feat!: Refector directories and flux apps (#559)
This commit is contained in:
Devin Buhl authored and GitHub committed
1 parent
a43e2325f1
commit
4e6edcc66a
163 files changed
+1194
-1060
No files matched your search
@@ -40,39 +40,44 @@ main() {
|
||||
# generate sops configuration file
|
||||
envsubst < "${PROJECT_DIR}/tmpl/.sops.yaml" \
|
||||
> "${PROJECT_DIR}/.sops.yaml"
|
||||
|
||||
# generate cluster settings
|
||||
envsubst < "${PROJECT_DIR}/tmpl/cluster/cluster-settings.yaml" \
|
||||
> "${PROJECT_DIR}/cluster/flux/vars/cluster-settings.yaml"
|
||||
envsubst < "${PROJECT_DIR}/tmpl/cluster/flux-cluster.yaml" \
|
||||
> "${PROJECT_DIR}/cluster/flux/config/flux-cluster.yaml"
|
||||
envsubst < "${PROJECT_DIR}/tmpl/cluster/kube-vip-daemonset.yaml" \
|
||||
> "${PROJECT_DIR}/cluster/apps/kube-system/kube-vip/daemon-set.yaml"
|
||||
# generate cluster secrets
|
||||
envsubst < "${PROJECT_DIR}/tmpl/cluster/cluster-secrets.sops.yaml" \
|
||||
> "${PROJECT_DIR}/cluster/flux/vars/cluster-secrets.sops.yaml"
|
||||
envsubst < "${PROJECT_DIR}/tmpl/cluster/cert-manager-secret.sops.yaml" \
|
||||
> "${PROJECT_DIR}/cluster/apps/kube-system/cert-manager/issuers/secret.sops.yaml"
|
||||
envsubst < "${PROJECT_DIR}/tmpl/cluster/cloudflare-ddns-secret.sops.yaml" \
|
||||
> "${PROJECT_DIR}/cluster/apps/kube-system/cloudflare-ddns/secret.sops.yaml"
|
||||
envsubst < "${PROJECT_DIR}/tmpl/cluster/external-dns-secret.sops.yaml" \
|
||||
> "${PROJECT_DIR}/cluster/apps/kube-system/external-dns/secret.sops.yaml"
|
||||
# encrypt cluster secrets
|
||||
sops --encrypt --in-place "${PROJECT_DIR}/cluster/flux/vars/cluster-secrets.sops.yaml"
|
||||
sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/kube-system/cert-manager/issuers/secret.sops.yaml"
|
||||
sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/kube-system/cloudflare-ddns/secret.sops.yaml"
|
||||
sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/kube-system/external-dns/secret.sops.yaml"
|
||||
# generate terraform secrets
|
||||
envsubst < "${PROJECT_DIR}/tmpl/kubernetes/flux/cluster-settings.yaml" \
|
||||
> "${PROJECT_DIR}/kubernetes/flux/vars/cluster-settings.yaml"
|
||||
|
||||
envsubst < "${PROJECT_DIR}/tmpl/kubernetes/flux/cluster.yaml" \
|
||||
> "${PROJECT_DIR}/kubernetes/flux/config/cluster.yaml"
|
||||
|
||||
# generate secrets
|
||||
envsubst < "${PROJECT_DIR}/tmpl/kubernetes/cluster-secrets.sops.yaml" \
|
||||
> "${PROJECT_DIR}/kubernetes/flux/vars/cluster-secrets.sops.yaml"
|
||||
sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/flux/vars/cluster-secrets.sops.yaml"
|
||||
|
||||
envsubst < "${PROJECT_DIR}/tmpl/kubernetes/cert-manager-secret.sops.yaml" \
|
||||
> "${PROJECT_DIR}/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml"
|
||||
sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml"
|
||||
|
||||
envsubst < "${PROJECT_DIR}/tmpl/kubernetes/cloudflare-ddns-secret.sops.yaml" \
|
||||
> "${PROJECT_DIR}/kubernetes/apps/networking/cloudflare-ddns/app/secret.sops.yaml"
|
||||
sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/networking/cloudflare-ddns/app/secret.sops.yaml"
|
||||
|
||||
envsubst < "${PROJECT_DIR}/tmpl/kubernetes/external-dns-secret.sops.yaml" \
|
||||
> "${PROJECT_DIR}/kubernetes/apps/networking/external-dns/app/secret.sops.yaml"
|
||||
sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/networking/external-dns/app/secret.sops.yaml"
|
||||
|
||||
envsubst < "${PROJECT_DIR}/tmpl/terraform/secret.sops.yaml" \
|
||||
> "${PROJECT_DIR}/provision/terraform/cloudflare/secret.sops.yaml"
|
||||
# encrypt terraform secrets
|
||||
sops --encrypt --in-place "${PROJECT_DIR}/provision/terraform/cloudflare/secret.sops.yaml"
|
||||
> "${PROJECT_DIR}/terraform/cloudflare/secret.sops.yaml"
|
||||
sops --encrypt --in-place "${PROJECT_DIR}/terraform/cloudflare/secret.sops.yaml"
|
||||
|
||||
# generate ansible settings
|
||||
envsubst < "${PROJECT_DIR}/tmpl/ansible/kube-vip.yml" \
|
||||
> "${PROJECT_DIR}/provision/ansible/inventory/group_vars/kubernetes/kube-vip.yml"
|
||||
> "${PROJECT_DIR}/ansible/inventory/group_vars/kubernetes/kube-vip.yml"
|
||||
|
||||
# generate ansible hosts file and secrets
|
||||
generate_ansible_hosts
|
||||
generate_ansible_host_secrets
|
||||
setup_github_webhook
|
||||
setup_weave_gitops
|
||||
success
|
||||
fi
|
||||
}
|
||||
@@ -236,6 +241,7 @@ verify_binaries() {
|
||||
_has_binary "helm"
|
||||
_has_binary "ipcalc"
|
||||
_has_binary "jq"
|
||||
_has_binary "gitops"
|
||||
_has_binary "yq"
|
||||
_has_binary "sops"
|
||||
_has_binary "ssh"
|
||||
@@ -289,25 +295,40 @@ verify_git_repository() {
|
||||
}
|
||||
|
||||
setup_github_webhook() {
|
||||
WEBHOOK_SECRET="${BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET:-ignored}"
|
||||
_has_envar "BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET"
|
||||
|
||||
if [[ "${WEBHOOK_SECRET}" != "ignored" ]]; then
|
||||
if [[ "${WEBHOOK_SECRET}" == "generated" ]]; then
|
||||
WEBHOOK_SECRET="$(openssl rand -base64 30)"
|
||||
fi
|
||||
WEBHOOK_SECRET="${BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET}"
|
||||
|
||||
export BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET="${WEBHOOK_SECRET}"
|
||||
_log "INFO" "Using GitHub Token '${WEBHOOK_SECRET}' for Flux"
|
||||
|
||||
mkdir -p "${PROJECT_DIR}/cluster/flux/add-ons"
|
||||
cp -rf "${PROJECT_DIR}/tmpl/cluster/flux/webhooks" "${PROJECT_DIR}/cluster/flux/add-ons"
|
||||
cp -rf "${PROJECT_DIR}/tmpl/cluster/flux/kustomization.yaml" "${PROJECT_DIR}/cluster/flux/add-ons"
|
||||
|
||||
envsubst < "${PROJECT_DIR}/tmpl/cluster/flux/webhooks/github/secret.sops.yaml" \
|
||||
> "${PROJECT_DIR}/cluster/flux/add-ons/webhooks/github/secret.sops.yaml"
|
||||
|
||||
sops --encrypt --in-place "${PROJECT_DIR}/cluster/flux/add-ons/webhooks/github/secret.sops.yaml"
|
||||
if [[ "${WEBHOOK_SECRET}" == "generated" ]]; then
|
||||
WEBHOOK_SECRET="$(openssl rand -base64 30)"
|
||||
fi
|
||||
|
||||
export BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET="${WEBHOOK_SECRET}"
|
||||
_log "INFO" "Using GitHub Token '${WEBHOOK_SECRET}' for Flux"
|
||||
|
||||
envsubst < "${PROJECT_DIR}/tmpl/kubernetes/github-webhook-token-secret.sops.yaml" \
|
||||
> "${PROJECT_DIR}/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml"
|
||||
sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml"
|
||||
}
|
||||
|
||||
setup_weave_gitops() {
|
||||
_has_envar "BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD"
|
||||
|
||||
WEAVE_GITOPS_ADMIN_PASSWORD="${BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD}"
|
||||
|
||||
if [[ "${WEAVE_GITOPS_ADMIN_PASSWORD}" == "generated" ]]; then
|
||||
WEAVE_GITOPS_ADMIN_PASSWORD="$(openssl rand -base64 30)"
|
||||
fi
|
||||
|
||||
export BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD="${WEAVE_GITOPS_ADMIN_PASSWORD}"
|
||||
_log "INFO" "Using admin password '${WEAVE_GITOPS_ADMIN_PASSWORD}' for Weave Gitops"
|
||||
|
||||
# Convert password to bcrypt hash
|
||||
export BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD="$(echo -n "${BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD}" | gitops get bcrypt-hash)"
|
||||
|
||||
envsubst < "${PROJECT_DIR}/tmpl/kubernetes/weave-gitops-secret.sops.yaml" \
|
||||
> "${PROJECT_DIR}/kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml"
|
||||
sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml"
|
||||
}
|
||||
|
||||
verify_cloudflare() {
|
||||
@@ -426,8 +447,8 @@ generate_ansible_host_secrets() {
|
||||
printf "kind: Secret\n"
|
||||
printf "ansible_user: %s\n" "${!node_username}"
|
||||
printf "ansible_become_pass: %s\n" "${!node_password}"
|
||||
} > "${PROJECT_DIR}/provision/ansible/inventory/host_vars/${node_hostname}.sops.yml"
|
||||
sops --encrypt --in-place "${PROJECT_DIR}/provision/ansible/inventory/host_vars/${node_hostname}.sops.yml"
|
||||
} > "${PROJECT_DIR}/ansible/inventory/host_vars/${node_hostname}.sops.yml"
|
||||
sops --encrypt --in-place "${PROJECT_DIR}/ansible/inventory/host_vars/${node_hostname}.sops.yml"
|
||||
done
|
||||
}
|
||||
|
||||
@@ -480,7 +501,7 @@ generate_ansible_hosts() {
|
||||
fi
|
||||
done
|
||||
fi
|
||||
} > "${PROJECT_DIR}/provision/ansible/inventory/hosts.yml"
|
||||
} > "${PROJECT_DIR}/ansible/inventory/hosts.yml"
|
||||
}
|
||||
|
||||
success() {
|
||||
|
||||
Reference in new issue
Block a user