configmaps + - statefulsets/finalizers + - jobs/finalizers + - deployments/finalizers + - runaijobs/finalizers + - mpijobs/finalizers + - pytorchjobs/finalizers + - tfjobs/finalizers + - xgboostjobs/finalizers + - replicasets/finalizers + - pods/finalizers + verbs: + - create + - update + - apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - pods/finalizers + verbs: + - update + - apiGroups: + - "" + resources: + - pods/status + verbs: + - get + - patch + - update +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# A Kubernetes Admission Controller +# Responsible for the management of Job submission policies and the validation of the input provided to submit the Job +# This ClusterRole has no associated ClusterRoleBinding (only RoleBinding at the project level) +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-admission-controller-project +rules: + - apiGroups: + - "" + - apps + - batch + - kubeflow.org + - run.ai + resources: + - configmaps + - statefulsets/finalizers + - jobs/finalizers + - deployments/finalizers + - runaijobs/finalizers + - mpijobs/finalizers + - pytorchjobs/finalizers + - tfjobs/finalizers + - xgboostjobs/finalizers + - replicasets/finalizers + - pods/finalizers + verbs: + - create + - update +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +## Creation of custom certificates +## Relevant for regular Kubernetes. Not relevant for Openshift installations. +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-init-ca +rules: + - apiGroups: ["admissionregistration.k8s.io"] + resources: ["validatingwebhookconfigurations"] + verbs: ["get", "watch", "list", "create", "update", "patch", "delete"] + - apiGroups: ["admissionregistration.k8s.io"] + resources: ["mutatingwebhookconfigurations"] + verbs: ["get", "watch", "list", "create", "update", "patch", "delete"] + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["get"] + - apiGroups: ["certificates.k8s.io"] + resources: ["certificatesigningrequests"] + verbs: ["get", "watch", "list", "create", "update", "patch", "delete"] + - apiGroups: ["certificates.k8s.io"] + resources: ["certificatesigningrequests/approval", "certificatesigningrequests/status"] + verbs: ["update"] + - apiGroups: ["certificates.k8s.io"] + resources: ["signers"] + resourceNames: ["kubernetes.io/legacy-unknown", "kubernetes.io/kubelet-serving"] + verbs: ["approve"] +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# Used for an extension of the Kubernetes Job to the "runaijob" CRD +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-job-controller +rules: + - apiGroups: + - "" + resources: + - pods + - events + - configmaps + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - pods/exec + verbs: + - create + - apiGroups: + - run.ai + resources: + - '*' + verbs: + - '*' +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# Job Controller Writer. +# This ClusterRole has no associated ClusterRoleBinding (only RoleBinding at the project level) +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-job-controller-project +rules: + - apiGroups: + - "" + resources: + - pods + - events + - configmaps + verbs: + - create + - delete + - patch + - update +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +# Run:AI Projects +# Alows the reading of project-related data and editing of Run:AI specific CRDs. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-project-controller +rules: + - apiGroups: + - run.ai + resources: + - projects + - projects/finalizers + - projects/status + verbs: + - '*' + - apiGroups: + - scheduling.run.ai + - scheduling.incubator.k8s.io + resources: + - queues + - departments + - departments/finalizers + verbs: + - '*' + - apiGroups: + - "" + resources: + - configmaps + - namespaces + verbs: + - get + - list + - watch + - apiGroups: + - rbac.authorization.k8s.io + resources: + - rolebindings + verbs: + - get + - list + - watch + - apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-prometheus +rules: + - apiGroups: + - "" + resources: + - nodes + - nodes/metrics + - pods + - endpoints + - services + verbs: + - get + - list + - watch + - nonResourceURLs: + - /metrics + - /metrics/cadvisor + verbs: + - get +--- +# Source: runai-cluster/templates/clusterroles/external-workload-integrator.yaml +# Run:AI ExternalWorkloadIntegrator +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-external-workload-integrator +rules: + - apiGroups: + - run.ai + resources: + - externalworkloads + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - run.ai + resources: + - externalworkloads/status + verbs: + - get + - update + - patch + - watch + - apiGroups: + - run.ai + resources: + - externalworkloads/finalizers + verbs: + - update + - patch + - apiGroups: + - run.ai + resources: + - projects + - nodepools + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.run.ai + resources: + - departments + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - watch + - list + - apiGroups: + - run.ai + resources: + - trainingworkloads + - interactiveworkloads + - distributedworkloads + verbs: + - get + - list + - watch + - apiGroups: + - "workspace.devfile.io" + resources: + - devworkspaces + - devworkspaces/finalizers + verbs: + - get + - list + - watch + - apiGroups: + - ray.io + resources: + - rayclusters + - rayjobs + - rayservices + - rayclusters/finalizers + - rayjobs/finalizers + - rayservices/finalizers + verbs: + - get + - list + - watch + - apiGroups: + - "" + - apps + - machinelearning.seldon.io + - kubevirt.io + - kubeflow.org + - run.ai + - amlarc.azureml.com + - serving.knative.dev + - knative.dev + - batch + resources: + - deployments + - jobs + - runaijobs + - mpijobs + - pytorchjobs + - tfjobs + - xgboostjobs + - notebooks + - seldondeployments + - virtualmachines + - virtualmachineinstances + - statefulsets + - replicasets + - pods + - amljobs + - revisions + - configurations + - services + - cronjobs + - scheduledworkflows + verbs: + - get + - list + - watch + - apiGroups: + - "" + - apps + - machinelearning.seldon.io + - kubevirt.io + - kubeflow.org + - run.ai + - amlarc.azureml.com + - serving.knative.dev + - knative.dev + - batch + resources: + - deployments/finalizers + - jobs/finalizers + - runaijobs/finalizers + - mpijobs/finalizers + - pytorchjobs/finalizers + - tfjobs/finalizers + - xgboostjobs/finalizers + - seldondeployments/finalizers + - virtualmachines/finalizers + - virtualmachineinstances/finalizers + - statefulsets/finalizers + - replicasets/finalizers + - pods/finalizers + - amljobs/finalizers + - revisions/finalizers + - configurations/finalizers + - services/finalizers + - cronjobs/finalizers + - scheduledworkflows/finalizers + verbs: + - get + - list + - watch + - apiGroups: + - argoproj.io + resources: + - workflows + - workflows/finalizers + verbs: + - get + - list + - watch + - apiGroups: + - tekton.dev + resources: + - pipelineruns + - taskruns + - pipelineruns/finalizers + - taskruns/finalizers + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.run.ai + resources: + - podgroups + verbs: + - get + - list + - watch + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/external-workload-integrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-external-workload-integrator-project +rules: + - apiGroups: + - "" + resources: + - pods + verbs: + - update + - patch +--- +# Source: runai-cluster/templates/clusterroles/metrics-exporter.yaml +# Run:AI Metrics Exporter +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: metrics-exporter +rules: + - apiGroups: + - scheduling.run.ai + resources: + - queues + verbs: + - list + - get + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + - list + - get + - watch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - list + - get + - watch + - apiGroups: + - scheduling.run.ai + resources: + - podgroups + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.k8s.io + resources: + - priorityclasses + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - pods + verbs: + - list + - get + - watch +--- +# Source: runai-cluster/templates/clusterroles/node-scale-adjuster.yaml +# Run:AI Node Scale Adjuster +# Allows runai to work with cluster autoscalers +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: node-scale-adjuster-ro +rules: + - apiGroups: + - "" + resources: + - pods + verbs: + - list + - get + - watch +--- +# Source: runai-cluster/templates/clusterroles/nodepool-controller.yaml +# Run:AI NodePool Controller +# Allows the reading of nodepool related data and editing of Run:AI specific CRDs and Nodes. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: nodepool-controller +rules: + - apiGroups: + - run.ai + resources: + - nodepools + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - run.ai + resources: + - nodepools/status + verbs: + - get + - update + - patch + - watch + - apiGroups: + - run.ai + resources: + - nodepools/finalizers + verbs: + - update + - patch + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch + - update + - patch + - apiGroups: + - "" + - apps + resources: + - deployments + - pods + - services + verbs: + - get + - list + - watch + - apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - get + - list + - watch + - apiGroups: + - run.ai + resources: + - runaiconfigs + verbs: + - get + - list + - watch + - apiGroups: + - engine.run.ai + resources: + - schedulingshards + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +--- +# Source: runai-cluster/templates/clusterroles/pod-group-assigner.yaml +# Run:AI Pod Grouper +# Responsible to watch pods in the cluster and group them to podgroups according to their job type +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: pod-group-assigner +rules: + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + - patch + - update + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - watch + - apiGroups: + - scheduling.run.ai + resources: + - podgroups + verbs: + - get + - list + - watch + - update + - patch + - apiGroups: + - scheduling.run.ai + resources: + - queues + verbs: + - get + - list + - watch + - apiGroups: + - run.ai + resources: + - projects + - nodepools + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/pod-grouper.yaml +# Run:AI Pod Grouper +# Responsible to watch pods in the cluster and group them to podgroups according to their job type +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: pod-grouper +rules: + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - update + - watch + - patch + - apiGroups: + - "workspace.devfile.io" + resources: + - devworkspaces + verbs: + - get + - list + - watch + - apiGroups: + - "workspace.devfile.io" + resources: + - devworkspaces/finalizers + verbs: + - create + - update + - patch + - apiGroups: + - ray.io + resources: + - rayclusters + - rayjobs + - rayservices + verbs: + - get + - list + - watch + - apiGroups: + - ray.io + resources: + - rayclusters/finalizers + - rayjobs/finalizers + - rayservices/finalizers + verbs: + - create + - update + - patch + - apiGroups: + - "" + - apps + - machinelearning.seldon.io + - kubevirt.io + - kubeflow.org + - run.ai + - amlarc.azureml.com + - serving.knative.dev + - knative.dev + - batch + resources: + - deployments + - jobs + - runaijobs + - mpijobs + - pytorchjobs + - tfjobs + - xgboostjobs + - notebooks + - seldondeployments + - virtualmachines + - virtualmachineinstances + - statefulsets + - replicasets + - pods + - amljobs + - revisions + - configurations + - services + - cronjobs + verbs: + - get + - list + - watch + - apiGroups: + - "" + - apps + - machinelearning.seldon.io + - kubevirt.io + - kubeflow.org + - run.ai + - amlarc.azureml.com + - serving.knative.dev + - knative.dev + - batch + resources: + - deployments/finalizers + - jobs/finalizers + - runaijobs/finalizers + - mpijobs/finalizers + - pytorchjobs/finalizers + - tfjobs/finalizers + - xgboostjobs/finalizers + - seldondeployments/finalizers + - virtualmachines/finalizers + - virtualmachineinstances/finalizers + - statefulsets/finalizers + - replicasets/finalizers + - pods/finalizers + - amljobs/finalizers + - revisions/finalizers + - configurations/finalizers + - services/finalizers + - cronjobs/finalizers + verbs: + - get + - list + - watch + - update + - create + - apiGroups: + - scheduling.run.ai + resources: + - podgroups + verbs: + - get + - list + - watch + - update + - create +--- +# Source: runai-cluster/templates/clusterroles/project-controller-cluster-wide-resources.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-project-controller-cluster-secret +rules: + - apiGroups: + - run.ai + resources: + - projects + - projects/finalizers + verbs: + - '*' + - apiGroups: + - scheduling.run.ai + - scheduling.incubator.k8s.io + resources: + - queues + verbs: + - '*' + - apiGroups: + - "" + resources: + - secrets + - serviceaccounts + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/project-controller-cluster-wide-resources.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-project-controller-cluster-secret-per-project +rules: + - apiGroups: + - "" + resourceNames: + - default + resources: + - serviceaccounts + verbs: + - update + - create + - apiGroups: + - "" + resources: + - secrets + - secrets/finalizers + verbs: + - update + - create + - delete +--- +# Source: runai-cluster/templates/clusterroles/project-controller-cluster-wide-resources.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-project-controller-cluster-pvc +rules: + - apiGroups: + - run.ai + resources: + - projects + - projects/finalizers + verbs: + - '*' + - apiGroups: + - scheduling.run.ai + - scheduling.incubator.k8s.io + resources: + - queues + verbs: + - '*' + - apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/project-controller-cluster-wide-resources.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-project-controller-cluster-pvc-per-project +rules: + - apiGroups: + - "" + resources: + - persistentvolumeclaims + - persistentvolumeclaims/finalizers + verbs: + - update + - create + - delete + - list + - watch + - patch +--- +# Source: runai-cluster/templates/clusterroles/project-controller-limit-range.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-project-controller-limit-range +rules: + - apiGroups: + - "" + resources: + - limitranges + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/project-controller-limit-range.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-project-controller-limit-range-per-project +rules: + - apiGroups: + - "" + resourceNames: + - runai-limit-range + resources: + - limitranges + - limitranges/finalizers + verbs: + - update + - create + - delete + - patch +--- +# Source: runai-cluster/templates/clusterroles/project-controller-ns-creation.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-project-controller-ns-creation +rules: + - apiGroups: + - "" + resources: + - namespaces + - namespaces/finalizers + verbs: + - create + - update +--- +# Source: runai-cluster/templates/clusterroles/project-controller-rb-creation.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-project-controller-rolebinding-creation +rules: + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + verbs: + - bind + - apiGroups: + - rbac.authorization.k8s.io + resources: + - rolebindings + verbs: + - '*' +--- +# Source: runai-cluster/templates/clusterroles/project-controller-service-monitor-creation.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-project-controller-servicemonitor-creation +rules: + - apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - create +--- +# Source: runai-cluster/templates/clusterroles/status-updater.yaml +# Run:AI Status Updater +# Responsible to watch pods in the cluster and update status and usage metrics on pod, pod-group and top-owner +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: status-updater +rules: + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + - update + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - update + - watch + - patch + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - pods/status + verbs: + - get + - patch + - update + - apiGroups: + - "scheduling.run.ai" + resources: + - podgroups + verbs: + - get + - list + - watch + - patch + - apiGroups: + - batch + resources: + - jobs + verbs: + - get + - list + - watch + - patch + - apiGroups: + - apps + resources: + - deployments + - statefulsets + - replicasets + verbs: + - get + - list + - watch + - patch + - apiGroups: + - machinelearning.seldon.io + resources: + - seldondeployments + verbs: + - get + - list + - watch + - patch + - apiGroups: + - kubevirt.io + resources: + - virtualmachines + - virtualmachineinstances + verbs: + - get + - list + - watch + - patch + - apiGroups: + - amlarc.azureml.com + resources: + - amljobs + verbs: + - get + - list + - watch + - patch + - apiGroups: + - kubeflow.org + resources: + - mpijobs + - notebooks + - pytorchjobs + - tfjobs + - xgboostjobs + - scheduledworkflows + verbs: + - get + - list + - watch + - patch + - apiGroups: + - run.ai + resources: + - runaijobs + verbs: + - get + - list + - watch + - patch + - apiGroups: + - serving.knative.dev + - knative.dev + resources: + - revisions + - configurations + - services + verbs: + - get + - list + - watch + - patch + - apiGroups: + - ray.io + resources: + - rayclusters + - rayjobs + - rayservices + verbs: + - get + - list + - watch + - patch + - apiGroups: + - argoproj.io + resources: + - workflows + verbs: + - get + - list + - watch + - apiGroups: + - tekton.dev + resources: + - pipelineruns + - taskruns + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/templates/clusterroles/status-updater.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: status-updater-ro +rules: + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - pods/status + verbs: + - get + - apiGroups: + - "scheduling.run.ai" + resources: + - podgroups + verbs: + - get + - list + - watch + - apiGroups: + - batch + resources: + - jobs + verbs: + - get + - list + - watch + - apiGroups: + - run.ai + resources: + - runaijobs + verbs: + - get + - list + - watch +--- +# Source: runai-cluster/charts/runai-engine/templates/operator/rbac/role_binding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-engine-operator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-engine-operator +subjects: +- kind: ServiceAccount + name: engine-operator + namespace: runai +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/binder-ro.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-binder-ro +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-binder-ro +subjects: + - kind: ServiceAccount + name: binder + namespace: runai +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/pod-group-controller.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: pod-group-controller-ro +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: pod-group-controller-ro +subjects: + - kind: ServiceAccount + name: pod-group-controller + namespace: runai +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/pod-grouper.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: pod-grouper-engine +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: pod-grouper-engine +subjects: + - kind: ServiceAccount + name: pod-grouper + namespace: runai +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/queue-controller.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: queue-controller-engine +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: queue-controller-engine +subjects: + - kind: ServiceAccount + name: queue-controller + namespace: runai +--- +# Source: runai-cluster/charts/runai-engine/templates/rbac/scheduler.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-engine-scheduler-cluster-wide +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-engine-scheduler-cluster-wide +subjects: + - kind: ServiceAccount + name: runai-scheduler + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/accessrule-controller.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-accessrule-controller +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-accessrule-controller +subjects: + - kind: ServiceAccount + name: accessrule-controller + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/compute-resource-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-compute-resource-administrator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-compute-resource-administrator +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/credentials-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-credentials-administrator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-credentials-administrator +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/data-source-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-data-source-administrator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-data-source-administrator +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-department-administrator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-department-administrator +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-viewer.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-department-viewer +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-department-viewer +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/editor.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-editor +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-editor +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/environment-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-environment-administrator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-environment-administrator +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l1-researcher.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-l1-researcher +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-l1-researcher +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l2-researcher.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-l2-researcher +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-l2-researcher +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/ml-engineer.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-ml-engineer +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-ml-engineer +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/research-manager.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-research-manager +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-research-manager +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/system-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-system-administrator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-system-administrator +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/template-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-template-administrator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-template-administrator +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/viewer.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-viewer +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-viewer +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-operator + namespace: runai +subjects: + - kind: ServiceAccount + name: runai-operator + namespace: runai +roleRef: + kind: ClusterRole + name: runai-operator + apiGroup: rbac.authorization.k8s.io +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: researcher-service-ro +subjects: + - kind: ServiceAccount + name: researcher-service + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: researcher-service-ro +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: workload-controller-ro +subjects: + - kind: ServiceAccount + name: workload-controller + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: workload-controller-ro +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-scheduler-ro +subjects: + - kind: ServiceAccount + name: runai-scheduler + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-scheduler-ro +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-scheduler-ro-kubevirt +subjects: + - kind: ServiceAccount + name: runai-scheduler + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-scheduler-ro-kubevirt +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: workload-overseer +subjects: + - kind: ServiceAccount + name: workload-overseer + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: workload-overseer +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: cluster-sync +subjects: + - kind: ServiceAccount + name: cluster-sync + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-sync +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: assets-sync +subjects: + - kind: ServiceAccount + name: assets-sync + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: assets-sync-cluster +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-mig-parted +subjects: + - kind: ServiceAccount + name: runai-mig-manager + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-mig-parted +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-agent +subjects: + - kind: ServiceAccount + name: runai-agent + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-agent +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-admission-controller-ro +roleRef: + kind: ClusterRole + apiGroup: rbac.authorization.k8s.io + name: runai-admission-controller-ro +subjects: + - kind: ServiceAccount + name: runai-admission-controller + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-init-ca +roleRef: + kind: ClusterRole + apiGroup: rbac.authorization.k8s.io + name: runai-init-ca +subjects: + - kind: ServiceAccount + namespace: runai + name: init-ca +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-job-controller +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-job-controller +subjects: + - kind: ServiceAccount + name: runai-job-controller + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-project-controller +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-project-controller +subjects: + - kind: ServiceAccount + name: runai-project-controller + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-prometheus +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-prometheus +subjects: + - kind: ServiceAccount + name: runai-prometheus + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/external-workload-integrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-external-workload-integrator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-external-workload-integrator +subjects: + - kind: ServiceAccount + name: external-workload-integrator + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/metrics-exporter.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: metrics-exporter +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: metrics-exporter +subjects: + - kind: ServiceAccount + name: metrics-exporter + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/node-scale-adjuster.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: node-scale-adjuster-ro +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: node-scale-adjuster-ro +subjects: + - kind: ServiceAccount + name: node-scale-adjuster + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/nodepool-controller.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: nodepool-controller +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: nodepool-controller +subjects: + - kind: ServiceAccount + name: nodepool-controller + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/pod-group-assigner.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: pod-group-assigner +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: pod-group-assigner +subjects: + - kind: ServiceAccount + name: pod-group-assigner + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/pod-grouper.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: pod-grouper +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: pod-grouper +subjects: + - kind: ServiceAccount + name: pod-grouper + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/project-controller-cluster-wide-resources.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-project-controller-cluster-secret +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-project-controller-cluster-secret +subjects: + - kind: ServiceAccount + name: runai-project-controller + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/project-controller-cluster-wide-resources.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-project-controller-cluster-pvc +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-project-controller-cluster-pvc +subjects: + - kind: ServiceAccount + name: runai-project-controller + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/project-controller-limit-range.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-project-controller-limit-range +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-project-controller-limit-range +subjects: + - kind: ServiceAccount + name: runai-project-controller + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/project-controller-ns-creation.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-project-controller-ns-creation +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-project-controller-ns-creation +subjects: + - kind: ServiceAccount + name: runai-project-controller + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/project-controller-rb-creation.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-project-controller-rolebinding-creation +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-project-controller-rolebinding-creation +subjects: + - kind: ServiceAccount + name: runai-project-controller + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/project-controller-service-monitor-creation.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-project-controller-servicemonitor-creation +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-project-controller-servicemonitor-creation +subjects: + - kind: ServiceAccount + name: runai-project-controller + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/status-updater.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: status-updater-ro +subjects: + - kind: ServiceAccount + name: status-updater + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: status-updater-ro +--- +# Source: runai-cluster/charts/runai-engine/templates/operator/rbac/leader_election_role.yaml +# permissions to do leader election. +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: leader-election-role + namespace: runai +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: workload-controller-migration + namespace: runai +rules: + - apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - delete + - watch + - list + - get + - update + - patch +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + namespace: runai + name: runai-public-config-viewer +rules: + - apiGroups: [""] + resources: ["configmaps"] + resourceNames: + - runai-public + verbs: ["get", "watch", "list"] +--- +# Source: runai-cluster/templates/clusterroles/node-scale-adjuster.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: node-scale-adjuster + namespace: runai-scale-adjust +rules: + - apiGroups: + - "" + resources: + - pods + verbs: + - create + - update + - delete + - patch +--- +# Source: runai-cluster/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: runai-operator + namespace: runai +rules: + - apiGroups: + - "" + - batch + - apps + - networking.k8s.io + - rbac.authorization.k8s.io + - monitoring.coreos.com + - run.ai + - route.openshift.io + resources: + - prometheuses + - prometheusrules + - pods + - services + - configmaps + - secrets + - serviceaccounts + - jobs + - deployments + - daemonsets + - replicasets + - statefulsets + - roles + - rolebindings + - ingresses + - runaiconfigs + - runaiconfigs/status + - runaiconfigs/finalizers + - interactivepolicies + - interactivepolicies/status + - interactiveworkloads + - interactiveworkloads/status + - trainingpolicies + - trainingpolicies/status + - trainingworkloads + - trainingworkloads/status + - inferencepolicies + - inferencepolicies/status + - inferenceworkloads + - inferenceworkloads/status + - distributedpolicies + - distributedpolicies/status + - distributedworkloads + - distributedworkloads/status + - servicemonitors + - podmonitors + - routes + - routes/custom-host + - validatingwebhookconfigurations + verbs: + - '*' + - apiGroups: + - "" + resources: + - events + verbs: + - create + - apiGroups: + - "" + resources: + - pods + verbs: + - deletecollection + - apiGroups: + - kubeflow.org + resources: + - mpijobs + - pytorchjobs + - tfjobs + - xgboostjobs + verbs: + - create +--- +# Source: runai-cluster/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + creationTimestamp: null + name: runai-operator + namespace: monitoring +rules: + - apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +--- +# Source: runai-cluster/charts/runai-engine/templates/operator/rbac/leader_election_role_binding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: leader-election-rolebinding + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: leader-election-role +subjects: +- kind: ServiceAccount + name: engine-operator + namespace: runai +--- +# Source: runai-cluster/charts/runai-engine/templates/resource-reservation-namespace.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-scheduler-rw-engine + namespace: runai-reservation +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-scheduler-rw-engine +subjects: + - kind: ServiceAccount + name: runai-scheduler + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/compute-resource-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-compute-resource-administrator-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-compute-resource-administrator-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/credentials-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-credentials-administrator-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-credentials-administrator-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/credentials-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-credentials-administrator-runai-cs + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-credentials-administrator-runai-cs +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/data-source-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-data-source-administrator-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-data-source-administrator-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/data-source-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-data-source-administrator-runai-cs + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-data-source-administrator-runai-cs +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-department-administrator-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-department-administrator-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-department-administrator-runai-cs + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-department-administrator-runai-cs +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/department-viewer.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-department-viewer-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-department-viewer-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/editor.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-editor-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-editor-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/editor.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-editor-runai-cs + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-editor-runai-cs +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/environment-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-environment-administrator-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-environment-administrator-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l1-researcher.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-l1-researcher-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-l1-researcher-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l1-researcher.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-l1-researcher-runai-cs + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-l1-researcher-runai-cs +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/l2-researcher.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-l2-researcher-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-l2-researcher-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/ml-engineer.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-ml-engineer-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-ml-engineer-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/research-manager.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-research-manager-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-research-manager-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/research-manager.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-research-manager-runai-cs + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-research-manager-runai-cs +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/system-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-system-administrator-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-system-administrator-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/system-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-system-administrator-runai-cs + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-system-administrator-runai-cs +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/template-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-template-administrator-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-template-administrator-runai +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/template-administrator.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-template-administrator-runai-cs + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-template-administrator-runai-cs +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/viewer.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-viewer-runai + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-viewer-runai +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: workload-controller-migration + namespace: runai +subjects: + - kind: ServiceAccount + name: workload-controller + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: workload-controller-migration +--- +# Source: runai-cluster/templates/clusterroles/base.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-public-config-viewer + namespace: runai +roleRef: + kind: Role + name: runai-public-config-viewer + apiGroup: rbac.authorization.k8s.io +subjects: + - kind: Group + name: system:authenticated + apiGroup: rbac.authorization.k8s.io + +# The following ClusterRole and ClusterRoleBinding are used +# by our private Prometheus instance +--- +# Source: runai-cluster/templates/clusterroles/node-scale-adjuster.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: node-scale-adjuster + namespace: runai-scale-adjust +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: node-scale-adjuster +subjects: + - kind: ServiceAccount + name: node-scale-adjuster + namespace: runai +--- +# Source: runai-cluster/templates/clusterroles/project-controller-rb-creation.yaml +# Do not remove the following RoleBinding! It is needed for feature RUN-7158 +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-project-controller-rolebinding-creation + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-project-controller-rolebinding-creation +subjects: + - kind: ServiceAccount + name: runai-project-controller + namespace: runai +--- +# Source: runai-cluster/templates/rbac.yaml +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-operator + namespace: runai +subjects: +- kind: ServiceAccount + name: runai-operator +roleRef: + kind: Role + name: runai-operator + apiGroup: rbac.authorization.k8s.io +--- +# Source: runai-cluster/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: runai-operator + namespace: monitoring +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: runai-operator +subjects: + - kind: ServiceAccount + name: runai-operator + namespace: runai +--- +# Source: runai-cluster/charts/runai-engine/templates/operator/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: engine-operator + namespace: runai + labels: + app: engine-operator +spec: + selector: + matchLabels: + app: engine-operator + replicas: 1 + template: + metadata: + labels: + app: engine-operator + spec: + containers: + - command: + - /manager + image: gcr.io/run-ai-prod/engine-operator:2.16.79 + imagePullPolicy: Always + name: manager + env: + - name: MS_REPOSITORY + value: gcr.io/run-ai-prod + - name: MS_TAG + value: 2.16.79 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + resources: + + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 50m + memory: 256Mi + serviceAccountName: engine-operator + terminationGracePeriodSeconds: 10 + imagePullSecrets: + - name: image-registry-secret + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 1 + preference: + matchExpressions: + - key: node-role.kubernetes.io/runai-system + operator: Exists +--- +# Source: runai-cluster/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: runai-operator +spec: + replicas: 1 + selector: + matchLabels: + name: runai + template: + metadata: + labels: + name: runai + spec: + serviceAccountName: runai-operator + containers: + - name: runai-go-operator + image: gcr.io/run-ai-prod/go-operator:2.16.79 + imagePullPolicy: + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + resources: + + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 50m + memory: 256Mi + env: + - name: WATCH_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + imagePullSecrets: + - name: gcr-secret + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 1 + preference: + matchExpressions: + - key: node-role.kubernetes.io/runai-system + operator: Exists +--- +# Source: runai-cluster/templates/clusterroles/auth-rbac/definitions-and-readme.yaml +# "runai-researcher" ClusterRole (in base.yaml) - +# project-controller used to create 1 RoleBinding in each project's namespace, the subjects being all Permissions.Users+Groups of the project; +# it is now embedded as part of the ClusterRoles here, in the "$extraJobsDeploymentsReadNamespaced..." and "$extraJobsDeploymentsCRUDNamespaced...". +# "runai-storageclass-lister" ClusterRole + ClusterRoleBinding (in base.yaml) - +# agent used to update the ClusterRoleBinding, assigning the subjects to be all users and groups in the system that are "researcher"s. +# it is now embedded as part of the ClusterRoles here, in the "$extraJobsDeploymentsReadClustered...". +# "runai-cluster-viewer" ClusterRole + ClusterRoleBinding (in base.yaml) - +# agent used to update the ClusterRoleBinding, assigning the subjects to be all users and groups in the system. +# it is now embedded as part of the ClusterRoles here, in the "extraJobsDeployments...". //TODO: validate +# "runai-template-viewer" Role + RoleBinding in "runai" namespace (in base.yaml) - +# agent used to update the RoleBinding, assigning the subjects to be all users and groups in the system. +# it is now embedded as part of the ClusterRoles here, in the "$policies..." and "$templates..." ("$policiesAndTemplatesApiGroups..."). //TODO: do +# "runai-cli-index-map-editor" Role + RoleBinding in "runai" namespace (in base.yaml) - +# agent used to update the RoleBinding, assigning the subjects to be all users and groups in the system. +# it is now embedded as part of the ClusterRoles here, in the "$runaiCliIndexMapEditor...". //TODO: do +# "runai-research-manager" ClusterRoleBinding (that points to "runai-researcher" ClusterRole) (in base.yaml) - +# agent used to update the ClusterRoleBinding, assigning the subjects to be all users and groups in the system that are "researcher manager"s. +# it is now embedded as part of the ClusterRoles here. +# +# $extraJobsDeploymentsCRUDNamespaced ApiGroups and Resources -> for namespaced ClusterRoles that include CRUD on jobs and/or deployments +# $extraJobsDeploymentsReadNamespaced ApiGroups and Resources -> for namespaced ClusterRoles that include Read on jobs and/or deployments +# $extraJobsDeploymentsWatchNamespaced ApiGroups and Resources -> also for namespaced ClusterRoles that include Read on jobs and/or deployments; but those with "watch" verbs +# $extraJobsDeploymentsReadClustered ApiGroups and Resources -> for cluster-scoped ClusterRoles that include Read on jobs and/or deployments +# $runaiCliIndexMapEditor ApiGroups, Resources, ResourceNames and Verbs -> +# a specific configmap rule, to be placed in the Role (and RoleBinding..) of "runai" namespace, ONLY for roles that include CRUD on jobs and/or deployments. + + +################################ +# ClusterRoles Explanation: +# For each backend Role, we will have 3 or 4 ClusterRoles existing. +# And for each backend AccessRule, the following will occur: +# "runai-" - accessrule's subject should exist in same-named ClusterRoleBinding. +# "runai--ns" - accessrule's subject should exist in RoleBinding in each namespace of the scope. +# "runai--runai" - accessrule's subject should exist in RoleBinding in "runai" namespace. +# "runai--runai-cs" - only if the scope is CLUSTER_SCOPE - accessrule's subject should exist in RoleBinding in "runai" namespace. +# +# Note: when adding a new role: add it to the "resourceNames" in the "runai-accessrule-controller" ClusterRole (in accessrule_controller.yaml). +--- +# Source: runai-cluster/templates/grafana-secret.yaml +# consider moving this secret to be managed by the operator +--- +# Source: runai-cluster/templates/runaiconfig.yaml +apiVersion: run.ai/v1 +kind: RunaiConfig +metadata: + name: runai +spec: + init-ca: + enabled: true + project-controller: + clusterWidePvc: true + createServiceMonitors: true + prometheus: + spec: + remoteWrite: + - url: https://prometheus-blocks-prod-us-central1.grafana.net/api/prom/push + writeRelabelConfigs: + - action: keep + regex: + sourceLabels: + - __name__ +--- +# Source: runai-cluster/charts/runai-engine/templates/hooks/post-install-rbac.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: runai-engine-post-install + namespace: runai +--- +# Source: runai-cluster/templates/hooks/post-install-rbac.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: runai-post-install + namespace: runai + labels: + run.ai/hook: post-install +--- +# Source: runai-cluster/templates/hooks/post-upgrade-rbac.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: runai-post-upgrade + namespace: runai + labels: + run.ai/hook: post-upgrade +--- +# Source: runai-cluster/templates/hooks/pre-delete-rbac.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: runai-pre-delete + namespace: runai + labels: + run.ai/hook: pre-delete +--- +# Source: runai-cluster/templates/hooks/pre-install-rbac.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: runai-pre-install + namespace: runai + labels: + run.ai/hook: pre-install +--- +# Source: runai-cluster/templates/hooks/pre-upgrade-rbac.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: runai-pre-upgrade + namespace: runai + labels: + run.ai/hook: pre-upgrade +--- +# Source: runai-cluster/templates/hooks/upgrade_crds/rbac.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: crd-upgrader + namespace: runai +--- +# Source: runai-cluster/charts/runai-engine/templates/hooks/post-install-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-engine-post-install + annotations: +rules: + - apiGroups: + - engine.run.ai + resources: + - configs + verbs: + - create + - apiGroups: + - scheduling.run.ai + resources: + - queues + verbs: + - create + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get +--- +# Source: runai-cluster/templates/hooks/post-install-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-post-install + labels: + run.ai/hook: post-install +rules: + - apiGroups: + - config.openshift.io + resources: + - clusteroperators + verbs: + - get + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - apiGroups: + - "" + resources: + - nodes + verbs: + - list +--- +# Source: runai-cluster/templates/hooks/post-upgrade-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-post-upgrade + labels: + run.ai/hook: post-upgrade +rules: + - apiGroups: + - config.openshift.io + resources: + - clusteroperators + verbs: + - get + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - apiGroups: + - "" + resources: + - nodes + verbs: + - list +--- +# Source: runai-cluster/templates/hooks/pre-delete-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-pre-delete + labels: + run.ai/hook: pre-delete +rules: + - apiGroups: + - run.ai + resources: + - runaiconfigs + verbs: + - delete +--- +# Source: runai-cluster/templates/hooks/pre-install-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-pre-install + labels: + run.ai/hook: pre-install +rules: + - apiGroups: + - '' + - 'operator.openshift.io' + resources: + - namespaces + - ingresscontrollers + verbs: + - '*' + - apiGroups: + - management.cattle.io + resources: + - projects + verbs: + - updatepsa + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - apiGroups: + - "" + resources: + - nodes + verbs: + - list + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterrolebindings + resourceNames: + - runai-research-manager + verbs: + - get + - list + - delete +--- +# Source: runai-cluster/templates/hooks/pre-upgrade-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-pre-upgrade + labels: + run.ai/hook: pre-upgrade +rules: + - apiGroups: + - management.cattle.io + resources: + - projects + verbs: + - updatepsa + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - apiGroups: + - "" + resources: + - nodes + verbs: + - list + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - patch + resourceNames: + - runai + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterrolebindings + resourceNames: + - runai-research-manager + verbs: + - get + - list + - delete +--- +# Source: runai-cluster/templates/hooks/upgrade_crds/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: runai-crd-upgrader + annotations: +rules: +- apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: ["get", "list", "update", "patch", "create"] +--- +# Source: runai-cluster/charts/runai-engine/templates/hooks/post-install-rbac.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-engine-post-install + namespace: runai + annotations: +subjects: + - kind: ServiceAccount + name: runai-engine-post-install + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-engine-post-install +--- +# Source: runai-cluster/templates/hooks/post-install-rbac.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-post-install + namespace: runai + labels: + run.ai/hook: post-install +subjects: + - kind: ServiceAccount + name: runai-post-install + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-post-install +--- +# Source: runai-cluster/templates/hooks/post-upgrade-rbac.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-post-upgrade + namespace: runai + labels: + run.ai/hook: post-upgrade +subjects: + - kind: ServiceAccount + name: runai-post-upgrade + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-post-upgrade +--- +# Source: runai-cluster/templates/hooks/pre-delete-rbac.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-pre-delete + labels: + run.ai/hook: pre-delete +subjects: + - kind: ServiceAccount + name: runai-pre-delete + namespace: runai +roleRef: + kind: ClusterRole + name: runai-pre-delete + apiGroup: rbac.authorization.k8s.io +--- +# Source: runai-cluster/templates/hooks/pre-install-rbac.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-pre-install + namespace: runai + labels: + run.ai/hook: pre-install +subjects: + - kind: ServiceAccount + name: runai-pre-install + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-pre-install +--- +# Source: runai-cluster/templates/hooks/pre-upgrade-rbac.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-pre-upgrade + labels: + run.ai/hook: pre-upgrade +subjects: + - kind: ServiceAccount + name: runai-pre-upgrade + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-pre-upgrade +--- +# Source: runai-cluster/templates/hooks/upgrade_crds/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: runai-crd-upgrader + annotations: +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: runai-crd-upgrader +subjects: +- kind: ServiceAccount + name: crd-upgrader + namespace: runai +--- +# Source: runai-cluster/templates/hooks/post-install-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: runai-post-install + namespace: runai + labels: + run.ai/hook: post-install +rules: + - apiGroups: + - run.ai + resources: + - runaiconfigs + verbs: + - get + - create + - update + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - create + - update +--- +# Source: runai-cluster/templates/hooks/post-install-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: runai-post-install + namespace: runai-scale-adjust + labels: + run.ai/hook: post-install +rules: + - apiGroups: + - run.ai + resources: + - runaiconfigs + verbs: + - get + - create + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - create + - update +--- +# Source: runai-cluster/templates/hooks/post-install-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: runai-post-install + namespace: runai-reservation + labels: + run.ai/hook: post-install +rules: + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - create + - update +--- +# Source: runai-cluster/templates/hooks/post-upgrade-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: runai-post-upgrade + namespace: runai + labels: + run.ai/hook: post-upgrade +rules: + - apiGroups: + - run.ai + resources: + - runaiconfigs + verbs: + - get + - create + - update + - apiGroups: + - '' + resources: + - configmaps + verbs: + - update + - get + - delete + - apiGroups: + - '' + resources: + - secrets + verbs: + - get + - create + - update +--- +# Source: runai-cluster/templates/hooks/post-upgrade-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: runai-post-upgrade + namespace: runai-reservation + labels: + run.ai/hook: post-upgrade +rules: + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - create + - update +--- +# Source: runai-cluster/templates/hooks/post-upgrade-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: runai-post-upgrade + namespace: runai-scale-adjust + labels: + run.ai/hook: post-upgrade +rules: + - apiGroups: + - run.ai + resources: + - runaiconfigs + verbs: + - get + - create + - update + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - create + - update +--- +# Source: runai-cluster/templates/hooks/pre-install-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: runai-pre-install + namespace: runai + labels: + run.ai/hook: pre-install +rules: + - apiGroups: + - '' + resources: + - configmaps + - secrets + verbs: + - get + - delete + - create +--- +# Source: runai-cluster/templates/hooks/pre-upgrade-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: runai-pre-upgrade + namespace: runai + labels: + run.ai/hook: pre-upgrade +rules: + - apiGroups: + - run.ai + resources: + - runaiconfigs + verbs: + - get + - apiGroups: + - '' + resources: + - configmaps + - secrets + verbs: + - get + - create + - delete +--- +# Source: runai-cluster/templates/hooks/post-install-rbac.yaml +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-post-install + namespace: runai + labels: + run.ai/hook: post-install +subjects: + - kind: ServiceAccount + name: runai-post-install + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: runai-post-install +--- +# Source: runai-cluster/templates/hooks/post-install-rbac.yaml +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-post-install + namespace: runai-scale-adjust + labels: + run.ai/hook: post-install +subjects: + - kind: ServiceAccount + name: runai-post-install + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: runai-post-install +--- +# Source: runai-cluster/templates/hooks/post-install-rbac.yaml +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-post-install + namespace: runai-reservation + labels: + run.ai/hook: post-install +subjects: + - kind: ServiceAccount + name: runai-post-install + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: runai-post-install +--- +# Source: runai-cluster/templates/hooks/post-upgrade-rbac.yaml +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-post-upgrade + namespace: runai + labels: + run.ai/hook: post-upgrade +subjects: + - kind: ServiceAccount + name: runai-post-upgrade + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: runai-post-upgrade +--- +# Source: runai-cluster/templates/hooks/post-upgrade-rbac.yaml +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-post-upgrade + namespace: runai-reservation + labels: + run.ai/hook: post-upgrade +subjects: + - kind: ServiceAccount + name: runai-post-upgrade + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: runai-post-upgrade +--- +# Source: runai-cluster/templates/hooks/post-upgrade-rbac.yaml +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-post-upgrade + namespace: runai-scale-adjust + labels: + run.ai/hook: post-upgrade +subjects: + - kind: ServiceAccount + name: runai-post-upgrade + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: runai-post-upgrade +--- +# Source: runai-cluster/templates/hooks/pre-install-rbac.yaml +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-pre-install + namespace: runai + labels: + run.ai/hook: pre-install +subjects: + - kind: ServiceAccount + name: runai-pre-install + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: runai-pre-install +--- +# Source: runai-cluster/templates/hooks/pre-upgrade-rbac.yaml +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: runai-pre-upgrade + namespace: runai + labels: + run.ai/hook: pre-upgrade +subjects: + - kind: ServiceAccount + name: runai-pre-upgrade + namespace: runai +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: runai-pre-upgrade +--- +# Source: runai-cluster/templates/hooks/post-install-job.yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: post-install + namespace: runai + labels: + run.ai/hook: post-install +spec: + backoffLimit: 0 + template: + metadata: + labels: + run.ai/hook: post-install + spec: + serviceAccountName: runai-post-install + restartPolicy: Never + containers: + - name: post-install + image: gcr.io/run-ai-prod/go-operator:2.16.79 + imagePullPolicy: + args: + - --post-install + - --control-plane-url= + - --control-plane-client-id= + - --control-plane-client-secret= + - --cluster-uid= + - --cluster-url= + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + resources: + + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 50m + memory: 256Mi + imagePullSecrets: + - name: gcr-secret + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 1 + preference: + matchExpressions: + - key: node-role.kubernetes.io/runai-system + operator: Exists +--- +# Source: runai-cluster/templates/hooks/post-upgrade-job.yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: post-upgrade + namespace: runai + labels: + run.ai/hook: post-upgrade +spec: + backoffLimit: 0 + template: + metadata: + labels: + run.ai/hook: post-upgrade + spec: + serviceAccountName: runai-post-upgrade + restartPolicy: Never + containers: + - name: post-upgrade + image: gcr.io/run-ai-prod/go-operator:2.16.79 + imagePullPolicy: + args: + - --post-upgrade + - --control-plane-url= + - --control-plane-client-id= + - --control-plane-client-secret= + - --cluster-uid= + - --cluster-url= + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + resources: + + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 50m + memory: 256Mi + imagePullSecrets: + - name: gcr-secret + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 1 + preference: + matchExpressions: + - key: node-role.kubernetes.io/runai-system + operator: Exists +--- +# Source: runai-cluster/templates/hooks/pre-delete-job.yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: pre-delete + namespace: runai + labels: + run.ai/hook: pre-delete +spec: + backoffLimit: 0 + template: + metadata: + labels: + run.ai/hook: pre-delete + spec: + serviceAccountName: runai-pre-delete + restartPolicy: Never + containers: + - name: pre-delete + image: gcr.io/run-ai-prod/go-operator:2.16.79 + imagePullPolicy: + args: + - --pre-delete + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + resources: + + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 50m + memory: 256Mi + imagePullSecrets: + - name: gcr-secret + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 1 + preference: + matchExpressions: + - key: node-role.kubernetes.io/runai-system + operator: Exists +--- +# Source: runai-cluster/templates/hooks/pre-install-job.yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: pre-install + namespace: runai + labels: + run.ai/hook: pre-install +spec: + backoffLimit: 0 + template: + metadata: + labels: + run.ai/hook: pre-install + spec: + serviceAccountName: runai-pre-install + restartPolicy: Never + containers: + - name: pre-install + image: gcr.io/run-ai-prod/go-operator:2.16.79 + imagePullPolicy: + args: + - --pre-install + - --control-plane-url= + - --control-plane-client-id= + - --control-plane-client-secret= + - --cluster-uid= + - --cluster-url= + - --custom-ca-enabled=false + - --custom-ca-secret-name=runai-ca-cert + - --custom-ca-secret-key=runai-ca.pem + - --custom-ca-secret-optional=true + - --image-registry= + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + resources: + + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 50m + memory: 256Mi + imagePullSecrets: + - name: gcr-secret + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 1 + preference: + matchExpressions: + - key: node-role.kubernetes.io/runai-system + operator: Exists +--- +# Source: runai-cluster/templates/hooks/pre-upgrade-job.yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: pre-upgrade + namespace: runai + labels: + run.ai/hook: pre-upgrade +spec: + backoffLimit: 0 + template: + metadata: + labels: + run.ai/hook: pre-upgrade + spec: + serviceAccountName: runai-pre-upgrade + restartPolicy: Never + containers: + - name: pre-upgrade + image: gcr.io/run-ai-prod/go-operator:2.16.79 + imagePullPolicy: + args: + - --pre-upgrade + - --control-plane-url= + - --control-plane-client-id= + - --control-plane-client-secret= + - --cluster-uid= + - --cluster-url= + - --custom-ca-enabled=false + - --custom-ca-secret-name=runai-ca-cert + - --custom-ca-secret-key=runai-ca.pem + - --custom-ca-secret-optional=true + - --image-registry= + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + resources: + + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 50m + memory: 256Mi + imagePullSecrets: + - name: gcr-secret + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 1 + preference: + matchExpressions: + - key: node-role.kubernetes.io/runai-system + operator: Exists +--- +# Source: runai-cluster/templates/hooks/upgrade_crds/job.yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: crd-upgrader + namespace: runai + annotations: +spec: + template: + metadata: + name: crd-upgrader + spec: + serviceAccountName: crd-upgrader + containers: + - name: crd-upgrader + image: gcr.io/run-ai-prod/crd-upgrader:2.16.79 + imagePullPolicy: Always + resources: + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 50m + memory: 256Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + restartPolicy: OnFailure + imagePullSecrets: + - name: gcr-secret + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 1 + preference: + matchExpressions: + - key: node-role.kubernetes.io/runai-system + operator: Exists + diff --git a/gitops-catalog/runai/static/prereqs/namespaces.yaml b/gitops-catalog/runai/static/prereqs/namespaces.yaml new file mode 100644 index 0000000..6c50141 --- /dev/null +++ b/gitops-catalog/runai/static/prereqs/namespaces.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: runai +--- +apiVersion: v1 +kind: Namespace +metadata: + name: monitoring +--- +apiVersion: v1 +kind: Namespace +metadata: + name: runai-scale-adjust +--- +apiVersion: v1 +kind: Namespace +metadata: + name: runai-reservation diff --git a/gitops-catalog/runai/templates/application.yaml b/gitops-catalog/runai/templates/application.yaml new file mode 100644 index 0000000..f612dff --- /dev/null +++ b/gitops-catalog/runai/templates/application.yaml @@ -0,0 +1,26 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-runai + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: runai + kubefirst.konstruct.io/source: catalog-templates + argocd.argoproj.io/sync-wave: '47' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.argocdAppNamespace }} + name: in-cluster + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/environments/runai/{{ .Values.clusterName }} + targetRevision: HEAD + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/runai/templates/manifests-application.yaml b/gitops-catalog/runai/templates/manifests-application.yaml new file mode 100644 index 0000000..8eb9b56 --- /dev/null +++ b/gitops-catalog/runai/templates/manifests-application.yaml @@ -0,0 +1,27 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: runai-cluster-{{ .Values.clusterName }} + namespace: {{ .Values.argocdAppNamespace }} + annotations: + argocd.argoproj.io/sync-wave: "50" + kubefirst.konstruct.io/application-name: runai + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + name: {{ .Values.clusterDestination }} + namespace: runai + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/environments/runai/{{ .Values.clusterName }}/manifests + targetRevision: HEAD + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/gitops-catalog/runai/templates/prereqs-application.yaml b/gitops-catalog/runai/templates/prereqs-application.yaml new file mode 100644 index 0000000..bf93c8d --- /dev/null +++ b/gitops-catalog/runai/templates/prereqs-application.yaml @@ -0,0 +1,25 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: runai-prereqs-{{ .Values.clusterName }} + namespace: {{ .Values.argocdAppNamespace }} + annotations: + argocd.argoproj.io/sync-wave: "49" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + name: {{ .Values.clusterDestination }} + namespace: runai + project: {{ .Values.project }} + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/environments/runai/{{ .Values.clusterName }}/prereqs + targetRevision: HEAD + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/gitops-catalog/runai/values.yaml b/gitops-catalog/runai/values.yaml new file mode 100644 index 0000000..64ebf5b --- /dev/null +++ b/gitops-catalog/runai/values.yaml @@ -0,0 +1,51 @@ +# Run.ai GPU Orchestration Platform Configuration +# Deploys Run.ai cluster agent via pre-rendered manifests (hook annotations +# stripped for ArgoCD compatibility). Prereqs app creates required namespaces +# at sync-wave 49, manifests app deploys Run.ai at sync-wave 50. + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: civo-gpu +clusterName: civo-gpu + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/civonetes/demo-organization-gitops.git +gitopsRepoUrl: https://github.com/civonetes/demo-organization-gitops.git + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: civo-gpu +clusterDestination: civo-gpu + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: civo-gpu +project: civo-gpu + +# @input.type: string +# @input.description: ArgoCD Application namespace (where app-of-apps lives) +# @input.required: true +# @input.default: civo-gpu-environment +argocdAppNamespace: civo-gpu-environment + +# ============================================================================= +# RUN.AI CLUSTER CONFIGURATION +# These values are used as token replacements in the rendered manifests. +# ============================================================================= + +# @input.type: string +# @input.description: Run.ai control plane URL (provided by Run.ai after account setup) +# @input.required: true +# @input.default: https://placeholder.runai.ai +clusterUrl: https://placeholder.runai.ai + +# @input.type: string +# @input.description: Cluster UID (provided by Run.ai onboarding wizard) +# @input.required: true +# @input.default: demo-cluster-uid +clusterUid: demo-cluster-uid diff --git a/templates/civo/gpu-cluster/Chart.yaml b/templates/civo/gpu-cluster/Chart.yaml new file mode 100644 index 0000000..0cf8148 --- /dev/null +++ b/templates/civo/gpu-cluster/Chart.yaml @@ -0,0 +1,15 @@ +apiVersion: v2 +name: civo-gpu-cluster +description: "Civo GPU cluster template — Talos-based with NVIDIA GPU operator" +type: application +version: 2.0.0 +appVersion: "2.0" +keywords: + - argocd + - gpu-cluster + - gitops + - crossplane + - terraform + - civo +maintainers: + - name: Konstruct diff --git a/templates/civo/gpu-cluster/konstruct.yaml b/templates/civo/gpu-cluster/konstruct.yaml new file mode 100644 index 0000000..aaf9fb8 --- /dev/null +++ b/templates/civo/gpu-cluster/konstruct.yaml @@ -0,0 +1,2 @@ +clusterType: "gpu" +inputs: [] diff --git a/templates/civo/gpu-cluster/templates/0-providerconfig.yaml b/templates/civo/gpu-cluster/templates/0-providerconfig.yaml new file mode 100644 index 0000000..9093291 --- /dev/null +++ b/templates/civo/gpu-cluster/templates/0-providerconfig.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-provider-config + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '0' +spec: + project: default + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.workloadClusterName }}/provider-config + targetRevision: HEAD + destination: + name: in-cluster + namespace: crossplane-system + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/civo/gpu-cluster/templates/10-infrastructure.yaml b/templates/civo/gpu-cluster/templates/10-infrastructure.yaml new file mode 100644 index 0000000..47c45de --- /dev/null +++ b/templates/civo/gpu-cluster/templates/10-infrastructure.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-infrastructure + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '10' +spec: + project: default + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.workloadClusterName }}/infrastructure + targetRevision: HEAD + destination: + name: in-cluster + namespace: {{ .Values.workloadClusterName }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/civo/workload-cluster/templates/35-cert-manager.yaml b/templates/civo/gpu-cluster/templates/30-cert-manager.yaml similarity index 83% rename from templates/civo/workload-cluster/templates/35-cert-manager.yaml rename to templates/civo/gpu-cluster/templates/30-cert-manager.yaml index db26457..18eedad 100644 --- a/templates/civo/workload-cluster/templates/35-cert-manager.yaml +++ b/templates/civo/gpu-cluster/templates/30-cert-manager.yaml @@ -6,18 +6,20 @@ metadata: finalizers: - resources-finalizer.argocd.argoproj.io annotations: - argocd.argoproj.io/sync-wave: '35' + argocd.argoproj.io/sync-wave: '30' spec: project: {{ .Values.workloadClusterName }}-platform source: repoURL: https://charts.jetstack.io - targetRevision: v1.20.1 + targetRevision: v1.16.5 helm: values: |- serviceAccount: create: true name: cert-manager installCRDs: true + startupapicheck: + enabled: false extraArgs: - --enable-gateway-api chart: cert-manager @@ -30,3 +32,4 @@ spec: selfHeal: true syncOptions: - CreateNamespace=true + - ServerSideApply=true diff --git a/templates/civo/gpu-cluster/templates/30-envoy-gateway.yaml b/templates/civo/gpu-cluster/templates/30-envoy-gateway.yaml new file mode 100644 index 0000000..558132f --- /dev/null +++ b/templates/civo/gpu-cluster/templates/30-envoy-gateway.yaml @@ -0,0 +1,61 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-envoy-gateway + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: {{ .Values.workloadClusterName }}-platform + source: + repoURL: docker.io/envoyproxy + chart: gateway-helm + targetRevision: v1.7.0 + helm: + valuesObject: + config: + envoyGateway: + logging: + level: + default: info + gateway: + controllerName: gateway.envoyproxy.io/gatewayclass-controller + podDisruptionBudget: + minAvailable: 1 + deployment: + replicas: 1 + envoyGateway: + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: 500m + memory: 512Mi + pod: + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: kubernetes.io/hostname + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: + control-plane: envoy-gateway + destination: + name: {{ .Values.workloadClusterName }} + namespace: envoy-gateway-system + syncPolicy: + automated: + prune: true + selfHeal: true + allowEmpty: false + syncOptions: + - CreateNamespace=true + - ServerSideApply=true + retry: + limit: 5 + backoff: + duration: 5s + factor: 2 + maxDuration: 3m diff --git a/templates/civo/gpu-cluster/templates/30-reloader.yaml b/templates/civo/gpu-cluster/templates/30-reloader.yaml new file mode 100644 index 0000000..f6dd120 --- /dev/null +++ b/templates/civo/gpu-cluster/templates/30-reloader.yaml @@ -0,0 +1,31 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-reloader + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '30' +spec: + project: {{ .Values.workloadClusterName }}-platform + source: + repoURL: 'https://stakater.github.io/stakater-charts' + targetRevision: v1.0.10 + chart: reloader + helm: + values: |- + ignoreSecrets: false + destination: + name: {{ .Values.workloadClusterName }} + namespace: reloader + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 5 + backoff: + duration: 5s + maxDuration: 5m0s + factor: 2 diff --git a/templates/civo/gpu-cluster/templates/45-environment.yaml b/templates/civo/gpu-cluster/templates/45-environment.yaml new file mode 100644 index 0000000..16146b0 --- /dev/null +++ b/templates/civo/gpu-cluster/templates/45-environment.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.workloadClusterName }}-{{ .Values.envName }} + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: '45' +spec: + project: {{ .Values.workloadClusterName }}-environment + source: + repoURL: {{ .Values.teamGitopsRepoUrl }} + path: registry/environments/{{ .Values.envName }}/{{ .Values.workloadClusterName }} + targetRevision: HEAD + destination: + name: in-cluster + namespace: {{ .Values.workloadClusterName }}-environment + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/templates/civo/gpu-cluster/templates/infrastructure/wait.yaml b/templates/civo/gpu-cluster/templates/infrastructure/wait.yaml new file mode 100644 index 0000000..8238d93 --- /dev/null +++ b/templates/civo/gpu-cluster/templates/infrastructure/wait.yaml @@ -0,0 +1,21 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ .Values.workloadClusterName }}-infrastructure-wait + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "20" +spec: + template: + spec: + serviceAccountName: argocd-server + containers: + - name: wait + image: {{ .Values.waitJobImage }} + command: + - /bin/sh + - -c + - | + while ! kubectl wait --for=jsonpath='{.status.conditions[0].status}'='True' workspace/{{ .Values.workloadClusterName }}-infrastructure; do echo "waiting for cluster to provision"; sleep 5; done + restartPolicy: Never + backoffLimit: 1 diff --git a/templates/civo/gpu-cluster/templates/infrastructure/workspace.yaml b/templates/civo/gpu-cluster/templates/infrastructure/workspace.yaml new file mode 100644 index 0000000..6652f14 --- /dev/null +++ b/templates/civo/gpu-cluster/templates/infrastructure/workspace.yaml @@ -0,0 +1,24 @@ +apiVersion: tf.upbound.io/v1beta1 +kind: Workspace +metadata: + name: {{ .Values.workloadClusterName }}-infrastructure +spec: + providerConfigRef: + name: {{ .Values.workloadClusterName }} + forProvider: + source: Remote + module: {{ .Values.workloadClusterTerraformModuleUrl }} + vars: + - key: cluster_name + value: {{ .Values.workloadClusterName }} + - key: cluster_region + value: {{ .Values.workloadClusterRegion }} + - key: environment + value: {{ .Values.workloadClusterName }} + - key: node_count + value: "{{ .Values.workloadNodeCount }}" + - key: node_type + value: {{ .Values.workloadNodeType }} + - key: is_gpu + value: "{{ .Values.isGpu }}" + diff --git a/templates/civo/gpu-cluster/templates/provider-config/providerconfig.yaml b/templates/civo/gpu-cluster/templates/provider-config/providerconfig.yaml new file mode 100644 index 0000000..46c0185 --- /dev/null +++ b/templates/civo/gpu-cluster/templates/provider-config/providerconfig.yaml @@ -0,0 +1,45 @@ +apiVersion: tf.upbound.io/v1beta1 +kind: ProviderConfig +metadata: + name: {{ .Values.workloadClusterName }} + annotations: + argocd.argoproj.io/sync-wave: "-1" +spec: + configuration: | + terraform { + backend "s3" { + key = "registry/konstruct-clusters/{{ .Values.workloadClusterName }}/infrastructure/provider-config/terraform.tfstate" + bucket = "{{ .Values.projectStateStoreBucket }}" + region = "{{ .Values.projectRegion }}" + endpoint = "https://objectstore.{{ .Values.projectRegion }}.civo.com" + + skip_credentials_validation = true + skip_metadata_api_check = true + skip_region_validation = true + force_path_style = true + } + required_providers { + civo = { + source = "civo/civo" + version = "= 1.1.0" + } + } + } + provider "civo" { + credentials_file = "civo.json" + region = "{{ .Values.workloadClusterRegion }}" + } + pluginCache: false + credentials: + - filename: civo.json + source: Secret + secretRef: + namespace: crossplane-system + name: {{ .Values.cloudAccountName }}-civo-creds + key: config.json + - filename: .git-credentials + source: Secret + secretRef: + namespace: crossplane-system + name: git-credentials + key: creds diff --git a/templates/civo/gpu-cluster/templates/registry-workload-cluster.yaml b/templates/civo/gpu-cluster/templates/registry-workload-cluster.yaml new file mode 100644 index 0000000..0136813 --- /dev/null +++ b/templates/civo/gpu-cluster/templates/registry-workload-cluster.yaml @@ -0,0 +1,30 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: registry-{{ .Values.workloadClusterName }} + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: '100' + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: default + source: + repoURL: {{ .Values.gitopsRepoUrl }} + path: registry/clusters/{{ .Values.workloadClusterName }} + targetRevision: HEAD + destination: + server: https://kubernetes.default.svc + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + retry: + limit: 5 + backoff: + duration: 1m + maxDuration: 15m0s + factor: 2 diff --git a/templates/civo/gpu-cluster/templates/workloadcluster-environment-project.yaml b/templates/civo/gpu-cluster/templates/workloadcluster-environment-project.yaml new file mode 100644 index 0000000..56ac444 --- /dev/null +++ b/templates/civo/gpu-cluster/templates/workloadcluster-environment-project.yaml @@ -0,0 +1,26 @@ +apiVersion: argoproj.io/v1alpha1 +kind: AppProject +metadata: + name: {{ .Values.workloadClusterName }}-environment + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "-1" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + description: {{ .Values.workloadClusterName }} description + sourceRepos: + - '{{ .Values.gitopsRepoUrl }}' + destinations: + - name: in-cluster + namespace: {{ .Values.workloadClusterName }}-environment + clusterResourceWhitelist: + - group: '*' + kind: '*' + roles: + - description: {{ .Values.workloadClusterName }}-admin-role + groups: + - admins + name: admin-role + policies: + - p, proj:{{ .Values.workloadClusterName }}:admin-role, applications, *, {{ .Values.workloadClusterName }}/*, allow diff --git a/templates/civo/gpu-cluster/templates/workloadcluster-platform-project.yaml b/templates/civo/gpu-cluster/templates/workloadcluster-platform-project.yaml new file mode 100644 index 0000000..7a63f6d --- /dev/null +++ b/templates/civo/gpu-cluster/templates/workloadcluster-platform-project.yaml @@ -0,0 +1,26 @@ +apiVersion: argoproj.io/v1alpha1 +kind: AppProject +metadata: + name: {{ .Values.workloadClusterName }}-platform + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "-1" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + description: {{ .Values.workloadClusterName }} description + sourceRepos: + - '*' + destinations: + - namespace: '*' + server: '*' + clusterResourceWhitelist: + - group: '*' + kind: '*' + roles: + - description: {{ .Values.workloadClusterName }}-admin-role + groups: + - admins + name: admin-role + policies: + - p, proj:{{ .Values.workloadClusterName }}:admin-role, applications, *, {{ .Values.workloadClusterName }}/*, allow diff --git a/templates/civo/gpu-cluster/templates/workloadcluster-project.yaml b/templates/civo/gpu-cluster/templates/workloadcluster-project.yaml new file mode 100644 index 0000000..b9d63c1 --- /dev/null +++ b/templates/civo/gpu-cluster/templates/workloadcluster-project.yaml @@ -0,0 +1,27 @@ +apiVersion: argoproj.io/v1alpha1 +kind: AppProject +metadata: + name: {{ .Values.workloadClusterName }} + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "-1" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + description: {{ .Values.workloadClusterName }} description + sourceNamespaces: ["{{ .Values.workloadClusterName }}-environment"] + sourceRepos: + - '*' + destinations: + - name: {{ .Values.workloadClusterName }} + namespace: '*' + clusterResourceWhitelist: + - group: '*' + kind: '*' + roles: + - description: {{ .Values.workloadClusterName }}-admin-role + groups: + - admins + name: admin-role + policies: + - p, proj:{{ .Values.workloadClusterName }}:admin-role, applications, *, {{ .Values.workloadClusterName }}/*, allow diff --git a/templates/civo/gpu-cluster/values.yaml b/templates/civo/gpu-cluster/values.yaml new file mode 100644 index 0000000..9fafc80 --- /dev/null +++ b/templates/civo/gpu-cluster/values.yaml @@ -0,0 +1,11 @@ +# Terraform Module Configuration +# @input.type: string +# @input.description: the complete URL for the Terraform module for infrastructure provisioning +# @input.required: true +workloadClusterTerraformModuleUrl: "git::https://github.com/konstructio/gitops-template.git//civo-github/terraform/civo/modules/workload-cluster?ref=main" + +# GPU Configuration +isGpu: true + +# Wait Job Configuration +waitJobImage: "dtzar/helm-kubectl:3.19.0" diff --git a/templates/civo/workload-cluster/konstruct.yaml b/templates/civo/workload-cluster/konstruct.yaml new file mode 100644 index 0000000..9c71f84 --- /dev/null +++ b/templates/civo/workload-cluster/konstruct.yaml @@ -0,0 +1,2 @@ +clusterType: "physical" +inputs: [] diff --git a/templates/civo/workload-cluster/templates/30-cert-manager.yaml b/templates/civo/workload-cluster/templates/30-cert-manager.yaml index 197a312..18eedad 100644 --- a/templates/civo/workload-cluster/templates/30-cert-manager.yaml +++ b/templates/civo/workload-cluster/templates/30-cert-manager.yaml @@ -11,13 +11,15 @@ spec: project: {{ .Values.workloadClusterName }}-platform source: repoURL: https://charts.jetstack.io - targetRevision: v1.20.1 + targetRevision: v1.16.5 helm: values: |- serviceAccount: create: true name: cert-manager installCRDs: true + startupapicheck: + enabled: false extraArgs: - --enable-gateway-api chart: cert-manager @@ -30,3 +32,4 @@ spec: selfHeal: true syncOptions: - CreateNamespace=true + - ServerSideApply=true diff --git a/templates/civo/workload-cluster/templates/infrastructure/workspace.yaml b/templates/civo/workload-cluster/templates/infrastructure/workspace.yaml index 6e77647..6652f14 100644 --- a/templates/civo/workload-cluster/templates/infrastructure/workspace.yaml +++ b/templates/civo/workload-cluster/templates/infrastructure/workspace.yaml @@ -19,4 +19,6 @@ spec: value: "{{ .Values.workloadNodeCount }}" - key: node_type value: {{ .Values.workloadNodeType }} + - key: is_gpu + value: "{{ .Values.isGpu }}" diff --git a/templates/civo/workload-cluster/values.yaml b/templates/civo/workload-cluster/values.yaml index bf552d4..f64a076 100644 --- a/templates/civo/workload-cluster/values.yaml +++ b/templates/civo/workload-cluster/values.yaml @@ -2,7 +2,10 @@ # @input.type: string # @input.description: the complete URL for the Terraform module for infrastructure provisioning # @input.required: true -workloadClusterTerraformModuleUrl: "git::https://github.com/konstructio/gitops-template.git//terraform/civo/modules/workload-cluster?ref=main" +workloadClusterTerraformModuleUrl: "git::https://github.com/konstructio/gitops-template.git//civo-github/terraform/civo/modules/workload-cluster?ref=main" + +# GPU Configuration +isGpu: false # Wait Job Configuration waitJobImage: "dtzar/helm-kubectl:3.19.0" From a289f109084cd2684ef97f51429408f51bb765bb Mon Sep 17 00:00:00 2001 From: John Dietz Date: Sun, 19 Apr 2026 11:35:07 -0400 Subject: [PATCH 66/77] feat(catalog): add ArgoCD Helm templates for 9 GitOps catalog items Add catalog templates for: envoy-gateway, external-dns, cert-manager, external-secrets, vault, prometheus (kube-prometheus-stack), grafana, reloader, and groundcover. Each template includes Chart.yaml, values.yaml with @input annotations for UI form generation, and an ArgoCD Application template. Closes #41 --- gitops-catalog/cert-manager/Chart.yaml | 6 ++ .../cert-manager/templates/application.yaml | 36 ++++++++ gitops-catalog/cert-manager/values.yaml | 75 ++++++++++++++++ gitops-catalog/envoy-gateway/Chart.yaml | 6 ++ .../envoy-gateway/templates/application.yaml | 36 ++++++++ gitops-catalog/envoy-gateway/values.yaml | 68 ++++++++++++++ gitops-catalog/external-dns/Chart.yaml | 6 ++ .../external-dns/templates/application.yaml | 36 ++++++++ gitops-catalog/external-dns/values.yaml | 81 +++++++++++++++++ gitops-catalog/external-secrets/Chart.yaml | 6 ++ .../templates/application.yaml | 36 ++++++++ gitops-catalog/external-secrets/values.yaml | 82 +++++++++++++++++ gitops-catalog/grafana/Chart.yaml | 6 ++ .../grafana/templates/application.yaml | 39 ++++++++ gitops-catalog/grafana/values.yaml | 88 ++++++++++++++++++ gitops-catalog/groundcover/Chart.yaml | 6 ++ .../groundcover/templates/application.yaml | 37 ++++++++ gitops-catalog/groundcover/values.yaml | 74 +++++++++++++++ gitops-catalog/prometheus/Chart.yaml | 6 ++ .../prometheus/templates/application.yaml | 46 ++++++++++ gitops-catalog/prometheus/values.yaml | 88 ++++++++++++++++++ gitops-catalog/reloader/Chart.yaml | 6 ++ .../reloader/templates/application.yaml | 38 ++++++++ gitops-catalog/reloader/values.yaml | 76 ++++++++++++++++ gitops-catalog/vault/Chart.yaml | 6 ++ .../vault/templates/application.yaml | 50 +++++++++++ gitops-catalog/vault/values.yaml | 89 +++++++++++++++++++ 27 files changed, 1129 insertions(+) create mode 100644 gitops-catalog/cert-manager/Chart.yaml create mode 100644 gitops-catalog/cert-manager/templates/application.yaml create mode 100644 gitops-catalog/cert-manager/values.yaml create mode 100644 gitops-catalog/envoy-gateway/Chart.yaml create mode 100644 gitops-catalog/envoy-gateway/templates/application.yaml create mode 100644 gitops-catalog/envoy-gateway/values.yaml create mode 100644 gitops-catalog/external-dns/Chart.yaml create mode 100644 gitops-catalog/external-dns/templates/application.yaml create mode 100644 gitops-catalog/external-dns/values.yaml create mode 100644 gitops-catalog/external-secrets/Chart.yaml create mode 100644 gitops-catalog/external-secrets/templates/application.yaml create mode 100644 gitops-catalog/external-secrets/values.yaml create mode 100644 gitops-catalog/grafana/Chart.yaml create mode 100644 gitops-catalog/grafana/templates/application.yaml create mode 100644 gitops-catalog/grafana/values.yaml create mode 100644 gitops-catalog/groundcover/Chart.yaml create mode 100644 gitops-catalog/groundcover/templates/application.yaml create mode 100644 gitops-catalog/groundcover/values.yaml create mode 100644 gitops-catalog/prometheus/Chart.yaml create mode 100644 gitops-catalog/prometheus/templates/application.yaml create mode 100644 gitops-catalog/prometheus/values.yaml create mode 100644 gitops-catalog/reloader/Chart.yaml create mode 100644 gitops-catalog/reloader/templates/application.yaml create mode 100644 gitops-catalog/reloader/values.yaml create mode 100644 gitops-catalog/vault/Chart.yaml create mode 100644 gitops-catalog/vault/templates/application.yaml create mode 100644 gitops-catalog/vault/values.yaml diff --git a/gitops-catalog/cert-manager/Chart.yaml b/gitops-catalog/cert-manager/Chart.yaml new file mode 100644 index 0000000..fa03a85 --- /dev/null +++ b/gitops-catalog/cert-manager/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: cert-manager +description: A Helm chart for deploying cert-manager with ArgoCD for automated TLS certificate management using ACME, self-signed, and other issuers +type: application +version: 0.1.0 +appVersion: "1.17.1" diff --git a/gitops-catalog/cert-manager/templates/application.yaml b/gitops-catalog/cert-manager/templates/application.yaml new file mode 100644 index 0000000..5c8f06a --- /dev/null +++ b/gitops-catalog/cert-manager/templates/application.yaml @@ -0,0 +1,36 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-cert-manager + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: cert-manager + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + chart: cert-manager + repoURL: https://charts.jetstack.io + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: cert-manager + values: | + crds: + enabled: {{ .Values.installCRDs }} + replicaCount: {{ .Values.replicas }} + prometheus: + servicemonitor: + enabled: {{ .Values.serviceMonitorEnabled }} + startupapicheck: + enabled: {{ .Values.startupapicheck }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/cert-manager/values.yaml b/gitops-catalog/cert-manager/values.yaml new file mode 100644 index 0000000..9d57b06 --- /dev/null +++ b/gitops-catalog/cert-manager/values.yaml @@ -0,0 +1,75 @@ +# cert-manager Configuration +# This values file contains all configurable parameters for deploying cert-manager via ArgoCD + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for cert-manager deployment +# @input.required: true +# @input.default: cert-manager +namespace: cert-manager + +# @input.type: string +# @input.description: cert-manager Helm chart version +# @input.required: true +# @input.default: v1.17.1 +chartVersion: v1.17.1 + +# ============================================================================= +# CERT-MANAGER CONFIGURATION +# ============================================================================= + +# @input.type: enum +# @input.description: Install cert-manager CRDs (required for first install, disable if CRDs are managed separately) +# @input.options: true,false +# @input.required: true +# @input.default: true +installCRDs: true + +# @input.type: number +# @input.description: Number of cert-manager controller replicas +# @input.required: true +# @input.default: 1 +replicas: 1 + +# @input.type: enum +# @input.description: Enable Prometheus ServiceMonitor for cert-manager metrics +# @input.options: true,false +# @input.required: true +# @input.default: false +serviceMonitorEnabled: false + +# @input.type: enum +# @input.description: Enable the cert-manager Startupapicheck job to verify API availability +# @input.options: true,false +# @input.required: true +# @input.default: true +startupapicheck: true diff --git a/gitops-catalog/envoy-gateway/Chart.yaml b/gitops-catalog/envoy-gateway/Chart.yaml new file mode 100644 index 0000000..1ceefa3 --- /dev/null +++ b/gitops-catalog/envoy-gateway/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: envoy-gateway +description: A Helm chart for deploying Envoy Gateway with ArgoCD as a Kubernetes-native API gateway for managing ingress and traffic routing +type: application +version: 0.1.0 +appVersion: "1.3.0" diff --git a/gitops-catalog/envoy-gateway/templates/application.yaml b/gitops-catalog/envoy-gateway/templates/application.yaml new file mode 100644 index 0000000..db33a27 --- /dev/null +++ b/gitops-catalog/envoy-gateway/templates/application.yaml @@ -0,0 +1,36 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-envoy-gateway + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: envoy-gateway + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + chart: gateway-helm + repoURL: https://gateway.envoyproxy.io/charts + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: envoy-gateway + values: | + deployment: + replicas: {{ .Values.replicas }} + config: + envoyGateway: + provider: + kubernetes: + enabled: {{ .Values.kubernetesProviderEnabled }} + createGatewayClass: {{ .Values.gatewayClassEnabled }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/envoy-gateway/values.yaml b/gitops-catalog/envoy-gateway/values.yaml new file mode 100644 index 0000000..e3d37d3 --- /dev/null +++ b/gitops-catalog/envoy-gateway/values.yaml @@ -0,0 +1,68 @@ +# Envoy Gateway Configuration +# This values file contains all configurable parameters for deploying Envoy Gateway via ArgoCD + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for Envoy Gateway deployment +# @input.required: true +# @input.default: envoy-gateway-system +namespace: envoy-gateway-system + +# @input.type: string +# @input.description: Envoy Gateway Helm chart version +# @input.required: true +# @input.default: v1.3.0 +chartVersion: v1.3.0 + +# ============================================================================= +# ENVOY GATEWAY CONFIGURATION +# ============================================================================= + +# @input.type: number +# @input.description: Number of Envoy Gateway controller replicas +# @input.required: true +# @input.default: 1 +replicas: 1 + +# @input.type: enum +# @input.description: Enable Kubernetes provider for gateway management +# @input.options: true,false +# @input.required: true +# @input.default: true +kubernetesProviderEnabled: true + +# @input.type: enum +# @input.description: Install GatewayClass resource for Envoy Gateway +# @input.options: true,false +# @input.required: true +# @input.default: true +gatewayClassEnabled: true diff --git a/gitops-catalog/external-dns/Chart.yaml b/gitops-catalog/external-dns/Chart.yaml new file mode 100644 index 0000000..7e99548 --- /dev/null +++ b/gitops-catalog/external-dns/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: external-dns +description: A Helm chart for deploying ExternalDNS with ArgoCD to automatically manage DNS records from Kubernetes resources +type: application +version: 0.1.0 +appVersion: "1.15.1" diff --git a/gitops-catalog/external-dns/templates/application.yaml b/gitops-catalog/external-dns/templates/application.yaml new file mode 100644 index 0000000..18d063d --- /dev/null +++ b/gitops-catalog/external-dns/templates/application.yaml @@ -0,0 +1,36 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-external-dns + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: external-dns + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + chart: external-dns + repoURL: https://kubernetes-sigs.github.io/external-dns/ + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: external-dns + values: | + provider: + name: {{ .Values.provider }} + domainFilters: + - {{ .Values.domainFilters }} + policy: {{ .Values.policy }} + sources: + - {{ .Values.sources }} + txtOwnerId: {{ .Values.txtOwnerId }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/external-dns/values.yaml b/gitops-catalog/external-dns/values.yaml new file mode 100644 index 0000000..2adb215 --- /dev/null +++ b/gitops-catalog/external-dns/values.yaml @@ -0,0 +1,81 @@ +# ExternalDNS Configuration +# This values file contains all configurable parameters for deploying ExternalDNS via ArgoCD + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for ExternalDNS deployment +# @input.required: true +# @input.default: external-dns +namespace: external-dns + +# @input.type: string +# @input.description: ExternalDNS Helm chart version +# @input.required: true +# @input.default: 1.15.1 +chartVersion: 1.15.1 + +# ============================================================================= +# EXTERNAL DNS CONFIGURATION +# ============================================================================= + +# @input.type: enum +# @input.description: DNS provider (e.g., aws, cloudflare, google, azure, civo) +# @input.options: aws,cloudflare,google,azure,civo,digitalocean,rfc2136 +# @input.required: true +# @input.default: aws +provider: aws + +# @input.type: string +# @input.description: Comma-separated list of DNS zones to manage +# @input.required: true +# @input.default: example.com +domainFilters: example.com + +# @input.type: enum +# @input.description: DNS record ownership policy (sync deletes unmanaged records, upsert-only is safer) +# @input.options: sync,upsert-only +# @input.required: true +# @input.default: upsert-only +policy: upsert-only + +# @input.type: enum +# @input.description: Kubernetes resource types to watch for DNS records +# @input.options: ingress,service,istio-gateway,istio-virtualservice +# @input.required: true +# @input.default: ingress +sources: ingress + +# @input.type: string +# @input.description: TXT record owner ID to avoid conflicts between multiple ExternalDNS instances +# @input.required: true +# @input.default: default +txtOwnerId: default diff --git a/gitops-catalog/external-secrets/Chart.yaml b/gitops-catalog/external-secrets/Chart.yaml new file mode 100644 index 0000000..79a36f5 --- /dev/null +++ b/gitops-catalog/external-secrets/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: external-secrets +description: A Helm chart for deploying External Secrets Operator with ArgoCD to sync secrets from external providers like AWS, Vault, and GCP into Kubernetes +type: application +version: 0.1.0 +appVersion: "0.14.3" diff --git a/gitops-catalog/external-secrets/templates/application.yaml b/gitops-catalog/external-secrets/templates/application.yaml new file mode 100644 index 0000000..e673510 --- /dev/null +++ b/gitops-catalog/external-secrets/templates/application.yaml @@ -0,0 +1,36 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-external-secrets + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: external-secrets + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + chart: external-secrets + repoURL: https://charts.external-secrets.io + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: external-secrets + values: | + installCRDs: {{ .Values.installCRDs }} + replicaCount: {{ .Values.replicas }} + webhook: + create: {{ .Values.webhookEnabled }} + certController: + create: {{ .Values.certControllerEnabled }} + serviceMonitor: + enabled: {{ .Values.serviceMonitorEnabled }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/external-secrets/values.yaml b/gitops-catalog/external-secrets/values.yaml new file mode 100644 index 0000000..ce77eb4 --- /dev/null +++ b/gitops-catalog/external-secrets/values.yaml @@ -0,0 +1,82 @@ +# External Secrets Operator Configuration +# This values file contains all configurable parameters for deploying External Secrets Operator via ArgoCD + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for External Secrets Operator deployment +# @input.required: true +# @input.default: external-secrets +namespace: external-secrets + +# @input.type: string +# @input.description: External Secrets Operator Helm chart version +# @input.required: true +# @input.default: 0.14.3 +chartVersion: 0.14.3 + +# ============================================================================= +# EXTERNAL SECRETS CONFIGURATION +# ============================================================================= + +# @input.type: enum +# @input.description: Install External Secrets CRDs +# @input.options: true,false +# @input.required: true +# @input.default: true +installCRDs: true + +# @input.type: number +# @input.description: Number of operator replicas +# @input.required: true +# @input.default: 1 +replicas: 1 + +# @input.type: enum +# @input.description: Enable the webhook for validating ExternalSecret resources +# @input.options: true,false +# @input.required: true +# @input.default: true +webhookEnabled: true + +# @input.type: enum +# @input.description: Enable the cert-controller for managing webhook certificates +# @input.options: true,false +# @input.required: true +# @input.default: true +certControllerEnabled: true + +# @input.type: enum +# @input.description: Enable ServiceMonitor for Prometheus metrics collection +# @input.options: true,false +# @input.required: true +# @input.default: false +serviceMonitorEnabled: false diff --git a/gitops-catalog/grafana/Chart.yaml b/gitops-catalog/grafana/Chart.yaml new file mode 100644 index 0000000..ee37f19 --- /dev/null +++ b/gitops-catalog/grafana/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: grafana +description: A Helm chart for deploying standalone Grafana with ArgoCD for metrics visualization, dashboards, and alerting +type: application +version: 0.1.0 +appVersion: "8.12.1" diff --git a/gitops-catalog/grafana/templates/application.yaml b/gitops-catalog/grafana/templates/application.yaml new file mode 100644 index 0000000..57ee5ec --- /dev/null +++ b/gitops-catalog/grafana/templates/application.yaml @@ -0,0 +1,39 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-grafana + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: grafana + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + chart: grafana + repoURL: https://grafana.github.io/helm-charts + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: grafana + values: | + replicas: {{ .Values.replicas }} + persistence: + enabled: {{ .Values.persistenceEnabled }} + size: {{ .Values.persistenceSize }} + ingress: + enabled: {{ .Values.ingressEnabled }} + sidecar: + dashboards: + enabled: {{ .Values.sidecarDashboardsEnabled }} + datasources: + enabled: {{ .Values.sidecarDatasourcesEnabled }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/grafana/values.yaml b/gitops-catalog/grafana/values.yaml new file mode 100644 index 0000000..0de6218 --- /dev/null +++ b/gitops-catalog/grafana/values.yaml @@ -0,0 +1,88 @@ +# Grafana Configuration +# This values file contains all configurable parameters for deploying standalone Grafana via ArgoCD + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for Grafana deployment +# @input.required: true +# @input.default: observability +namespace: observability + +# @input.type: string +# @input.description: Grafana Helm chart version +# @input.required: true +# @input.default: 8.12.1 +chartVersion: 8.12.1 + +# ============================================================================= +# GRAFANA CONFIGURATION +# ============================================================================= + +# @input.type: number +# @input.description: Number of Grafana replicas +# @input.required: true +# @input.default: 1 +replicas: 1 + +# @input.type: enum +# @input.description: Enable persistent storage for Grafana dashboards and data +# @input.options: true,false +# @input.required: true +# @input.default: true +persistenceEnabled: true + +# @input.type: string +# @input.description: Storage size for Grafana persistent volume +# @input.required: true +# @input.default: 10Gi +persistenceSize: 10Gi + +# @input.type: enum +# @input.description: Enable Grafana Ingress +# @input.options: true,false +# @input.required: true +# @input.default: false +ingressEnabled: false + +# @input.type: enum +# @input.description: Enable sidecar for automatic dashboard provisioning from ConfigMaps +# @input.options: true,false +# @input.required: true +# @input.default: true +sidecarDashboardsEnabled: true + +# @input.type: enum +# @input.description: Enable sidecar for automatic datasource provisioning from ConfigMaps +# @input.options: true,false +# @input.required: true +# @input.default: true +sidecarDatasourcesEnabled: true diff --git a/gitops-catalog/groundcover/Chart.yaml b/gitops-catalog/groundcover/Chart.yaml new file mode 100644 index 0000000..1929491 --- /dev/null +++ b/gitops-catalog/groundcover/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: groundcover +description: A Helm chart for deploying groundcover eBPF-based observability platform with ArgoCD for zero-instrumentation APM, metrics, logs, and traces +type: application +version: 0.1.0 +appVersion: "1.0.0" diff --git a/gitops-catalog/groundcover/templates/application.yaml b/gitops-catalog/groundcover/templates/application.yaml new file mode 100644 index 0000000..4895795 --- /dev/null +++ b/gitops-catalog/groundcover/templates/application.yaml @@ -0,0 +1,37 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-groundcover + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: groundcover + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + chart: groundcover + repoURL: https://helm.groundcover.com/ + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: groundcover + values: | + global: + groundcover_token: {{ .Values.apiKey }} + cluster: + name: {{ .Values.clusterDisplayName }} + agent: + logs: + enabled: {{ .Values.logsEnabled }} + traces: + enabled: {{ .Values.tracesEnabled }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/groundcover/values.yaml b/gitops-catalog/groundcover/values.yaml new file mode 100644 index 0000000..e95d697 --- /dev/null +++ b/gitops-catalog/groundcover/values.yaml @@ -0,0 +1,74 @@ +# Groundcover Observability Platform Configuration +# This values file contains all configurable parameters for deploying groundcover via ArgoCD + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for groundcover deployment +# @input.required: true +# @input.default: groundcover +namespace: groundcover + +# @input.type: string +# @input.description: groundcover Helm chart version +# @input.required: true +# @input.default: 0.36.3 +chartVersion: 0.36.3 + +# ============================================================================= +# GROUNDCOVER CONFIGURATION +# ============================================================================= + +# @input.type: string +# @input.description: groundcover API key for authentication +# @input.required: true +# @input.default: "" +apiKey: "" + +# @input.type: string +# @input.description: Cluster display name shown in groundcover dashboard +# @input.required: true +# @input.default: my-cluster +clusterDisplayName: my-cluster + +# @input.type: enum +# @input.description: Enable log collection +# @input.options: true,false +# @input.required: true +# @input.default: true +logsEnabled: true + +# @input.type: enum +# @input.description: Enable distributed tracing +# @input.options: true,false +# @input.required: true +# @input.default: true +tracesEnabled: true diff --git a/gitops-catalog/prometheus/Chart.yaml b/gitops-catalog/prometheus/Chart.yaml new file mode 100644 index 0000000..2081532 --- /dev/null +++ b/gitops-catalog/prometheus/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: prometheus +description: A Helm chart for deploying kube-prometheus-stack with ArgoCD for full-stack Kubernetes monitoring with Prometheus, Alertmanager, and Grafana dashboards +type: application +version: 0.1.0 +appVersion: "69.8.0" diff --git a/gitops-catalog/prometheus/templates/application.yaml b/gitops-catalog/prometheus/templates/application.yaml new file mode 100644 index 0000000..d025f8c --- /dev/null +++ b/gitops-catalog/prometheus/templates/application.yaml @@ -0,0 +1,46 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-prometheus + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: prometheus + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + chart: kube-prometheus-stack + repoURL: https://prometheus-community.github.io/helm-charts + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: kube-prometheus-stack + values: | + grafana: + enabled: {{ .Values.grafanaEnabled }} + alertmanager: + enabled: {{ .Values.alertmanagerEnabled }} + prometheus: + prometheusSpec: + retention: {{ .Values.retention }} + storageSpec: + volumeClaimTemplate: + spec: + resources: + requests: + storage: {{ .Values.storageSize }} + nodeExporter: + enabled: {{ .Values.nodeExporterEnabled }} + kubeStateMetrics: + enabled: {{ .Values.kubeStateMetricsEnabled }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/gitops-catalog/prometheus/values.yaml b/gitops-catalog/prometheus/values.yaml new file mode 100644 index 0000000..dd0ab9b --- /dev/null +++ b/gitops-catalog/prometheus/values.yaml @@ -0,0 +1,88 @@ +# kube-prometheus-stack Configuration +# This values file contains all configurable parameters for deploying kube-prometheus-stack via ArgoCD + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for Prometheus stack deployment +# @input.required: true +# @input.default: observability +namespace: observability + +# @input.type: string +# @input.description: kube-prometheus-stack Helm chart version +# @input.required: true +# @input.default: 69.8.0 +chartVersion: 69.8.0 + +# ============================================================================= +# PROMETHEUS STACK CONFIGURATION +# ============================================================================= + +# @input.type: enum +# @input.description: Enable bundled Grafana deployment (disable if using standalone Grafana) +# @input.options: true,false +# @input.required: true +# @input.default: true +grafanaEnabled: true + +# @input.type: enum +# @input.description: Enable Alertmanager for alert routing and notification +# @input.options: true,false +# @input.required: true +# @input.default: true +alertmanagerEnabled: true + +# @input.type: string +# @input.description: Prometheus data retention period +# @input.required: true +# @input.default: 15d +retention: 15d + +# @input.type: string +# @input.description: Storage size for Prometheus data (PVC) +# @input.required: true +# @input.default: 50Gi +storageSize: 50Gi + +# @input.type: enum +# @input.description: Enable Node Exporter for host-level metrics +# @input.options: true,false +# @input.required: true +# @input.default: true +nodeExporterEnabled: true + +# @input.type: enum +# @input.description: Enable kube-state-metrics for Kubernetes object metrics +# @input.options: true,false +# @input.required: true +# @input.default: true +kubeStateMetricsEnabled: true diff --git a/gitops-catalog/reloader/Chart.yaml b/gitops-catalog/reloader/Chart.yaml new file mode 100644 index 0000000..adeba65 --- /dev/null +++ b/gitops-catalog/reloader/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: reloader +description: A Helm chart for deploying Stakater Reloader with ArgoCD to automatically restart pods when ConfigMaps or Secrets are updated +type: application +version: 0.1.0 +appVersion: "1.2.1" diff --git a/gitops-catalog/reloader/templates/application.yaml b/gitops-catalog/reloader/templates/application.yaml new file mode 100644 index 0000000..c176da4 --- /dev/null +++ b/gitops-catalog/reloader/templates/application.yaml @@ -0,0 +1,38 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-reloader + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: reloader + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + chart: reloader + repoURL: https://stakater.github.io/stakater-charts + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: reloader + values: | + reloader: + watchGlobally: true + ignoreConfigMaps: {{ not .Values.watchConfigMaps }} + ignoreSecrets: {{ not .Values.watchSecrets }} + isArgoRollouts: false + deployment: + env: + open: + IGNORE_CONFIGMAPS_WITHOUT_ANNOTATION: "{{ .Values.ignoreConfigMapsWithoutAnnotation }}" + IGNORE_SECRETS_WITHOUT_ANNOTATION: "{{ .Values.ignoreSecretsWithoutAnnotation }}" + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/reloader/values.yaml b/gitops-catalog/reloader/values.yaml new file mode 100644 index 0000000..7ec76ba --- /dev/null +++ b/gitops-catalog/reloader/values.yaml @@ -0,0 +1,76 @@ +# Stakater Reloader Configuration +# This values file contains all configurable parameters for deploying Reloader via ArgoCD + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for Reloader deployment +# @input.required: true +# @input.default: reloader +namespace: reloader + +# @input.type: string +# @input.description: Reloader Helm chart version +# @input.required: true +# @input.default: 1.2.1 +chartVersion: 1.2.1 + +# ============================================================================= +# RELOADER CONFIGURATION +# ============================================================================= + +# @input.type: enum +# @input.description: Watch ConfigMaps for changes and trigger rolling restarts +# @input.options: true,false +# @input.required: true +# @input.default: true +watchConfigMaps: true + +# @input.type: enum +# @input.description: Watch Secrets for changes and trigger rolling restarts +# @input.options: true,false +# @input.required: true +# @input.default: true +watchSecrets: true + +# @input.type: enum +# @input.description: Only watch resources with the reloader annotation (false = watch all resources) +# @input.options: true,false +# @input.required: true +# @input.default: false +ignoreConfigMapsWithoutAnnotation: false + +# @input.type: enum +# @input.description: Only watch secrets with the reloader annotation (false = watch all secrets) +# @input.options: true,false +# @input.required: true +# @input.default: false +ignoreSecretsWithoutAnnotation: false diff --git a/gitops-catalog/vault/Chart.yaml b/gitops-catalog/vault/Chart.yaml new file mode 100644 index 0000000..d65f510 --- /dev/null +++ b/gitops-catalog/vault/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: vault +description: A Helm chart for deploying HashiCorp Vault with ArgoCD for secrets management, encryption, and identity-based access (last fully OSS release before BSL relicensing) +type: application +version: 0.1.0 +appVersion: "0.27.0" diff --git a/gitops-catalog/vault/templates/application.yaml b/gitops-catalog/vault/templates/application.yaml new file mode 100644 index 0000000..728ff8e --- /dev/null +++ b/gitops-catalog/vault/templates/application.yaml @@ -0,0 +1,50 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: {{ .Values.clusterName }}-vault + namespace: argocd + annotations: + kubefirst.konstruct.io/application-name: vault + kubefirst.konstruct.io/source: catalog-templates + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + namespace: {{ .Values.namespace }} + name: {{ .Values.clusterDestination }} + project: {{ .Values.project }} + source: + chart: vault + repoURL: https://helm.releases.hashicorp.com + targetRevision: {{ .Values.chartVersion }} + helm: + releaseName: vault + values: | + server: + dev: + enabled: {{ .Values.devMode }} + ha: + enabled: {{ .Values.haEnabled }} + {{- if .Values.haEnabled }} + raft: + enabled: true + replicas: {{ .Values.replicas }} + {{- end }} + {{- if not .Values.haEnabled }} + standalone: + enabled: true + {{- end }} + dataStorage: + size: {{ .Values.dataStorageSize }} + ui: + enabled: {{ .Values.uiEnabled }} + injector: + enabled: {{ .Values.injectorEnabled }} + ui: + enabled: {{ .Values.uiEnabled }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/gitops-catalog/vault/values.yaml b/gitops-catalog/vault/values.yaml new file mode 100644 index 0000000..c2dbd83 --- /dev/null +++ b/gitops-catalog/vault/values.yaml @@ -0,0 +1,89 @@ +# HashiCorp Vault Configuration +# This values file contains all configurable parameters for deploying Vault via ArgoCD +# Note: Chart version 0.27.0 is the last fully OSS release before BSL relicensing + +# @input.type: string +# @input.description: Cluster name identifier +# @input.required: true +# @input.default: my-cluster +clusterName: my-cluster + +# @input.type: string +# @input.description: GitOps repository URL for ArgoCD sync +# @input.required: true +# @input.default: https://github.com/example/gitops-repo +gitopsRepoUrl: https://github.com/example/gitops-repo + +# @input.type: string +# @input.description: Registry path in GitOps repository +# @input.required: true +# @input.default: registry/clusters/my-cluster +registryPath: registry/clusters/my-cluster + +# @input.type: string +# @input.description: Target cluster destination for ArgoCD +# @input.required: true +# @input.default: in-cluster +clusterDestination: in-cluster + +# @input.type: string +# @input.description: ArgoCD project name +# @input.required: true +# @input.default: default +project: default + +# @input.type: string +# @input.description: Namespace for Vault deployment +# @input.required: true +# @input.default: vault +namespace: vault + +# @input.type: string +# @input.description: Vault Helm chart version (0.27.0 is last fully OSS release) +# @input.required: true +# @input.default: 0.27.0 +chartVersion: 0.27.0 + +# ============================================================================= +# VAULT CONFIGURATION +# ============================================================================= + +# @input.type: enum +# @input.description: Run Vault in dev mode (in-memory storage, auto-unsealed, NOT for production) +# @input.options: true,false +# @input.required: true +# @input.default: false +devMode: false + +# @input.type: number +# @input.description: Number of Vault server replicas (use 3+ for HA with Raft) +# @input.required: true +# @input.default: 1 +replicas: 1 + +# @input.type: enum +# @input.description: Enable Vault HA mode with Raft integrated storage +# @input.options: true,false +# @input.required: true +# @input.default: false +haEnabled: false + +# @input.type: enum +# @input.description: Enable Vault UI +# @input.options: true,false +# @input.required: true +# @input.default: true +uiEnabled: true + +# @input.type: enum +# @input.description: Enable Vault Agent Injector for automatic sidecar injection +# @input.options: true,false +# @input.required: true +# @input.default: true +injectorEnabled: true + +# @input.type: string +# @input.description: Storage size for Vault data (PVC) +# @input.required: true +# @input.default: 10Gi +dataStorageSize: 10Gi From a8b87103a2021c285198842ea46a87defb2d05de Mon Sep 17 00:00:00 2001 From: John Dietz Date: Sun, 19 Apr 2026 12:04:28 -0400 Subject: [PATCH 67/77] fix(catalog): disable PodSecurityPolicy in groundcover template PSP was removed in Kubernetes 1.25+. The groundcover chart 0.36.3 creates PSP resources by default, causing sync failures on modern clusters. Disable pspEnabled across all subcharts (agent, loki, victoria-metrics, promscale, timescaledb) with a configurable toggle defaulting to false. --- .../groundcover/templates/application.yaml | 20 +++++++++++++++++++ gitops-catalog/groundcover/values.yaml | 8 ++++++++ 2 files changed, 28 insertions(+) diff --git a/gitops-catalog/groundcover/templates/application.yaml b/gitops-catalog/groundcover/templates/application.yaml index 4895795..9614e70 100644 --- a/gitops-catalog/groundcover/templates/application.yaml +++ b/gitops-catalog/groundcover/templates/application.yaml @@ -29,6 +29,26 @@ spec: enabled: {{ .Values.logsEnabled }} traces: enabled: {{ .Values.tracesEnabled }} + rbac: + pspEnabled: {{ .Values.pspEnabled }} + groundcover: + rbac: + pspEnabled: {{ .Values.pspEnabled }} + victoria-metrics-single: + rbac: + pspEnabled: {{ .Values.pspEnabled }} + victoria-metrics-agent: + rbac: + pspEnabled: {{ .Values.pspEnabled }} + loki: + rbac: + pspEnabled: {{ .Values.pspEnabled }} + promscale: + rbac: + pspEnabled: {{ .Values.pspEnabled }} + timescaledb-single: + rbac: + pspEnabled: {{ .Values.pspEnabled }} syncPolicy: automated: prune: true diff --git a/gitops-catalog/groundcover/values.yaml b/gitops-catalog/groundcover/values.yaml index e95d697..900dcd3 100644 --- a/gitops-catalog/groundcover/values.yaml +++ b/gitops-catalog/groundcover/values.yaml @@ -72,3 +72,11 @@ logsEnabled: true # @input.required: true # @input.default: true tracesEnabled: true + +# @input.type: enum +# @input.description: Enable PodSecurityPolicy resources (disable for Kubernetes 1.25+ where PSP is removed) +# @input.options: true,false +# @input.required: true +# @input.default: false +# @input.tip: PSP was removed in Kubernetes 1.25. Set to false for modern clusters. +pspEnabled: false From f067b5884f7c171ca41f420cdec329a2cc923787 Mon Sep 17 00:00:00 2001 From: Rishi <117034340+jokestax@users.noreply.github.com> Date: Sat, 16 May 2026 01:39:34 +0530 Subject: [PATCH 68/77] feat: change vars for workload cluster in Civo --- templates/civo/gpu-cluster/Chart.yaml | 15 --- templates/civo/gpu-cluster/konstruct.yaml | 2 - .../templates/0-providerconfig.yaml | 24 ----- .../templates/10-infrastructure.yaml | 24 ----- .../templates/30-cert-manager.yaml | 35 ------ .../templates/30-envoy-gateway.yaml | 61 ----------- .../gpu-cluster/templates/30-reloader.yaml | 31 ------ .../gpu-cluster/templates/45-environment.yaml | 24 ----- .../templates/infrastructure/wait.yaml | 21 ---- .../templates/infrastructure/workspace.yaml | 24 ----- .../provider-config/providerconfig.yaml | 45 -------- .../templates/registry-workload-cluster.yaml | 30 ------ .../workloadcluster-environment-project.yaml | 26 ----- .../workloadcluster-platform-project.yaml | 26 ----- .../templates/workloadcluster-project.yaml | 27 ----- templates/civo/gpu-cluster/values.yaml | 11 -- .../civo/workload-cluster/konstruct.yaml | 2 - .../templates/infrastructure/workspace.yaml | 2 - templates/civo/workload-cluster/values.yaml | 5 +- .../civo/modules/workload-cluster/gpu.tf | 100 ++++++++++++++++++ 20 files changed, 101 insertions(+), 434 deletions(-) delete mode 100644 templates/civo/gpu-cluster/Chart.yaml delete mode 100644 templates/civo/gpu-cluster/konstruct.yaml delete mode 100644 templates/civo/gpu-cluster/templates/0-providerconfig.yaml delete mode 100644 templates/civo/gpu-cluster/templates/10-infrastructure.yaml delete mode 100644 templates/civo/gpu-cluster/templates/30-cert-manager.yaml delete mode 100644 templates/civo/gpu-cluster/templates/30-envoy-gateway.yaml delete mode 100644 templates/civo/gpu-cluster/templates/30-reloader.yaml delete mode 100644 templates/civo/gpu-cluster/templates/45-environment.yaml delete mode 100644 templates/civo/gpu-cluster/templates/infrastructure/wait.yaml delete mode 100644 templates/civo/gpu-cluster/templates/infrastructure/workspace.yaml delete mode 100644 templates/civo/gpu-cluster/templates/provider-config/providerconfig.yaml delete mode 100644 templates/civo/gpu-cluster/templates/registry-workload-cluster.yaml delete mode 100644 templates/civo/gpu-cluster/templates/workloadcluster-environment-project.yaml delete mode 100644 templates/civo/gpu-cluster/templates/workloadcluster-platform-project.yaml delete mode 100644 templates/civo/gpu-cluster/templates/workloadcluster-project.yaml delete mode 100644 templates/civo/gpu-cluster/values.yaml delete mode 100644 templates/civo/workload-cluster/konstruct.yaml create mode 100644 terraform/civo/modules/workload-cluster/gpu.tf diff --git a/templates/civo/gpu-cluster/Chart.yaml b/templates/civo/gpu-cluster/Chart.yaml deleted file mode 100644 index 0cf8148..0000000 --- a/templates/civo/gpu-cluster/Chart.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v2 -name: civo-gpu-cluster -description: "Civo GPU cluster template — Talos-based with NVIDIA GPU operator" -type: application -version: 2.0.0 -appVersion: "2.0" -keywords: - - argocd - - gpu-cluster - - gitops - - crossplane - - terraform - - civo -maintainers: - - name: Konstruct diff --git a/templates/civo/gpu-cluster/konstruct.yaml b/templates/civo/gpu-cluster/konstruct.yaml deleted file mode 100644 index aaf9fb8..0000000 --- a/templates/civo/gpu-cluster/konstruct.yaml +++ /dev/null @@ -1,2 +0,0 @@ -clusterType: "gpu" -inputs: [] diff --git a/templates/civo/gpu-cluster/templates/0-providerconfig.yaml b/templates/civo/gpu-cluster/templates/0-providerconfig.yaml deleted file mode 100644 index 9093291..0000000 --- a/templates/civo/gpu-cluster/templates/0-providerconfig.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: {{ .Values.workloadClusterName }}-provider-config - namespace: argocd - finalizers: - - resources-finalizer.argocd.argoproj.io - annotations: - argocd.argoproj.io/sync-wave: '0' -spec: - project: default - source: - repoURL: {{ .Values.gitopsRepoUrl }} - path: registry/clusters/{{ .Values.workloadClusterName }}/provider-config - targetRevision: HEAD - destination: - name: in-cluster - namespace: crossplane-system - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/templates/civo/gpu-cluster/templates/10-infrastructure.yaml b/templates/civo/gpu-cluster/templates/10-infrastructure.yaml deleted file mode 100644 index 47c45de..0000000 --- a/templates/civo/gpu-cluster/templates/10-infrastructure.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: {{ .Values.workloadClusterName }}-infrastructure - namespace: argocd - finalizers: - - resources-finalizer.argocd.argoproj.io - annotations: - argocd.argoproj.io/sync-wave: '10' -spec: - project: default - source: - repoURL: {{ .Values.gitopsRepoUrl }} - path: registry/clusters/{{ .Values.workloadClusterName }}/infrastructure - targetRevision: HEAD - destination: - name: in-cluster - namespace: {{ .Values.workloadClusterName }} - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/templates/civo/gpu-cluster/templates/30-cert-manager.yaml b/templates/civo/gpu-cluster/templates/30-cert-manager.yaml deleted file mode 100644 index 18eedad..0000000 --- a/templates/civo/gpu-cluster/templates/30-cert-manager.yaml +++ /dev/null @@ -1,35 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: {{ .Values.workloadClusterName }}-cert-manager - namespace: argocd - finalizers: - - resources-finalizer.argocd.argoproj.io - annotations: - argocd.argoproj.io/sync-wave: '30' -spec: - project: {{ .Values.workloadClusterName }}-platform - source: - repoURL: https://charts.jetstack.io - targetRevision: v1.16.5 - helm: - values: |- - serviceAccount: - create: true - name: cert-manager - installCRDs: true - startupapicheck: - enabled: false - extraArgs: - - --enable-gateway-api - chart: cert-manager - destination: - name: {{ .Values.workloadClusterName }} - namespace: cert-manager - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - - ServerSideApply=true diff --git a/templates/civo/gpu-cluster/templates/30-envoy-gateway.yaml b/templates/civo/gpu-cluster/templates/30-envoy-gateway.yaml deleted file mode 100644 index 558132f..0000000 --- a/templates/civo/gpu-cluster/templates/30-envoy-gateway.yaml +++ /dev/null @@ -1,61 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: {{ .Values.workloadClusterName }}-envoy-gateway - namespace: argocd - finalizers: - - resources-finalizer.argocd.argoproj.io - annotations: - argocd.argoproj.io/sync-wave: '30' -spec: - project: {{ .Values.workloadClusterName }}-platform - source: - repoURL: docker.io/envoyproxy - chart: gateway-helm - targetRevision: v1.7.0 - helm: - valuesObject: - config: - envoyGateway: - logging: - level: - default: info - gateway: - controllerName: gateway.envoyproxy.io/gatewayclass-controller - podDisruptionBudget: - minAvailable: 1 - deployment: - replicas: 1 - envoyGateway: - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - cpu: 500m - memory: 512Mi - pod: - topologySpreadConstraints: - - maxSkew: 1 - topologyKey: kubernetes.io/hostname - whenUnsatisfiable: ScheduleAnyway - labelSelector: - matchLabels: - control-plane: envoy-gateway - destination: - name: {{ .Values.workloadClusterName }} - namespace: envoy-gateway-system - syncPolicy: - automated: - prune: true - selfHeal: true - allowEmpty: false - syncOptions: - - CreateNamespace=true - - ServerSideApply=true - retry: - limit: 5 - backoff: - duration: 5s - factor: 2 - maxDuration: 3m diff --git a/templates/civo/gpu-cluster/templates/30-reloader.yaml b/templates/civo/gpu-cluster/templates/30-reloader.yaml deleted file mode 100644 index f6dd120..0000000 --- a/templates/civo/gpu-cluster/templates/30-reloader.yaml +++ /dev/null @@ -1,31 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: {{ .Values.workloadClusterName }}-reloader - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: '30' -spec: - project: {{ .Values.workloadClusterName }}-platform - source: - repoURL: 'https://stakater.github.io/stakater-charts' - targetRevision: v1.0.10 - chart: reloader - helm: - values: |- - ignoreSecrets: false - destination: - name: {{ .Values.workloadClusterName }} - namespace: reloader - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - retry: - limit: 5 - backoff: - duration: 5s - maxDuration: 5m0s - factor: 2 diff --git a/templates/civo/gpu-cluster/templates/45-environment.yaml b/templates/civo/gpu-cluster/templates/45-environment.yaml deleted file mode 100644 index 16146b0..0000000 --- a/templates/civo/gpu-cluster/templates/45-environment.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: {{ .Values.workloadClusterName }}-{{ .Values.envName }} - namespace: argocd - finalizers: - - resources-finalizer.argocd.argoproj.io - annotations: - argocd.argoproj.io/sync-wave: '45' -spec: - project: {{ .Values.workloadClusterName }}-environment - source: - repoURL: {{ .Values.teamGitopsRepoUrl }} - path: registry/environments/{{ .Values.envName }}/{{ .Values.workloadClusterName }} - targetRevision: HEAD - destination: - name: in-cluster - namespace: {{ .Values.workloadClusterName }}-environment - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/templates/civo/gpu-cluster/templates/infrastructure/wait.yaml b/templates/civo/gpu-cluster/templates/infrastructure/wait.yaml deleted file mode 100644 index 8238d93..0000000 --- a/templates/civo/gpu-cluster/templates/infrastructure/wait.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ .Values.workloadClusterName }}-infrastructure-wait - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: "20" -spec: - template: - spec: - serviceAccountName: argocd-server - containers: - - name: wait - image: {{ .Values.waitJobImage }} - command: - - /bin/sh - - -c - - | - while ! kubectl wait --for=jsonpath='{.status.conditions[0].status}'='True' workspace/{{ .Values.workloadClusterName }}-infrastructure; do echo "waiting for cluster to provision"; sleep 5; done - restartPolicy: Never - backoffLimit: 1 diff --git a/templates/civo/gpu-cluster/templates/infrastructure/workspace.yaml b/templates/civo/gpu-cluster/templates/infrastructure/workspace.yaml deleted file mode 100644 index 6652f14..0000000 --- a/templates/civo/gpu-cluster/templates/infrastructure/workspace.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: tf.upbound.io/v1beta1 -kind: Workspace -metadata: - name: {{ .Values.workloadClusterName }}-infrastructure -spec: - providerConfigRef: - name: {{ .Values.workloadClusterName }} - forProvider: - source: Remote - module: {{ .Values.workloadClusterTerraformModuleUrl }} - vars: - - key: cluster_name - value: {{ .Values.workloadClusterName }} - - key: cluster_region - value: {{ .Values.workloadClusterRegion }} - - key: environment - value: {{ .Values.workloadClusterName }} - - key: node_count - value: "{{ .Values.workloadNodeCount }}" - - key: node_type - value: {{ .Values.workloadNodeType }} - - key: is_gpu - value: "{{ .Values.isGpu }}" - diff --git a/templates/civo/gpu-cluster/templates/provider-config/providerconfig.yaml b/templates/civo/gpu-cluster/templates/provider-config/providerconfig.yaml deleted file mode 100644 index 46c0185..0000000 --- a/templates/civo/gpu-cluster/templates/provider-config/providerconfig.yaml +++ /dev/null @@ -1,45 +0,0 @@ -apiVersion: tf.upbound.io/v1beta1 -kind: ProviderConfig -metadata: - name: {{ .Values.workloadClusterName }} - annotations: - argocd.argoproj.io/sync-wave: "-1" -spec: - configuration: | - terraform { - backend "s3" { - key = "registry/konstruct-clusters/{{ .Values.workloadClusterName }}/infrastructure/provider-config/terraform.tfstate" - bucket = "{{ .Values.projectStateStoreBucket }}" - region = "{{ .Values.projectRegion }}" - endpoint = "https://objectstore.{{ .Values.projectRegion }}.civo.com" - - skip_credentials_validation = true - skip_metadata_api_check = true - skip_region_validation = true - force_path_style = true - } - required_providers { - civo = { - source = "civo/civo" - version = "= 1.1.0" - } - } - } - provider "civo" { - credentials_file = "civo.json" - region = "{{ .Values.workloadClusterRegion }}" - } - pluginCache: false - credentials: - - filename: civo.json - source: Secret - secretRef: - namespace: crossplane-system - name: {{ .Values.cloudAccountName }}-civo-creds - key: config.json - - filename: .git-credentials - source: Secret - secretRef: - namespace: crossplane-system - name: git-credentials - key: creds diff --git a/templates/civo/gpu-cluster/templates/registry-workload-cluster.yaml b/templates/civo/gpu-cluster/templates/registry-workload-cluster.yaml deleted file mode 100644 index 0136813..0000000 --- a/templates/civo/gpu-cluster/templates/registry-workload-cluster.yaml +++ /dev/null @@ -1,30 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: registry-{{ .Values.workloadClusterName }} - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: '100' - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: default - source: - repoURL: {{ .Values.gitopsRepoUrl }} - path: registry/clusters/{{ .Values.workloadClusterName }} - targetRevision: HEAD - destination: - server: https://kubernetes.default.svc - namespace: argocd - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - retry: - limit: 5 - backoff: - duration: 1m - maxDuration: 15m0s - factor: 2 diff --git a/templates/civo/gpu-cluster/templates/workloadcluster-environment-project.yaml b/templates/civo/gpu-cluster/templates/workloadcluster-environment-project.yaml deleted file mode 100644 index 56ac444..0000000 --- a/templates/civo/gpu-cluster/templates/workloadcluster-environment-project.yaml +++ /dev/null @@ -1,26 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: AppProject -metadata: - name: {{ .Values.workloadClusterName }}-environment - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: "-1" - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - description: {{ .Values.workloadClusterName }} description - sourceRepos: - - '{{ .Values.gitopsRepoUrl }}' - destinations: - - name: in-cluster - namespace: {{ .Values.workloadClusterName }}-environment - clusterResourceWhitelist: - - group: '*' - kind: '*' - roles: - - description: {{ .Values.workloadClusterName }}-admin-role - groups: - - admins - name: admin-role - policies: - - p, proj:{{ .Values.workloadClusterName }}:admin-role, applications, *, {{ .Values.workloadClusterName }}/*, allow diff --git a/templates/civo/gpu-cluster/templates/workloadcluster-platform-project.yaml b/templates/civo/gpu-cluster/templates/workloadcluster-platform-project.yaml deleted file mode 100644 index 7a63f6d..0000000 --- a/templates/civo/gpu-cluster/templates/workloadcluster-platform-project.yaml +++ /dev/null @@ -1,26 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: AppProject -metadata: - name: {{ .Values.workloadClusterName }}-platform - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: "-1" - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - description: {{ .Values.workloadClusterName }} description - sourceRepos: - - '*' - destinations: - - namespace: '*' - server: '*' - clusterResourceWhitelist: - - group: '*' - kind: '*' - roles: - - description: {{ .Values.workloadClusterName }}-admin-role - groups: - - admins - name: admin-role - policies: - - p, proj:{{ .Values.workloadClusterName }}:admin-role, applications, *, {{ .Values.workloadClusterName }}/*, allow diff --git a/templates/civo/gpu-cluster/templates/workloadcluster-project.yaml b/templates/civo/gpu-cluster/templates/workloadcluster-project.yaml deleted file mode 100644 index b9d63c1..0000000 --- a/templates/civo/gpu-cluster/templates/workloadcluster-project.yaml +++ /dev/null @@ -1,27 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: AppProject -metadata: - name: {{ .Values.workloadClusterName }} - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: "-1" - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - description: {{ .Values.workloadClusterName }} description - sourceNamespaces: ["{{ .Values.workloadClusterName }}-environment"] - sourceRepos: - - '*' - destinations: - - name: {{ .Values.workloadClusterName }} - namespace: '*' - clusterResourceWhitelist: - - group: '*' - kind: '*' - roles: - - description: {{ .Values.workloadClusterName }}-admin-role - groups: - - admins - name: admin-role - policies: - - p, proj:{{ .Values.workloadClusterName }}:admin-role, applications, *, {{ .Values.workloadClusterName }}/*, allow diff --git a/templates/civo/gpu-cluster/values.yaml b/templates/civo/gpu-cluster/values.yaml deleted file mode 100644 index 9fafc80..0000000 --- a/templates/civo/gpu-cluster/values.yaml +++ /dev/null @@ -1,11 +0,0 @@ -# Terraform Module Configuration -# @input.type: string -# @input.description: the complete URL for the Terraform module for infrastructure provisioning -# @input.required: true -workloadClusterTerraformModuleUrl: "git::https://github.com/konstructio/gitops-template.git//civo-github/terraform/civo/modules/workload-cluster?ref=main" - -# GPU Configuration -isGpu: true - -# Wait Job Configuration -waitJobImage: "dtzar/helm-kubectl:3.19.0" diff --git a/templates/civo/workload-cluster/konstruct.yaml b/templates/civo/workload-cluster/konstruct.yaml deleted file mode 100644 index 9c71f84..0000000 --- a/templates/civo/workload-cluster/konstruct.yaml +++ /dev/null @@ -1,2 +0,0 @@ -clusterType: "physical" -inputs: [] diff --git a/templates/civo/workload-cluster/templates/infrastructure/workspace.yaml b/templates/civo/workload-cluster/templates/infrastructure/workspace.yaml index 6652f14..6e77647 100644 --- a/templates/civo/workload-cluster/templates/infrastructure/workspace.yaml +++ b/templates/civo/workload-cluster/templates/infrastructure/workspace.yaml @@ -19,6 +19,4 @@ spec: value: "{{ .Values.workloadNodeCount }}" - key: node_type value: {{ .Values.workloadNodeType }} - - key: is_gpu - value: "{{ .Values.isGpu }}" diff --git a/templates/civo/workload-cluster/values.yaml b/templates/civo/workload-cluster/values.yaml index f64a076..f3240d9 100644 --- a/templates/civo/workload-cluster/values.yaml +++ b/templates/civo/workload-cluster/values.yaml @@ -2,10 +2,7 @@ # @input.type: string # @input.description: the complete URL for the Terraform module for infrastructure provisioning # @input.required: true -workloadClusterTerraformModuleUrl: "git::https://github.com/konstructio/gitops-template.git//civo-github/terraform/civo/modules/workload-cluster?ref=main" - -# GPU Configuration -isGpu: false +workloadClusterTerraformModuleUrl: "git::https://github.com/konstructio/konstruct-templates.git//civo-github/terraform/civo/modules/workload-cluster?ref=main" # Wait Job Configuration waitJobImage: "dtzar/helm-kubectl:3.19.0" diff --git a/terraform/civo/modules/workload-cluster/gpu.tf b/terraform/civo/modules/workload-cluster/gpu.tf new file mode 100644 index 0000000..c0ee91a --- /dev/null +++ b/terraform/civo/modules/workload-cluster/gpu.tf @@ -0,0 +1,100 @@ +locals { + gpu_node_sizes = [for i in data.civo_size.gpu.sizes : i.name] + gpu_prefixes = ["g4g.", "an."] # Civo GPU sizes start with these prefixes - ensure to end with "." to avoid false positives + deploy_gpu_operator = contains(local.gpu_node_sizes, var.node_type) + + # Single-H100 node pools need NVLink disabled at driver load, since there is + # no peer GPU for NVLink to attach to. On multi-H100 or non-H100 nodes this + # workaround must not be applied — it reduces peer-to-peer bandwidth. + gpu_is_single_h100 = lower(var.node_type) == "an.g1.h100.kube.x1" + +} + +# Get all the GPU node types +data "civo_size" "gpu" { + filter { + key = "name" + values = local.gpu_prefixes + match_by = "re" + } + filter { + key = "type" + values = ["kubernetes"] + } +} + +resource "kubernetes_namespace" "gpu_operator" { + count = locals.deploy_gpu_operator ? 1 : 0 + + metadata { + name = "gpu-operator" + } + + depends_on = [civo_kubernetes_cluster.cluster] +} + +resource "kubernetes_config_map" "nvidia_kernel_config" { + count = locals.deploy_gpu_operator && local.gpu_is_single_h100 ? 1 : 0 + + metadata { + name = "nvidia-kernel-config" + namespace = kubernetes_namespace.gpu_operator[0].metadata[0].name + } + + data = { + "nvidia.conf" = "options nvidia NVreg_NvLinkDisable=1" + } +} + +resource "helm_release" "gpu_operator" { + count = locals.deploy_gpu_operator ? 1 : 0 + + name = "gpu-operator" + repository = "https://helm.ngc.nvidia.com/nvidia" + chart = "gpu-operator" + version = "v25.10.1" + namespace = kubernetes_namespace.gpu_operator[0].metadata[0].name + timeout = 900 + wait = true + + # Civo's GPU images bake in the NVIDIA container toolkit, so toolkit.enabled + # stays false; the rest match the Operator install validated against Civo + # Kubernetes. + set { + name = "driver.enabled" + value = "true" + } + set { + name = "toolkit.enabled" + value = "false" + } + set { + name = "devicePlugin.enabled" + value = "true" + } + set { + name = "gfd.enabled" + value = "true" + } + set { + name = "operator.defaultRuntime" + value = "containerd" + } + set { + name = "validator.cuda.runtimeClassName" + value = "nvidia" + } + + dynamic "set" { + for_each = local.gpu_is_single_h100 ? [1] : [] + content { + name = "driver.kernelModuleConfig.name" + value = "nvidia-kernel-config" + } + } + + depends_on = [ + kubernetes_config_map.nvidia_kernel_config, + kubernetes_namespace.gpu_operator, + ] +} From 5f84442bb1e0fb521c336ca04384565d4ced12fc Mon Sep 17 00:00:00 2001 From: Rishi <117034340+jokestax@users.noreply.github.com> Date: Sat, 16 May 2026 23:16:16 +0530 Subject: [PATCH 69/77] Update gpu.tf --- .../civo/modules/workload-cluster/gpu.tf | 57 ++++++------------- 1 file changed, 17 insertions(+), 40 deletions(-) diff --git a/terraform/civo/modules/workload-cluster/gpu.tf b/terraform/civo/modules/workload-cluster/gpu.tf index c0ee91a..922c851 100644 --- a/terraform/civo/modules/workload-cluster/gpu.tf +++ b/terraform/civo/modules/workload-cluster/gpu.tf @@ -24,17 +24,17 @@ data "civo_size" "gpu" { } resource "kubernetes_namespace" "gpu_operator" { - count = locals.deploy_gpu_operator ? 1 : 0 + count = local.deploy_gpu_operator ? 1 : 0 metadata { name = "gpu-operator" } - depends_on = [civo_kubernetes_cluster.cluster] + depends_on = [civo_kubernetes_cluster.kubefirst] } resource "kubernetes_config_map" "nvidia_kernel_config" { - count = locals.deploy_gpu_operator && local.gpu_is_single_h100 ? 1 : 0 + count = local.deploy_gpu_operator && local.gpu_is_single_h100 ? 1 : 0 metadata { name = "nvidia-kernel-config" @@ -47,8 +47,7 @@ resource "kubernetes_config_map" "nvidia_kernel_config" { } resource "helm_release" "gpu_operator" { - count = locals.deploy_gpu_operator ? 1 : 0 - + count = local.deploy_gpu_operator ? 1 : 0 name = "gpu-operator" repository = "https://helm.ngc.nvidia.com/nvidia" chart = "gpu-operator" @@ -57,41 +56,19 @@ resource "helm_release" "gpu_operator" { timeout = 900 wait = true - # Civo's GPU images bake in the NVIDIA container toolkit, so toolkit.enabled - # stays false; the rest match the Operator install validated against Civo - # Kubernetes. - set { - name = "driver.enabled" - value = "true" - } - set { - name = "toolkit.enabled" - value = "false" - } - set { - name = "devicePlugin.enabled" - value = "true" - } - set { - name = "gfd.enabled" - value = "true" - } - set { - name = "operator.defaultRuntime" - value = "containerd" - } - set { - name = "validator.cuda.runtimeClassName" - value = "nvidia" - } - - dynamic "set" { - for_each = local.gpu_is_single_h100 ? [1] : [] - content { - name = "driver.kernelModuleConfig.name" - value = "nvidia-kernel-config" - } - } + values = [yamlencode({ + driver = merge( + { enabled = true }, + local.gpu_is_single_h100 ? { + kernelModuleConfig = { name = "nvidia-kernel-config" } + } : {} + ) + toolkit = { enabled = false } + devicePlugin = { enabled = true } + gfd = { enabled = true } + operator = { defaultRuntime = "containerd" } + validator = { cuda = { runtimeClassName = "nvidia" } } + })] depends_on = [ kubernetes_config_map.nvidia_kernel_config, From a60eefb748b49b9440606bf2dcea0d30c65bb3f7 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Sun, 17 May 2026 01:27:25 +0530 Subject: [PATCH 70/77] fix: remove duplicates --- .../templates/35-cert-manager.yaml | 32 ------------------- .../templates/35-clusterissuers.yaml | 24 -------------- 2 files changed, 56 deletions(-) delete mode 100644 templates/civo/project-cluster/templates/35-cert-manager.yaml delete mode 100644 templates/civo/project-cluster/templates/35-clusterissuers.yaml diff --git a/templates/civo/project-cluster/templates/35-cert-manager.yaml b/templates/civo/project-cluster/templates/35-cert-manager.yaml deleted file mode 100644 index 83b610f..0000000 --- a/templates/civo/project-cluster/templates/35-cert-manager.yaml +++ /dev/null @@ -1,32 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: {{ .Values.workloadClusterName }}-cert-manager - namespace: argocd - finalizers: - - resources-finalizer.argocd.argoproj.io - annotations: - argocd.argoproj.io/sync-wave: '35' -spec: - project: {{ .Values.workloadClusterName }} - source: - repoURL: https://charts.jetstack.io - targetRevision: v1.20.1 - helm: - values: |- - serviceAccount: - create: true - name: cert-manager - installCRDs: true - extraArgs: - - --enable-gateway-api - chart: cert-manager - destination: - name: {{ .Values.workloadClusterName }} - namespace: cert-manager - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/templates/civo/project-cluster/templates/35-clusterissuers.yaml b/templates/civo/project-cluster/templates/35-clusterissuers.yaml deleted file mode 100644 index 755d930..0000000 --- a/templates/civo/project-cluster/templates/35-clusterissuers.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: {{ .Values.workloadClusterName }}-cert-issuers - namespace: argocd - finalizers: - - resources-finalizer.argocd.argoproj.io - annotations: - argocd.argoproj.io/sync-wave: '36' -spec: - project: {{ .Values.workloadClusterName }} - source: - repoURL: {{ .Values.gitopsRepoUrl }} - path: registry/konstruct-clusters/{{ .Values.workloadClusterName }}/cert-issuers - targetRevision: HEAD - destination: - name: {{ .Values.workloadClusterName }} - namespace: cert-manager - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true From fb26a07da5589ee83097a53578e59e5b84fb6c13 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Sun, 17 May 2026 12:57:20 +0530 Subject: [PATCH 71/77] fix: remove duplicates --- terraform/civo/modules/project-cluster/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/terraform/civo/modules/project-cluster/main.tf b/terraform/civo/modules/project-cluster/main.tf index 246d188..876049a 100644 --- a/terraform/civo/modules/project-cluster/main.tf +++ b/terraform/civo/modules/project-cluster/main.tf @@ -29,7 +29,7 @@ resource "civo_kubernetes_cluster" "project-cluster" { firewall_id = civo_firewall.project-cluster.id write_kubeconfig = true cluster_type = "k3s" - kubernetes_version = "1.34.2-k3s1" + kubernetes_version = "1.35.0-k3s1" pools { label = var.cluster_name size = var.node_type From 7b5ba7187d309eb492002c8bc006c86da7a3faad Mon Sep 17 00:00:00 2001 From: mrrishi Date: Sun, 17 May 2026 13:01:23 +0530 Subject: [PATCH 72/77] feat: upgrade version to 1.35 --- terraform/civo/modules/workload-cluster/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/terraform/civo/modules/workload-cluster/main.tf b/terraform/civo/modules/workload-cluster/main.tf index 3a54b0b..e91a834 100644 --- a/terraform/civo/modules/workload-cluster/main.tf +++ b/terraform/civo/modules/workload-cluster/main.tf @@ -14,7 +14,7 @@ resource "civo_kubernetes_cluster" "kubefirst" { firewall_id = civo_firewall.kubefirst.id write_kubeconfig = true cluster_type = "k3s" - kubernetes_version = "1.34.2-k3s1" + kubernetes_version = "1.35.0-k3s1" pools { label = var.cluster_name size = var.node_type From be9f6e96dcf838bfde38df88d99c78169f0337d4 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Sun, 17 May 2026 13:21:55 +0530 Subject: [PATCH 73/77] feat: upgrade version to 1.35 --- terraform/civo/modules/project-cluster/main.tf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/terraform/civo/modules/project-cluster/main.tf b/terraform/civo/modules/project-cluster/main.tf index 876049a..cd71d65 100644 --- a/terraform/civo/modules/project-cluster/main.tf +++ b/terraform/civo/modules/project-cluster/main.tf @@ -180,7 +180,7 @@ provider "kubernetes" { alias = "incluster" } -resource "kubernetes_secret" "preshared_token_mgmt" { +resource "kubernetes_secret_v1" "preshared_token_mgmt" { provider = kubernetes.incluster metadata { name = "pre-shared-token" @@ -197,7 +197,7 @@ resource "kubernetes_namespace_v1" "argocd" { } } -resource "kubernetes_secret" "preshared_token_argocd" { +resource "kubernetes_secret_v1" "preshared_token_argocd" { depends_on = [civo_kubernetes_cluster.project-cluster] metadata { name = "platform-cluster-identity" @@ -209,7 +209,7 @@ resource "kubernetes_secret" "preshared_token_argocd" { } } -resource "kubernetes_secret" "preshared_token_crossplane" { +resource "kubernetes_secret_v1" "preshared_token_crossplane" { depends_on = [civo_kubernetes_cluster.project-cluster] metadata { name = "platform-cluster-identity" From 2fd65a6dd876f09254b5e22c667fa290a2202d79 Mon Sep 17 00:00:00 2001 From: John Dietz Date: Mon, 18 May 2026 06:17:19 -0400 Subject: [PATCH 74/77] Update cluster configuration in values.yaml --- gitops-catalog/ollama-openwebui/values.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/gitops-catalog/ollama-openwebui/values.yaml b/gitops-catalog/ollama-openwebui/values.yaml index a9f5e84..8d96847 100644 --- a/gitops-catalog/ollama-openwebui/values.yaml +++ b/gitops-catalog/ollama-openwebui/values.yaml @@ -7,7 +7,7 @@ # @input.description: Cluster name identifier # @input.required: true # @input.default: my-cluster -clusterName: my-cluster +clusterName: gg-gpu # @input.type: string # @input.description: GitOps repository URL for ArgoCD sync @@ -25,13 +25,13 @@ registryPath: registry/clusters/my-cluster # @input.description: Target cluster destination for ArgoCD # @input.required: true # @input.default: in-cluster -clusterDestination: in-cluster +clusterDestination: gg-gpu # @input.type: string # @input.description: ArgoCD project name # @input.required: true # @input.default: default -project: default +project: gg-gpu # @input.type: string # @input.description: Namespace for Open WebUI and Ollama deployment From 7d6bf0c6b3bec34ebaa87b96ff6305c1ffc4203c Mon Sep 17 00:00:00 2001 From: Rishi <117034340+jokestax@users.noreply.github.com> Date: Mon, 18 May 2026 16:02:52 +0530 Subject: [PATCH 75/77] Update values.yaml --- gitops-catalog/ollama-openwebui/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitops-catalog/ollama-openwebui/values.yaml b/gitops-catalog/ollama-openwebui/values.yaml index 8d96847..3a99c69 100644 --- a/gitops-catalog/ollama-openwebui/values.yaml +++ b/gitops-catalog/ollama-openwebui/values.yaml @@ -43,7 +43,7 @@ namespace: openwebui # @input.description: Open WebUI Helm chart version (from https://helm.openwebui.com) # @input.required: true # @input.default: 6.38.0 -chartVersion: 13.3.1 +chartVersion: 3.1.19 # ============================================================================= # OPEN WEBUI CONFIGURATION From b3b59780640ec201896cb2cbd9f6d223a16f4247 Mon Sep 17 00:00:00 2001 From: mrrishi Date: Wed, 20 May 2026 14:18:41 +0530 Subject: [PATCH 76/77] fix: ns to v1 --- terraform/civo/modules/workload-cluster/gpu.tf | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/terraform/civo/modules/workload-cluster/gpu.tf b/terraform/civo/modules/workload-cluster/gpu.tf index 922c851..2c1ad0a 100644 --- a/terraform/civo/modules/workload-cluster/gpu.tf +++ b/terraform/civo/modules/workload-cluster/gpu.tf @@ -23,7 +23,7 @@ data "civo_size" "gpu" { } } -resource "kubernetes_namespace" "gpu_operator" { +resource "kubernetes_namespace_v1" "gpu_operator" { count = local.deploy_gpu_operator ? 1 : 0 metadata { @@ -38,7 +38,7 @@ resource "kubernetes_config_map" "nvidia_kernel_config" { metadata { name = "nvidia-kernel-config" - namespace = kubernetes_namespace.gpu_operator[0].metadata[0].name + namespace = kubernetes_namespace_v1.gpu_operator[0].metadata[0].name } data = { @@ -52,7 +52,7 @@ resource "helm_release" "gpu_operator" { repository = "https://helm.ngc.nvidia.com/nvidia" chart = "gpu-operator" version = "v25.10.1" - namespace = kubernetes_namespace.gpu_operator[0].metadata[0].name + namespace = kubernetes_namespace_v1.gpu_operator[0].metadata[0].name timeout = 900 wait = true @@ -72,6 +72,6 @@ resource "helm_release" "gpu_operator" { depends_on = [ kubernetes_config_map.nvidia_kernel_config, - kubernetes_namespace.gpu_operator, + kubernetes_namespace_v1.gpu_operator, ] } From bfbd7b7095929ec3955b3b3609f7e86e7af67dda Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cristhian=20Fern=C3=A1ndez?= Date: Thu, 18 Jun 2026 12:03:33 -0500 Subject: [PATCH 77/77] =?UTF-8?q?=F0=9F=90=9B=20fix(civo/project-cluster):?= =?UTF-8?q?=20correct=20external-dns=20domain=20and=20one-shot=20Job=20hoo?= =?UTF-8?q?ks?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three fixes for the civo/project-cluster template that left freshly-created mgmt clusters with Degraded/flapping ArgoCD apps: 1. external-dns domainFilters used .Values.domainName (default konstruct.io), never overridden, while all hostnames use .Values.domain (the real env domain that IS injected). external-dns published nothing (NXDOMAIN) -> ACME HTTP-01 failed -> certs unissued -> Gateway HTTPS listeners InvalidCertificateRef -> argocd/envoy-gateway-components/registry Degraded. Point domainFilters at .Values.domain and drop the now-unused domainName value. 2. github-token-refresher-init Jobs (argocd + crossplane-components) used hook-delete-policy: hook-succeeded, so ArgoCD deleted them on success while still tracking them as desired -> apps stuck OutOfSync/Missing. Use before-hook-creation so the completed Job persists. 3. apply-argocd-clusters-app was a plain Job with ttlSecondsAfterFinished: 100; k8s auto-deleted it ~100s after completion while ArgoCD tracked it -> the argocd app flapped Synced<->OutOfSync every ~100s. Make it a post-install/ post-upgrade hook (before-hook-creation) and drop the TTL. --- templates/civo/project-cluster/templates/30-external-dns.yaml | 2 +- .../civo/project-cluster/templates/argocd/application.yaml | 4 +++- .../templates/argocd/github-token-refresher.yaml | 2 +- .../crossplane-components/github-token-refresher.yaml | 2 +- templates/civo/project-cluster/values.yaml | 2 -- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/templates/civo/project-cluster/templates/30-external-dns.yaml b/templates/civo/project-cluster/templates/30-external-dns.yaml index d8a46c7..a9c6b3f 100644 --- a/templates/civo/project-cluster/templates/30-external-dns.yaml +++ b/templates/civo/project-cluster/templates/30-external-dns.yaml @@ -26,7 +26,7 @@ spec: - gateway-tcproute - gateway-udproute domainFilters: - - {{ .Values.domainName }} + - {{ .Values.domain }} env: - name: {{ .Values.externalDnsProviderTokenEnvName }} valueFrom: diff --git a/templates/civo/project-cluster/templates/argocd/application.yaml b/templates/civo/project-cluster/templates/argocd/application.yaml index 3d52de1..551c824 100644 --- a/templates/civo/project-cluster/templates/argocd/application.yaml +++ b/templates/civo/project-cluster/templates/argocd/application.yaml @@ -33,8 +33,10 @@ kind: Job metadata: name: apply-argocd-clusters-app namespace: argocd + annotations: + helm.sh/hook: post-install,post-upgrade + helm.sh/hook-delete-policy: before-hook-creation spec: - ttlSecondsAfterFinished: 100 template: spec: serviceAccountName: argocd-application-creator diff --git a/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml b/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml index e0b0e4c..6442b3f 100644 --- a/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml +++ b/templates/civo/project-cluster/templates/argocd/github-token-refresher.yaml @@ -133,7 +133,7 @@ metadata: namespace: argocd annotations: helm.sh/hook: post-install,post-upgrade - helm.sh/hook-delete-policy: hook-succeeded + helm.sh/hook-delete-policy: before-hook-creation spec: template: spec: diff --git a/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml b/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml index 12999ed..1f1fccd 100644 --- a/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml +++ b/templates/civo/project-cluster/templates/crossplane-components/github-token-refresher.yaml @@ -95,7 +95,7 @@ metadata: namespace: crossplane-system annotations: helm.sh/hook: post-install,post-upgrade - helm.sh/hook-delete-policy: hook-succeeded + helm.sh/hook-delete-policy: before-hook-creation spec: template: spec: diff --git a/templates/civo/project-cluster/values.yaml b/templates/civo/project-cluster/values.yaml index 21612c6..a134ccd 100644 --- a/templates/civo/project-cluster/values.yaml +++ b/templates/civo/project-cluster/values.yaml @@ -5,8 +5,6 @@ workloadClusterTerraformModuleUrl: "git::https://github.com/konstructio/konstruc # @input.required: false email: 123@gmail.com -domainName: konstruct.io - # Wait Job Configuration waitJobImage: "dtzar/helm-kubectl:3.19.0"