-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: Integrate gitlab with external object store (#15)
feat: Integrate gitlab with external object store chore: Upgrade to uds-cli v0.4.1
- Loading branch information
1 parent
0cbe86c
commit 7308c45
Showing
11 changed files
with
258 additions
and
47 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,37 +1,64 @@ | ||
| # uds-bundle-software-factory-nutanix | ||
| A UDS Bundle Containing | ||
| - custom init package | ||
| - metallb | ||
| - dubbd-rke2 | ||
| - keycloak | ||
| - gitlab | ||
| - gitlab-runner | ||
| - sonarqube | ||
| - jira | ||
| - confluence | ||
| - mattermost | ||
| - nexus | ||
| Detailed list of packages and dependencies in this bundle: | ||
| [packages-and-dependencies.md](docs/packages-and-dependencies.md) | ||
|
|
||
| ## Developer Info | ||
|
|
||
| [DEVELOPMENT_MAINTENANCE.md](docs/DEVELOPMENT_MAINTENANCE.md) | ||
|
|
||
| ## Deploying | ||
| ## Key Points | ||
| This project is continually improving and being iterated on. Stay tuned to the latest updates. | ||
| ### Things you will need | ||
| - You need an appropriately provisioned kubernetes cluster to deploy to. | ||
| - You need all databases and object storage provisioned with connection configurations ready to plug into your `uds-config.yaml` | ||
| - You need domain configuration and certs ready for use | ||
| - You need [zarf](https://github.com/defenseunicorns/zarf) and [uds](https://github.com/defenseunicorns/uds-cli) | ||
| - You need a bundle artifact. You can build it from this repository, download it or reference it directly from the [oci registry](https://github.com/defenseunicorns/uds-bundle-software-factory-nutanix/pkgs/container/uds-bundle%2Fsoftware-factory-nutanix) | ||
| - You need a `uds-config.yaml` that is set up for your environment. | ||
| - You need a `deploy-dubbd-values.yaml` to configure some resource increases needed for this bundle. | ||
|
|
||
| You can run the following command to deploy the published bundle from oci. You can use the breadcrumbs in the [Makefile](Makefile) to understand how the examples in this project are configured, built and deployed. | ||
| ## The Bundle | ||
|
|
||
| This is only an example. You need to set up and use the `uds-config.yaml`, `deploy-dubbd-values.yaml`, and certs that make sense for your deployment. | ||
| When disconnected, you can download the tarball for this bundle to use for deployment from the oci compliant github container registry connected to this repo [here](https://github.com/defenseunicorns/uds-bundle-software-factory-nutanix/pkgs/container/uds-bundle%2Fsoftware-factory-nutanix). You can also deploy the bundle directly from the oci registry if you are in a connected environment. | ||
|
|
||
| `uds deploy oci://ghcr.io/defenseunicorns/uds-bundle/uds-bundle-software-factory-nutanix:v0.x.x-amd64 --confirm` | ||
| ## uds-config.yaml | ||
| Once you have the bundle where you need or have access to it via oci, you can then set up a `uds-config.yaml` configuration for your environment. This configuration will be used during deployment. | ||
|
|
||
| ### UDS Config | ||
| Below are the example configurations used in this project to configure deploy time zarf variables for packages in the bundle. | ||
| Below are the example configurations used in this project to configure deploy time variables for the zarf packages in the bundle. | ||
| - [uds-config.yaml](uds-config/dev-cluster/uds-config.yaml) Example of our nutanix Dev cluster config | ||
| - [uds-config.yaml](uds-config/test-cluster/uds-config.yaml) Example of our nutanix Test cluster config | ||
|
|
||
| There will be sensitive values you will need to update before deployment. | ||
| There will be sensitive values you will need to update before deployment. You can search `replace-me` in the above `uds-config.yaml` files for quick reference sensitive values needing updated. | ||
|
|
||
| ### Certs | ||
| If deploying from this example you will need to insure the contents in the .pem files linked below are correct for your deployment. They contain the public `bigbang.dev` cert and key as placeholders. The [update-certs.sh](scripts/update-certs.sh) will be called in this examples Makefile to update the appropriate kubernetes resources. | ||
| - [test-cluster-ingress-cert.pem](scripts/test-cluster-ingress-cert.pem) | ||
| - [test-cluster-ingress-key.pem](scripts/test-cluster-ingress-key.pem) | ||
| ## Certs | ||
| Currently we are deploying the bundle, and then updating the certs in the cluster to our own `mtsi.bigbang.dev` and `mtsi-dev.bigbang.dev` certs using this [update-certs.sh](scripts/update-certs.sh) script. In a future version we will update this example to put the certs in the `uds-config.yaml` to be setup at deploy time. | ||
|
|
||
| ## High Level Steps | ||
| You can follow the breadcrumbs starting at the [Makefile](Makefile) target `make all/dev-cluster`. This Makefile downloads configured versions of zarf and uds to the build directory, places the `uds-config.yaml` and `deploy-dubbd-values.yaml` in that build directory and performs the deploy command from there. Steps numbered below. Or follow along in the Makefile. | ||
|
|
||
| These breadcrumbs will show you how to: | ||
| 1) download the tools you need like zarf and uds. | ||
| ```bash | ||
| .PHONY: build/zarf | ||
| build/zarf: | build ## Download the Zarf to the build dir | ||
| if [ -f build/zarf ] && [ "$$(build/zarf version)" = "$(ZARF_VERSION)" ] ; then exit 0; fi && \ | ||
| echo "Downloading zarf" && \ | ||
| curl -sL https://github.com/defenseunicorns/zarf/releases/download/$(ZARF_VERSION)/zarf_$(ZARF_VERSION)_$(UNAME_S)_$(ARCH) -o build/zarf && \ | ||
| chmod +x build/zarf | ||
|
|
||
| .PHONY: build/uds | ||
| build/uds: | build ## Download uds-cli to the build dir | ||
| if [ -f build/uds ] && [ "$$(build/uds version)" = "$(UDS_CLI_VERSION)" ] ; then exit 0; fi && \ | ||
| echo "Downloading uds-cli" && \ | ||
| curl -sL https://github.com/defenseunicorns/uds-cli/releases/download/$(UDS_CLI_VERSION)/uds-cli_$(UDS_CLI_VERSION)_$(UNAME_S)_$(ARCH) -o build/uds && \ | ||
| chmod +x build/uds | ||
| ``` | ||
| You can also use brew to install zarf and uds-cli | ||
| ```bash | ||
| brew tap defenseunicorns/tap && brew install uds && brew install zarf | ||
| ``` | ||
| 2) build all the zarf packages that support this bundle | ||
| 1) build the bundle itself | ||
| 1) place the `uds-config.yaml` and the `deploy-dubbd-values.yaml` in the directory where the deployment will take place | ||
| 1) deploy the software factory. | ||
| 1) update the certs with our certs (This step will be replaced with adding the certs to the configuration in a future version) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| # Source: bigbang/templates/gitlab/secret-objectstore.yaml | ||
| apiVersion: v1 | ||
| kind: Secret | ||
| metadata: | ||
| name: gitlab-object-store | ||
| namespace: gitlab | ||
| type: kubernetes.io/opaque | ||
| stringData: | ||
| connection: |- | ||
| provider: AWS | ||
| region: us-east-1 | ||
| aws_access_key_id: ###ZARF_VAR_ACCESS_KEY### | ||
| aws_secret_access_key: ###ZARF_VAR_SECRET_KEY### | ||
| endpoint: ###ZARF_VAR_ENDPOINT### | ||
| aws_signature_version: 4 | ||
| path_style: true | ||
| registry: |- | ||
| s3: | ||
| bucket: uds-gitlab-registry | ||
| accesskey: ###ZARF_VAR_ACCESS_KEY### | ||
| secretkey: ###ZARF_VAR_SECRET_KEY### | ||
| regionendpoint: ###ZARF_VAR_ENDPOINT### | ||
| region: us-east-1 | ||
| aws_signature_version: 4 | ||
| path_style: true | ||
| backups: |- | ||
| [default] | ||
| access_key = ###ZARF_VAR_ACCESS_KEY### | ||
| secret_key = ###ZARF_VAR_SECRET_KEY### | ||
| host_base = ###ZARF_VAR_ENDPOINT### | ||
| host_bucket = ###ZARF_VAR_ENDPOINT### | ||
| bucket_location = us-east-1 | ||
| multipart_chunk_size_mb = 128 | ||
| use_https = False |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| # yaml-language-server: $schema=https://raw.githubusercontent.com/defenseunicorns/zarf/main/zarf.schema.json | ||
| kind: ZarfPackageConfig | ||
| metadata: | ||
| name: gitlab-object-store | ||
| version: "0.0.1" | ||
| architecture: amd64 | ||
|
|
||
| variables: | ||
| - name: ENDPOINT | ||
| default: "replace-me" | ||
| - name: ACCESS_KEY | ||
| default: "replace-me" | ||
| - name: SECRET_KEY | ||
| default: "replace-me" | ||
|
|
||
| components: | ||
| - name: gitlab-object-store-secret | ||
| required: true | ||
| manifests: | ||
| - name: gitlab-object-store-secret | ||
| files: | ||
| - "secret.yaml" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| # Source: bigbang/templates/mattermost/secret-objectstore.yaml | ||
| apiVersion: v1 | ||
| kind: Secret | ||
| metadata: | ||
| name: ca-secret | ||
| namespace: mattermost | ||
| type: kubernetes.io/opaque | ||
| stringData: | ||
| ca.crt: | | ||
| ###ZARF_VAR_CA_CERT### |
19 changes: 19 additions & 0 deletions
19
packages/object-store/mattermost/policy-exceptions/externalName.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| apiVersion: kyverno.io/v2alpha1 | ||
| kind: PolicyException | ||
| metadata: | ||
| name: mattermost-object-storage-external-names-exception | ||
| namespace: mattermost | ||
| spec: | ||
| exceptions: | ||
| - policyName: restrict-external-names | ||
| ruleNames: | ||
| - external-names | ||
| match: | ||
| any: | ||
| - resources: | ||
| kinds: | ||
| - Service | ||
| namespaces: | ||
| - mattermost | ||
| names: | ||
| - mattermost-object-store |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| # Source: bigbang/templates/mattermost/secret-objectstore.yaml | ||
| apiVersion: v1 | ||
| kind: Secret | ||
| metadata: | ||
| name: mattermost-object-store | ||
| namespace: mattermost | ||
| type: kubernetes.io/opaque | ||
| stringData: | ||
| accesskey: "###ZARF_VAR_ACCESS_KEY###" | ||
| secretkey: "###ZARF_VAR_SECRET_KEY###" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| # yaml-language-server: $schema=https://raw.githubusercontent.com/defenseunicorns/zarf/main/zarf.schema.json | ||
| kind: ZarfPackageConfig | ||
| metadata: | ||
| name: mattermost-object-store | ||
| version: "0.0.1" | ||
| architecture: amd64 | ||
|
|
||
| variables: | ||
| - name: ACCESS_KEY | ||
| default: "replace-me" | ||
| - name: SECRET_KEY | ||
| default: "replace-me" | ||
| - name: CA_CERT | ||
| default: "replace-me" | ||
| autoIndent: true | ||
|
|
||
| components: | ||
| - name: object-store-kyverno-exceptions | ||
| required: true | ||
| manifests: | ||
| - name: kyverno-exceptions | ||
| files: | ||
| - policy-exceptions/externalName.yaml | ||
| - name: mattermost-object-store-secret | ||
| required: true | ||
| manifests: | ||
| - name: mattermost-object-store-secret | ||
| files: | ||
| - "secret.yaml" | ||
| - name: mattermost-object-store-ca-cert | ||
| required: true | ||
| manifests: | ||
| - name: mattermost-object-store-ca-cert | ||
| files: | ||
| - "ca-cert.yaml" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.