diff --git a/CHANGELOG.md b/CHANGELOG.md index c0d681c7a3..da745ef985 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,51 @@ # Changelog +## [0.49.0](https://www.github.com/JGodin-C2C/devops-stack/compare/v0.48.0...v0.49.0) (2021-12-02) + + +### ⚠ BREAKING CHANGES + +* **eks:** send http traffic on NLB to port 80 on cluster (#810) + +### Features + +* **docs:** improve KinD docs ([#820](https://www.github.com/JGodin-C2C/devops-stack/issues/820)) ([f5e3f2b](https://www.github.com/JGodin-C2C/devops-stack/commit/f5e3f2b07d59b24923c31c60eef18622f02fe546)) +* **keycloak:** pass a user list to keycloak ([#788](https://www.github.com/JGodin-C2C/devops-stack/issues/788)) ([c2835ec](https://www.github.com/JGodin-C2C/devops-stack/commit/c2835ecaba5ffb02908fa77049cffecb976787e3)) +* **kind:** add experimental support for KIND ([#785](https://www.github.com/JGodin-C2C/devops-stack/issues/785)) ([518e3e6](https://www.github.com/JGodin-C2C/devops-stack/commit/518e3e6885082429298607314215e15fcacb0d07)) +* **sks:** add output for cluster security group id ([#816](https://www.github.com/JGodin-C2C/devops-stack/issues/816)) ([108dcb2](https://www.github.com/JGodin-C2C/devops-stack/commit/108dcb28ded4beb1ac76657b832b0fe8f3cbf832)) +* **traefik:** tls version >= 1.2 ([#793](https://www.github.com/JGodin-C2C/devops-stack/issues/793)) ([c49580e](https://www.github.com/JGodin-C2C/devops-stack/commit/c49580efa834d1a5001abb18f0d9cf120970efc3)) +* **velero,k3s:** Add velero deployment for k3s ([3fea84d](https://www.github.com/JGodin-C2C/devops-stack/commit/3fea84d51e3e9598251b03ff633419d3b61fbf0f)) +* **velero:** Add azure configuration for velero ([e4a9aa4](https://www.github.com/JGodin-C2C/devops-stack/commit/e4a9aa41460408ccb1f9059c5623df3854c64e55)) +* **velero:** move velero variable to top ([d30dda7](https://www.github.com/JGodin-C2C/devops-stack/commit/d30dda70430aed8424b7236e4af7a3beff2d715f)) + + +### Bug Fixes + +* **argocd:** fix kube-prometheus-stack dependency on OIDC ([#795](https://www.github.com/JGodin-C2C/devops-stack/issues/795)) ([5848af8](https://www.github.com/JGodin-C2C/devops-stack/commit/5848af8970a8c273b8243fae3f5dd98167af17d2)) +* **eks:** keycloak admin pass output when not installed ([#817](https://www.github.com/JGodin-C2C/devops-stack/issues/817)) ([96cd02c](https://www.github.com/JGodin-C2C/devops-stack/commit/96cd02cc9f1cd68bb39cfbf8c0cd6a93b85d6e90)) +* **eks:** send http traffic on NLB to port 80 on cluster ([#810](https://www.github.com/JGodin-C2C/devops-stack/issues/810)) ([0cbd0eb](https://www.github.com/JGodin-C2C/devops-stack/commit/0cbd0eb05fcb818a623fa70489ad6b5f9302198b)) + +## [0.49.0](https://www.github.com/camptocamp/devops-stack/compare/v0.48.0...v0.49.0) (2021-11-19) + + +### ⚠ BREAKING CHANGES + +* **eks:** send http traffic on NLB to port 80 on cluster (#810) + +### Features + +* **keycloak:** pass a user list to keycloak ([#788](https://www.github.com/camptocamp/devops-stack/issues/788)) ([c2835ec](https://www.github.com/camptocamp/devops-stack/commit/c2835ecaba5ffb02908fa77049cffecb976787e3)) +* **kind:** add experimental support for KIND ([#785](https://www.github.com/camptocamp/devops-stack/issues/785)) ([518e3e6](https://www.github.com/camptocamp/devops-stack/commit/518e3e6885082429298607314215e15fcacb0d07)) +* **sks:** add output for cluster security group id ([#816](https://www.github.com/camptocamp/devops-stack/issues/816)) ([de31691](https://www.github.com/camptocamp/devops-stack/commit/de31691b49cdafd7236d8a0395d2af2b8bc30d23)) +* **traefik:** tls version >= 1.2 ([#793](https://www.github.com/camptocamp/devops-stack/issues/793)) ([c49580e](https://www.github.com/camptocamp/devops-stack/commit/c49580efa834d1a5001abb18f0d9cf120970efc3)) + + +### Bug Fixes + +* **argocd:** fix kube-prometheus-stack dependency on OIDC ([#795](https://www.github.com/camptocamp/devops-stack/issues/795)) ([5848af8](https://www.github.com/camptocamp/devops-stack/commit/5848af8970a8c273b8243fae3f5dd98167af17d2)) +* **eks:** keycloak admin pass output when not installed ([#817](https://www.github.com/camptocamp/devops-stack/issues/817)) ([980979b](https://www.github.com/camptocamp/devops-stack/commit/980979b1f4ab443a6689f6fbce8845b24bebd70f)) +* **eks:** send http traffic on NLB to port 80 on cluster ([#810](https://www.github.com/camptocamp/devops-stack/issues/810)) ([0cbd0eb](https://www.github.com/camptocamp/devops-stack/commit/0cbd0eb05fcb818a623fa70489ad6b5f9302198b)) + ## [0.48.0](https://www.github.com/camptocamp/devops-stack/compare/v0.47.0...v0.48.0) (2021-09-22) diff --git a/Makefile b/Makefile index 8c56800be0..5e0b8ce679 100644 --- a/Makefile +++ b/Makefile @@ -1,4 +1,4 @@ -MODULES = argocd-helm aks/azure eks/aws openshift4/aws k3s/docker k3s/libvirt sks/exoscale +MODULES = argocd-helm aks/azure eks/aws openshift4/aws k3s/docker k3s/libvirt sks/exoscale kind/kind MOD_REFS = $(addsuffix .adoc,$(addprefix docs/modules/ROOT/pages/references/terraform_modules/,$(MODULES))) APPLICATIONS = $(shell ls -d argocd/*/ | cut -f2 -d'/') diff --git a/argocd/apps/templates/velero.yaml b/argocd/apps/templates/velero.yaml new file mode 100644 index 0000000000..7c7ffb4087 --- /dev/null +++ b/argocd/apps/templates/velero.yaml @@ -0,0 +1,25 @@ +{{- if index $.Values "apps" "velero" "enabled" }} +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: velero + namespace: argocd +spec: + project: "devops-stack" + source: + path: argocd/velero + repoURL: {{ .Values.spec.source.repoURL }} + targetRevision: {{ .Values.spec.source.targetRevision }} + helm: + values: | + velero: + {{- index .Values "velero" | toYaml | nindent 10 }} + destination: + namespace: velero + server: {{ .Values.spec.destination.server }} + {{- if .Values.spec.syncPolicy }} + syncPolicy: + {{ toYaml .Values.spec.syncPolicy | nindent 4 }} + {{- end }} +{{- end }} diff --git a/argocd/argocd/Chart.yaml b/argocd/argocd/Chart.yaml index 6cc4cb8c5f..f308930682 100644 --- a/argocd/argocd/Chart.yaml +++ b/argocd/argocd/Chart.yaml @@ -12,7 +12,7 @@ description: | * ArgoCD Notifications dependencies: - name: "argo-cd" - version: "3.17.3" + version: "3.26.9" repository: "https://argoproj.github.io/argo-helm" - name: "argocd-applicationset" version: "1.3.1" diff --git a/argocd/velero/Chart.yaml b/argocd/velero/Chart.yaml new file mode 100644 index 0000000000..3821d98e97 --- /dev/null +++ b/argocd/velero/Chart.yaml @@ -0,0 +1,11 @@ +--- +apiVersion: "v2" +name: "velero" +version: "0" +description: | + This chart installs velero. + Velero is an open source tool to safely backup and restore, perform disaster recovery, and migrate Kubernetes cluster resources and persistent volumes. +dependencies: + - name: "velero" + version: "2.23.6" + repository: "https://vmware-tanzu.github.io/helm-charts/" diff --git a/argocd/velero/values.yaml b/argocd/velero/values.yaml new file mode 100644 index 0000000000..ed97d539c0 --- /dev/null +++ b/argocd/velero/values.yaml @@ -0,0 +1 @@ +--- diff --git a/docs/modules/ROOT/nav.adoc b/docs/modules/ROOT/nav.adoc index 3da01f6491..e17ab7efda 100644 --- a/docs/modules/ROOT/nav.adoc +++ b/docs/modules/ROOT/nav.adoc @@ -9,6 +9,7 @@ *** xref:ROOT:howtos/quickstart_ocp_ipi_aws.adoc[OpenShift (IPI) on AWS] *** xref:ROOT:howtos/quickstart_k3s_docker.adoc[K3s on Docker] *** xref:ROOT:howtos/quickstart_k3s_libvirt.adoc[K3s on Libvirt] +*** xref:ROOT:howtos/quickstart_kind.adoc[KinD] ** Pipelines *** xref:ROOT:howtos/pipelines.adoc[Deploying with Pipelines] *** xref:ROOT:howtos/pipelines_gitlab.adoc[Create your GitLab Pipeline] diff --git a/docs/modules/ROOT/pages/explanations/data_persistence.adoc b/docs/modules/ROOT/pages/explanations/data_persistence.adoc index 462949db6e..0f0a9c9fb6 100644 --- a/docs/modules/ROOT/pages/explanations/data_persistence.adoc +++ b/docs/modules/ROOT/pages/explanations/data_persistence.adoc @@ -10,7 +10,29 @@ In order to achieve this, clusters need to be totally stateless and achieve data persistence outside of the cluster (using external RDBMS, NoSQL databases, or object storage). -We thus recommend to avoid the use of storageClasses, -which allow self provisioning of Persistent Volumes (PVs), as it breaks -the blue/green infrastructure paradigm that the DevOps Stack supports. += synchronizing +In order to keep the cluster stateless, we use a tool to synchronize +both blue and green. + +This tool is velero. Started as a backup tool, cluster sync as been added as +a use case. + +== Velero + +To begin using velero, you will need to settup a blob storage/S3 storage in your +terraform code. + +You can then pass this structure to the devops stack to have it setted up: +For k3s , configuration is automatic and the backups are stored in the deployed +minio. + +For Azure : +``` + velero = { + storage = [storage_name] + container = [containeri(Blob storage) name] + resource_group = [resource group] + } + +``` diff --git a/docs/modules/ROOT/pages/howtos/quickstart_kind.adoc b/docs/modules/ROOT/pages/howtos/quickstart_kind.adoc new file mode 100644 index 0000000000..f5b513b411 --- /dev/null +++ b/docs/modules/ROOT/pages/howtos/quickstart_kind.adoc @@ -0,0 +1,38 @@ += Kind Quickstart + +== Prerequisites + +- Access to a functional Docker Engine, +- Knowledge of https://terraform.io[Terraform] basics +- Minimal Terraform version: 0.14 +- `jq` binary +- https://argoproj.github.io/argo-cd/cli_installation/[argocd] CLI + + +include::partial$terraform_instant_intro.adoc[] + +```hcl +# terraform/main.tf + +module "cluster" { + source = "git::https://github.com/camptocamp/devops-stack.git//modules/kind/kind?ref=master" + + cluster_name = "my-cluster" +} +``` + +If your docker setup doesn't support the bridge0 like on MacOSX, you cannot access to the container IP so the computed base domain isn't reachable. + + +include::partial$tf_apply.adoc[] + +include::partial$wait_for_keycloak.adoc[] + +include::partial$access_keycloak.adoc[] + +include::partial$tf_destroy.adoc[] + + +== Reference + +See the xref:ROOT:references/terraform_modules/kind/kind.adoc[Kind reference page]. diff --git a/docs/modules/ROOT/pages/references/applications/argocd.adoc b/docs/modules/ROOT/pages/references/applications/argocd.adoc index 847563d7a3..d50b4ed34b 100644 --- a/docs/modules/ROOT/pages/references/applications/argocd.adoc +++ b/docs/modules/ROOT/pages/references/applications/argocd.adoc @@ -14,7 +14,7 @@ enabled [cols=",,",options="header",] |=== |Repository |Name |Version -|https://argoproj.github.io/argo-helm |argo-cd |3.17.3 +|https://argoproj.github.io/argo-helm |argo-cd |3.26.9 |https://argoproj.github.io/argo-helm |argocd-applicationset |1.3.1 |https://argoproj.github.io/argo-helm |argocd-notifications |1.4.4 |=== diff --git a/docs/modules/ROOT/pages/references/applications/traefik.adoc b/docs/modules/ROOT/pages/references/applications/traefik.adoc index 4f2814cfef..96a5960315 100644 --- a/docs/modules/ROOT/pages/references/applications/traefik.adoc +++ b/docs/modules/ROOT/pages/references/applications/traefik.adoc @@ -17,6 +17,6 @@ cluster Ingress Controller. |=== |Key |Type |Default |Description |traefik |object -|`{"additionalArguments":["--metrics.prometheus=true","--serversTransport.insecureSkipVerify=true"],"deployment":{"replicas":2},"logs":{"access":{"enabled":true}}}` +|`{"additionalArguments":["--metrics.prometheus=true","--serversTransport.insecureSkipVerify=true"],"deployment":{"replicas":2},"logs":{"access":{"enabled":true}},"tlsOptions":{"default":{"minVersion":"VersionTLS12"}}}` |Values passed to the traefik chart |=== diff --git a/docs/modules/ROOT/pages/references/applications/velero.adoc b/docs/modules/ROOT/pages/references/applications/velero.adoc new file mode 100644 index 0000000000..e69de29bb2 diff --git a/docs/modules/ROOT/pages/references/terraform_modules/aks/azure.adoc b/docs/modules/ROOT/pages/references/terraform_modules/aks/azure.adoc index fff686cc35..6774a1ed03 100644 --- a/docs/modules/ROOT/pages/references/terraform_modules/aks/azure.adoc +++ b/docs/modules/ROOT/pages/references/terraform_modules/aks/azure.adoc @@ -11,7 +11,7 @@ The `aks/azure` Terraform module provides a way to install and configure: |=== |Name |Version |[[requirement_terraform]] <> |>= 0.13 -|[[requirement_azuread]] <> |~> 1.5 +|[[requirement_azuread]] <> |~> 2.0 |[[requirement_azurerm]] <> |~> 2.62 |[[requirement_helm]] <> |~> 2.0 |[[requirement_kubernetes]] <> |~> 2.0 @@ -25,7 +25,7 @@ The `aks/azure` Terraform module provides a way to install and configure: [cols="a,a",options="header,autowidth"] |=== |Name |Version -|[[provider_azuread]] <> |~> 1.5 +|[[provider_azuread]] <> |~> 2.0 |[[provider_azurerm]] <> |~> 2.62 |[[provider_random]] <> |~> 3.0 |=== @@ -45,7 +45,6 @@ The `aks/azure` Terraform module provides a way to install and configure: |=== |Name |Type |https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application[azuread_application.oauth2_apps] |resource -|https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_app_role[azuread_application_app_role.argocd_admin] |resource |https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_password[azuread_application_password.oauth2_apps] |resource |https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/dns_cname_record[azurerm_dns_cname_record.wildcard] |resource |https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster_node_pool[azurerm_kubernetes_cluster_node_pool.this] |resource @@ -60,8 +59,9 @@ The `aks/azure` Terraform module provides a way to install and configure: |https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/user_assigned_identity[azurerm_user_assigned_identity.kube_prometheus_stack_prometheus] |resource |https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/user_assigned_identity[azurerm_user_assigned_identity.this] |resource |https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password[random_password.grafana_admin_password] |resource -|https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password[random_password.oauth2_apps] |resource |https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string[random_string.storage_account] |resource +|https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/uuid[random_uuid.argocd_app_role] |resource +|https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/uuid[random_uuid.resource_app_id] |resource |https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/client_config[azurerm_client_config.current] |data source |https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/dns_zone[azurerm_dns_zone.this] |data source |https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/kubernetes_cluster[azurerm_kubernetes_cluster.cluster] |data source @@ -139,6 +139,12 @@ list(object({ |n/a |yes +|[[input_enable_velero]] <> +|Flag to enable velero +|`bool` +|`false` +|no + |[[input_extra_app_projects]] <> |Extra AppProjects objects to deploy. |`list(any)` @@ -166,7 +172,7 @@ list(object({ |[[input_kubernetes_version]] <> |Specify which Kubernetes release to use. |`string` -|`"1.20.7"` +|`"1.21.2"` |no |[[input_network_policy]] <> @@ -237,6 +243,22 @@ object({ |`"master"` |no +|[[input_velero]] <> +|Storage account used to configure backup and clusters synchronisation. More info here : http:// +| + +[source] +---- +object({ + storage = string + container = string + resource_group = string + }) +---- + +|n/a +|yes + |[[input_vnet_subnet_id]] <> |The ID of a Subnet where the Kubernetes Node Pool should exist. Changing this forces a new resource to be created. |`string` diff --git a/docs/modules/ROOT/pages/references/terraform_modules/argocd-helm.adoc b/docs/modules/ROOT/pages/references/terraform_modules/argocd-helm.adoc index 9216f05dea..284005ff78 100644 --- a/docs/modules/ROOT/pages/references/terraform_modules/argocd-helm.adoc +++ b/docs/modules/ROOT/pages/references/terraform_modules/argocd-helm.adoc @@ -216,6 +216,12 @@ No modules. |`{}` |no +|[[input_velero]] <> +|Velero settings +|`any` +|`{}` +|no + |[[input_wait_for_app_of_apps]] <> |Allow to disable wait for app of apps |`bool` diff --git a/docs/modules/ROOT/pages/references/terraform_modules/eks/aws.adoc b/docs/modules/ROOT/pages/references/terraform_modules/eks/aws.adoc index 0630f148c8..3293595a47 100644 --- a/docs/modules/ROOT/pages/references/terraform_modules/eks/aws.adoc +++ b/docs/modules/ROOT/pages/references/terraform_modules/eks/aws.adoc @@ -117,7 +117,7 @@ The `eks/aws` Terraform module provides a way to install and configure: |[[input_cluster_version]] <> |Kubernetes version to use for the EKS cluster. |`string` -|`"1.18"` +|`"1.21"` |no |[[input_cognito_user_pool_domain]] <> @@ -156,6 +156,12 @@ The `eks/aws` Terraform module provides a way to install and configure: |`false` |no +|[[input_enable_velero]] <> +|Flag to enable velero +|`bool` +|`false` +|no + |[[input_extra_app_projects]] <> |Extra AppProjects objects to deploy. |`list(any)` diff --git a/docs/modules/ROOT/pages/references/terraform_modules/k3s/docker.adoc b/docs/modules/ROOT/pages/references/terraform_modules/k3s/docker.adoc index 6ac57a5f89..993cbc057f 100644 --- a/docs/modules/ROOT/pages/references/terraform_modules/k3s/docker.adoc +++ b/docs/modules/ROOT/pages/references/terraform_modules/k3s/docker.adoc @@ -95,6 +95,12 @@ The `k3s/docker` Terraform module provides a way to install and configure: |`true` |no +|[[input_enable_velero]] <> +|Flag to enable velero +|`bool` +|`false` +|no + |[[input_extra_app_projects]] <> |Extra AppProjects objects to deploy. |`list(any)` @@ -122,7 +128,7 @@ The `k3s/docker` Terraform module provides a way to install and configure: |[[input_k3s_version]] <> |The K3s version to use |`string` -|`"v1.20.10-k3s1"` +|`"v1.21.6-k3s1"` |no |[[input_keycloak_users]] <> @@ -248,6 +254,7 @@ map(object({ |[[output_keycloak_admin_password]] <> |The password of Keycloak's admin user. |[[output_keycloak_users]] <> |n/a |[[output_kubeconfig]] <> |The content of the KUBECONFIG file. +|[[output_minio_keys]] <> |The minio key pair |[[output_repo_url]] <> |n/a |[[output_target_revision]] <> |n/a |=== diff --git a/docs/modules/ROOT/pages/references/terraform_modules/k3s/libvirt.adoc b/docs/modules/ROOT/pages/references/terraform_modules/k3s/libvirt.adoc index 7740cdb0c7..d8396f0f7b 100644 --- a/docs/modules/ROOT/pages/references/terraform_modules/k3s/libvirt.adoc +++ b/docs/modules/ROOT/pages/references/terraform_modules/k3s/libvirt.adoc @@ -95,6 +95,12 @@ The `k3s/libvirt` Terraform module provides a way to install and configure: |`true` |no +|[[input_enable_velero]] <> +|Flag to enable velero +|`bool` +|`false` +|no + |[[input_extra_app_projects]] <> |Extra AppProjects objects to deploy. |`list(any)` @@ -215,6 +221,7 @@ object({ |[[output_keycloak_admin_password]] <> |The password of Keycloak's admin user. |[[output_keycloak_users]] <> |n/a |[[output_kubeconfig]] <> |The content of the KUBECONFIG file. +|[[output_minio_keys]] <> |The minio key pair |[[output_repo_url]] <> |n/a |[[output_target_revision]] <> |n/a |=== diff --git a/docs/modules/ROOT/pages/references/terraform_modules/kind/kind.adoc b/docs/modules/ROOT/pages/references/terraform_modules/kind/kind.adoc new file mode 100644 index 0000000000..97e0d571b1 --- /dev/null +++ b/docs/modules/ROOT/pages/references/terraform_modules/kind/kind.adoc @@ -0,0 +1,175 @@ += KinD Terraform Module + +The `kind/kind` Terraform module provides a way to install and configure: + +* A KinD cluster based on Docker +* The xref:ROOT:references/terraform_modules/argocd-helm.adoc[ArgoCD Helm] module + +== Requirements + +[cols="a,a",options="header,autowidth"] +|=== +|Name |Version +|[[requirement_docker]] <> |~> 2.15.0 +|[[requirement_kind]] <> |~> 0.0.9 +|=== + +== Providers + +[cols="a,a",options="header,autowidth"] +|=== +|Name |Version +|[[provider_docker]] <> |~> 2.15.0 +|[[provider_kind]] <> |0.0.9 +|[[provider_kubernetes]] <> |2.5.0 +|[[provider_random]] <> |3.1.0 +|[[provider_tls]] <> |3.1.0 +|=== + +== Modules + +[cols="a,a,a",options="header,autowidth"] +|=== +|Name |Source |Version +|[[module_argocd]] <> |../../argocd-helm | +|=== + +== Resources + +[cols="a,a",options="header,autowidth"] +|=== +|Name |Type +|https://registry.terraform.io/providers/kyma-incubator/kind/latest/docs/resources/cluster[kind_cluster.cluster] |resource +|https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password[random_password.clientsecret] |resource +|https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password[random_password.grafana_admin_password] |resource +|https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password[random_password.jdoe_password] |resource +|https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password[random_password.minio_accesskey] |resource +|https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password[random_password.minio_secretkey] |resource +|https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key[tls_private_key.root] |resource +|https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/self_signed_cert[tls_self_signed_cert.root] |resource +|https://registry.terraform.io/providers/kreuzwerker/docker/latest/docs/data-sources/network[docker_network.kind] |data source +|https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/data-sources/secret[kubernetes_secret.keycloak_admin_password] |data source +|=== + +== Inputs + +[cols="a,a,a,a,a",options="header,autowidth"] +|=== +|Name |Description |Type |Default |Required +|[[input_app_of_apps_values_overrides]] <> +|App of apps values overrides. +|`string` +|`""` +|no + +|[[input_argocd_server_secretkey]] <> +|ArgoCD Server Secert Key to avoid regenerate token on redeploy. +|`string` +|`null` +|no + +|[[input_base_domain]] <> +|The base domain used for Ingresses. +|`string` +|`null` +|no + +|[[input_cluster_name]] <> +|The name of the Kubernetes cluster to create. +|`string` +|n/a +|yes + +|[[input_enable_minio]] <> +|Whether to enable minio object storage system +|`bool` +|`true` +|no + +|[[input_extra_app_projects]] <> +|Extra AppProjects objects to deploy. +|`list(any)` +|`[]` +|no + +|[[input_extra_application_sets]] <> +|Extra ApplicationSets objects to deploy. +|`list(any)` +|`[]` +|no + +|[[input_extra_apps]] <> +|Extra Applications objects to deploy. +|`list(any)` +|`[]` +|no + +|[[input_grafana_admin_password]] <> +|The admin password for Grafana. +|`string` +|`null` +|no + +|[[input_oidc]] <> +|OIDC configuration for core applications. +| + +[source] +---- +object({ + issuer_url = string + oauth_url = string + token_url = string + api_url = string + client_id = string + client_secret = string + oauth2_proxy_extra_args = list(string) + }) +---- + +|`null` +|no + +|[[input_repo_url]] <> +|The source repo URL of ArgoCD's app of apps. +|`string` +|`"https://github.com/camptocamp/devops-stack.git"` +|no + +|[[input_repositories]] <> +|A list of repositories to add to ArgoCD. +|`map(map(string))` +|`{}` +|no + +|[[input_target_revision]] <> +|The source target revision of ArgoCD's app of apps. +|`string` +|`"master"` +|no + +|[[input_wait_for_app_of_apps]] <> +|Allow to disable wait for app of apps +|`bool` +|`true` +|no + +|=== + +== Outputs + +[cols="a,a",options="header,autowidth"] +|=== +|Name |Description +|[[output_app_of_apps_values]] <> |App of Apps values +|[[output_argocd_auth_token]] <> |The token to set in ARGOCD_AUTH_TOKEN environment variable. +|[[output_argocd_server]] <> |The URL of the ArgoCD server. +|[[output_argocd_server_admin_password]] <> |The ArgoCD admin password. +|[[output_base_domain]] <> |n/a +|[[output_grafana_admin_password]] <> |The admin password for Grafana. +|[[output_jdoe_password]] <> |The password of a regular user jdoe. +|[[output_keycloak_admin_password]] <> |The password of Keycloak's admin user. +|[[output_kubeconfig]] <> |The content of the KUBECONFIG file. +|[[output_repo_url]] <> |n/a +|[[output_target_revision]] <> |n/a +|=== diff --git a/docs/modules/ROOT/pages/references/terraform_modules/openshift4/aws.adoc b/docs/modules/ROOT/pages/references/terraform_modules/openshift4/aws.adoc index 15e03a4afb..e54866baf3 100644 --- a/docs/modules/ROOT/pages/references/terraform_modules/openshift4/aws.adoc +++ b/docs/modules/ROOT/pages/references/terraform_modules/openshift4/aws.adoc @@ -64,6 +64,12 @@ No requirements. |n/a |yes +|[[input_enable_velero]] <> +|Flag to enable velero +|`bool` +|`false` +|no + |[[input_extra_app_projects]] <> |Extra AppProjects objects to deploy. |`list(any)` diff --git a/docs/modules/ROOT/pages/references/terraform_modules/sks/exoscale.adoc b/docs/modules/ROOT/pages/references/terraform_modules/sks/exoscale.adoc index 49280c7460..3feab6b744 100644 --- a/docs/modules/ROOT/pages/references/terraform_modules/sks/exoscale.adoc +++ b/docs/modules/ROOT/pages/references/terraform_modules/sks/exoscale.adoc @@ -83,6 +83,12 @@ The `sks/exoscale` Terraform module provides a way to install and configure: |n/a |yes +|[[input_enable_velero]] <> +|Flag to enable velero +|`bool` +|`false` +|no + |[[input_extra_app_projects]] <> |Extra AppProjects objects to deploy. |`list(any)` @@ -116,7 +122,7 @@ The `sks/exoscale` Terraform module provides a way to install and configure: |[[input_kubernetes_version]] <> |Specify which Kubernetes release to use. |`string` -|`"1.21.4"` +|`"1.21.6"` |no |[[input_nodepools]] <> @@ -193,6 +199,7 @@ object({ |[[output_argocd_server]] <> |The URL of the ArgoCD server. |[[output_argocd_server_admin_password]] <> |The ArgoCD admin password. |[[output_base_domain]] <> |n/a +|[[output_cluster_security_group_id]] <> |Security group ID attached to the SKS nodepool instances. |[[output_grafana_admin_password]] <> |The admin password for Grafana. |[[output_keycloak_admin_password]] <> |The password of Keycloak's admin user. |[[output_keycloak_users]] <> |n/a diff --git a/modules/aks/azure/main.tf b/modules/aks/azure/main.tf index 77c033e201..24a5552cbe 100644 --- a/modules/aks/azure/main.tf +++ b/modules/aks/azure/main.tf @@ -129,6 +129,10 @@ module "argocd" { oauth2_proxy_extra_args = [] } + velero = { + enable = var.enable_velero + } + grafana = { admin_password = local.grafana_admin_password } @@ -150,6 +154,7 @@ module "argocd" { loki_account_name = azurerm_storage_account.this.name loki_account_key = azurerm_storage_account.this.primary_access_key azureidentities = local.azureidentities + velero = var.velero } ), var.app_of_apps_values_overrides, diff --git a/modules/aks/azure/values.tmpl.yaml b/modules/aks/azure/values.tmpl.yaml index 0ea66c1393..f0f8719276 100644 --- a/modules/aks/azure/values.tmpl.yaml +++ b/modules/aks/azure/values.tmpl.yaml @@ -229,3 +229,19 @@ traefik: service: annotations: service.beta.kubernetes.io/azure-dns-label-name: ${azure_dns_label_name} +velero: + initContainers: + - name: velero-plugin-for-microsoft-azure + image: velero/velero-plugin-for-microsoft-azure:v1.3.0 + imagePullPolicy: IfNotPresent + volumeMounts: + - mountPath: /target + name: plugins + configuration: + provider: azure + bucket: "${velero["container"]}" + config: + subscriptionId: ${subscription_id} + storageAccount: "${velero["storage"]}" + resourceGroup: "${velero["resource_group"]}" + diff --git a/modules/aks/azure/variables.tf b/modules/aks/azure/variables.tf index 4bf49b044c..a05ba1abb2 100644 --- a/modules/aks/azure/variables.tf +++ b/modules/aks/azure/variables.tf @@ -6,7 +6,7 @@ variable "base_domain" { variable "kubernetes_version" { description = "Specify which Kubernetes release to use." type = string - default = "1.20.7" + default = "1.21.2" } variable "resource_group_name" { diff --git a/modules/argocd-helm/local.tf b/modules/argocd-helm/local.tf index 07652c9222..dc44dd0846 100644 --- a/modules/argocd-helm/local.tf +++ b/modules/argocd-helm/local.tf @@ -92,6 +92,15 @@ locals { local.minio_defaults, var.minio, ) + + velero_defaults = { + enable = false + } + velero = merge( + local.velero_defaults, + var.velero, + ) + metrics_archives_defaults = { bucket_name = "thanos" query_domain = "thanos-query.${var.cluster_name}.${var.base_domain}" diff --git a/modules/argocd-helm/main.tf b/modules/argocd-helm/main.tf index fd7c1d3443..76f2c7d2be 100644 --- a/modules/argocd-helm/main.tf +++ b/modules/argocd-helm/main.tf @@ -42,6 +42,7 @@ locals { grafana = local.grafana prometheus = local.prometheus alertmanager = local.alertmanager + velero = local.velero metrics_server = local.metrics_server metrics_archives = local.metrics_archives cert_manager = local.cert_manager diff --git a/modules/argocd-helm/variables.tf b/modules/argocd-helm/variables.tf index d234955f15..915a4b0bd9 100644 --- a/modules/argocd-helm/variables.tf +++ b/modules/argocd-helm/variables.tf @@ -88,6 +88,12 @@ variable "loki" { default = {} } +variable "velero" { + description = "Velero settings" + type = any + default = {} +} + variable "traefik" { description = "Trafik settings" type = any diff --git a/modules/eks/aws/main.tf b/modules/eks/aws/main.tf index 509094a205..ddd23cdaea 100644 --- a/modules/eks/aws/main.tf +++ b/modules/eks/aws/main.tf @@ -120,6 +120,10 @@ module "argocd" { bucket_name = aws_s3_bucket.loki.id, } + velero = { + enable = var.enable_velero + } + grafana = { admin_password = local.grafana_admin_password } diff --git a/modules/eks/aws/variables.tf b/modules/eks/aws/variables.tf index ef95919266..012c883814 100644 --- a/modules/eks/aws/variables.tf +++ b/modules/eks/aws/variables.tf @@ -1,7 +1,7 @@ variable "cluster_version" { description = "Kubernetes version to use for the EKS cluster." type = string - default = "1.18" + default = "1.21" } variable "base_domain" { diff --git a/modules/k3s/docker/variables.tf b/modules/k3s/docker/variables.tf index 4bcc4aceb4..7a4ac7b8fc 100644 --- a/modules/k3s/docker/variables.tf +++ b/modules/k3s/docker/variables.tf @@ -1,7 +1,7 @@ variable "k3s_version" { description = "The K3s version to use" type = string - default = "v1.20.10-k3s1" + default = "v1.21.6-k3s1" } variable "server_ports" { diff --git a/modules/k3s/main.tf b/modules/k3s/main.tf index ce874c3b11..b3297ccefc 100644 --- a/modules/k3s/main.tf +++ b/modules/k3s/main.tf @@ -63,6 +63,10 @@ module "argocd" { secret_key = local.minio.secret_key } + velero = { + enable = var.enable_velero + } + keycloak = { enable = var.oidc == null ? true : false user_map = local.keycloak_user_map diff --git a/modules/k3s/outputs.tf b/modules/k3s/outputs.tf index c865a34441..5a4a9db8fb 100644 --- a/modules/k3s/outputs.tf +++ b/modules/k3s/outputs.tf @@ -12,3 +12,9 @@ output "keycloak_admin_password" { value = data.kubernetes_secret.keycloak_admin_password.data.ADMIN_PASSWORD sensitive = true } + +output "minio_keys" { + description = "The minio key pair" + value = local.minio + sensitive = true +} diff --git a/modules/k3s/values.tmpl.yaml b/modules/k3s/values.tmpl.yaml index 32b5935a8b..9ced06a458 100644 --- a/modules/k3s/values.tmpl.yaml +++ b/modules/k3s/values.tmpl.yaml @@ -58,3 +58,30 @@ loki-stack: cert-manager: tlsCrt: ${root_cert} tlsKey: ${root_key} + +velero: + initContainers: + - name: velero-plugin-for-aws + image: velero/velero-plugin-for-aws:v1.1.0 + imagePullPolicy: IfNotPresent + volumeMounts: + - mountPath: /target + name: plugins + configuration: + provider: aws + backupStorageLocation: + caCert: ${root_cert} + bucket: velero + config: + region: minio + s3ForcePathStyle: true + publicUrl: https://minio.apps.${cluster_name}.${base_domain} + s3Url: http://minio.minio.svc.cluster.local:9000 + credentials: + useSecret: true + secretContents: + cloud: | + [default] + aws_access_key_id = ${minio_access_key} + aws_secret_access_key = ${minio_secret_key} + snapshotsEnabled: false diff --git a/modules/kind/kind/README.adoc b/modules/kind/kind/README.adoc new file mode 100644 index 0000000000..00fd3ea642 --- /dev/null +++ b/modules/kind/kind/README.adoc @@ -0,0 +1,8 @@ += KinD Terraform Module + +The `kind/kind` Terraform module provides a way to install and configure: + +* A KinD cluster based on Docker +* The xref:ROOT:references/terraform_modules/argocd-helm.adoc[ArgoCD Helm] module + + diff --git a/modules/sks/exoscale/main.tf b/modules/sks/exoscale/main.tf index 7622a90d1e..6d03b5c1d1 100644 --- a/modules/sks/exoscale/main.tf +++ b/modules/sks/exoscale/main.tf @@ -18,10 +18,10 @@ locals { }, } - router_nodepool = coalesce(var.router_nodepool, "router-${var.cluster_name}") - nodepools = coalesce(var.nodepools, local.default_nodepools) - cluster_issuer = (length(local.nodepools) > 1) ? "letsencrypt-prod" : "ca-issuer" - keycloak_user_map = { for username, infos in var.keycloak_users : username => merge(infos, tomap({password = random_password.keycloak_passwords[username].result})) } + router_nodepool = coalesce(var.router_nodepool, "router-${var.cluster_name}") + nodepools = coalesce(var.nodepools, local.default_nodepools) + cluster_issuer = (length(local.nodepools) > 1) ? "letsencrypt-prod" : "ca-issuer" + keycloak_user_map = { for username, infos in var.keycloak_users : username => merge(infos, tomap({ password = random_password.keycloak_passwords[username].result })) } } provider "helm" { @@ -147,12 +147,16 @@ module "argocd" { oauth2_proxy_extra_args = [] } + velero = { + enable = var.enable_velero + } + grafana = { admin_password = local.grafana_admin_password } keycloak = { - enable = true + enable = true user_map = local.keycloak_user_map } diff --git a/modules/sks/exoscale/outputs.tf b/modules/sks/exoscale/outputs.tf index 8fb37090a5..8e79fd0aa0 100644 --- a/modules/sks/exoscale/outputs.tf +++ b/modules/sks/exoscale/outputs.tf @@ -9,10 +9,15 @@ output "keycloak_users" { output "keycloak_admin_password" { description = "The password of Keycloak's admin user." - value = data.kubernetes_secret.keycloak_admin_password.data.ADMIN_PASSWORD + value = data.kubernetes_secret.keycloak_admin_password.data != null ? data.kubernetes_secret.keycloak_admin_password.data.ADMIN_PASSWORD : null sensitive = true } output "nlb_ip_address" { value = exoscale_nlb.this.ip_address } + +output "cluster_security_group_id" { + description = "Security group ID attached to the SKS nodepool instances." + value = module.cluster.this_security_group_id +} diff --git a/modules/sks/exoscale/variables.tf b/modules/sks/exoscale/variables.tf index 19dedd97bb..997eed7665 100644 --- a/modules/sks/exoscale/variables.tf +++ b/modules/sks/exoscale/variables.tf @@ -7,7 +7,7 @@ variable "base_domain" { variable "kubernetes_version" { description = "Specify which Kubernetes release to use." type = string - default = "1.21.4" + default = "1.21.6" } variable "zone" { diff --git a/modules/values.tmpl.yaml b/modules/values.tmpl.yaml index 2648d963ec..8321f0150e 100644 --- a/modules/values.tmpl.yaml +++ b/modules/values.tmpl.yaml @@ -49,6 +49,8 @@ apps: enabled: ${ can(metrics_archives.bucket_config) ? true : false } cluster-autoscaler: enabled: ${cluster_autoscaler.enable} + velero: + enabled: ${velero.enable} ${yamlencode({"extraApps": extra_apps})} ${yamlencode({"extraAppProjects": extra_app_projects})} @@ -460,6 +462,11 @@ minio: - name: "${metrics_archives.bucket_name}" policy: none purge: false +%{ if velero.enable } + - name: velero + policy: none + purge: false +%{ endif } %{ endif } secrets-store-csi-driver: {} @@ -526,3 +533,5 @@ thanos: %{ if cluster_autoscaler.enable } cluster-autoscaler: {} %{ endif } + +velero: {} diff --git a/modules/variables.tf b/modules/variables.tf index 73e21e7d37..83184f4fb7 100644 --- a/modules/variables.tf +++ b/modules/variables.tf @@ -65,6 +65,12 @@ variable "grafana_admin_password" { default = null } +variable "enable_velero" { + description = "Flag to enable velero" + type = bool + default = false +} + variable "repositories" { description = "A list of repositories to add to ArgoCD." type = map(map(string)) @@ -76,3 +82,9 @@ variable "wait_for_app_of_apps" { type = bool default = true } + +variable "velero" { + description = "Storage account used to configure backup and clusters synchronisation. More info here : http://" + default = default() +} + diff --git a/site/config.toml b/site/config.toml index 5f89f711d1..2463ee2616 100644 --- a/site/config.toml +++ b/site/config.toml @@ -15,7 +15,7 @@ org_logo = "images/logo/camptocamp.png" org_logo_width = "200px" org_url = "https://camptocamp.com" -version = "0.48.0" +version = "0.49.0" google_analytics = "G-GDBX9466LL" diff --git a/site/data/en/homepage.yml b/site/data/en/homepage.yml index 1f98128da9..f09fa1eac9 100644 --- a/site/data/en/homepage.yml +++ b/site/data/en/homepage.yml @@ -31,6 +31,9 @@ banner: - label: "K3S Quickstart" icon: "fa fa-hat-cowboy-side" link: "/docs/devops-stack/__VERSION__/howtos/quickstart_k3s_docker.html" + - label: "Kind Quickstart" + icon: "fa fa-wine-bottle" + link: "/docs/devops-stack/__VERSION__/howtos/quickstart_kind.html" # Components components: diff --git a/tests/k3s-docker/outputs.tf b/tests/k3s-docker/outputs.tf index 14fc83d25c..868cbc46cd 100644 --- a/tests/k3s-docker/outputs.tf +++ b/tests/k3s-docker/outputs.tf @@ -68,3 +68,8 @@ output "grafana_admin_password" { sensitive = true value = module.cluster.grafana_admin_password } + +output "minio_keys" { + sensitive = true + value = module.cluster.minio_keys +} diff --git a/version.txt b/version.txt index a758a09aae..5c4503b704 100644 --- a/version.txt +++ b/version.txt @@ -1 +1 @@ -0.48.0 +0.49.0