From 05d8e2bd79b01d7405d15620f6849bc5aa7b4b8b Mon Sep 17 00:00:00 2001 From: Alex Lebens Date: Mon, 3 Mar 2025 15:16:33 -0600 Subject: [PATCH] add argo workflows --- .../management/argo-workflows/Chart.yaml | 31 +++++ .../templates/external-secret.yaml | 62 ++++++++++ .../argo-workflows/templates/http-route.yaml | 30 +++++ .../management/argo-workflows/values.yaml | 106 ++++++++++++++++++ 4 files changed, 229 insertions(+) create mode 100644 clusters/cl01tl/management/argo-workflows/Chart.yaml create mode 100644 clusters/cl01tl/management/argo-workflows/templates/external-secret.yaml create mode 100644 clusters/cl01tl/management/argo-workflows/templates/http-route.yaml create mode 100644 clusters/cl01tl/management/argo-workflows/values.yaml diff --git a/clusters/cl01tl/management/argo-workflows/Chart.yaml b/clusters/cl01tl/management/argo-workflows/Chart.yaml new file mode 100644 index 000000000..e8ca68be2 --- /dev/null +++ b/clusters/cl01tl/management/argo-workflows/Chart.yaml @@ -0,0 +1,31 @@ +apiVersion: v2 +name: argo-workflows +version: 1.0.0 +description: Argo Workflows +keywords: + - argo-workflows + - argo-events + - workflows + - events +home: https://wiki.alexlebens.dev/doc/argo-workflows-bRGiuUyLgj +sources: + - https://github.com/argoproj/argo-workflows + - https://github.com/argoproj/argo-events + - https://github.com/cloudnative-pg/cloudnative-pg + - https://github.com/argoproj/argo-helm/tree/main/charts + - https://github.com/alexlebens/helm-charts/charts/postgres-cluster +maintainers: + - name: alexlebens +dependencies: + - name: argo-workflows + version: 0.45.8 + repository: https://argoproj.github.io/argo-helm + - name: argo-events + version: 2.4.13 + repository: https://argoproj.github.io/argo-helm + - name: postgres-cluster + alias: postgres-17-cluster + version: 4.2.0 + repository: http://alexlebens.github.io/helm-charts +icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/argocd.png +appVersion: v3.6.2 diff --git a/clusters/cl01tl/management/argo-workflows/templates/external-secret.yaml b/clusters/cl01tl/management/argo-workflows/templates/external-secret.yaml new file mode 100644 index 000000000..46309f6b6 --- /dev/null +++ b/clusters/cl01tl/management/argo-workflows/templates/external-secret.yaml @@ -0,0 +1,62 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: argo-workflows-oidc-secret + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: argo-workflows-oidc-secret + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: web + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + secretStoreRef: + kind: ClusterSecretStore + name: vault + data: + - secretKey: secret + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /authentik/oidc/argo-workflows + metadataPolicy: None + property: secret + - secretKey: client + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /authentik/oidc/argo-workflows + metadataPolicy: None + property: client + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: argo-workflows-postgresql-17-cluster-backup-secret + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: argo-workflows-postgresql-17-cluster-backup-secret + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: database + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + secretStoreRef: + kind: ClusterSecretStore + name: vault + data: + - secretKey: ACCESS_KEY_ID + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /digital-ocean/home-infra/postgres-backups + metadataPolicy: None + property: access + - secretKey: ACCESS_SECRET_KEY + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /digital-ocean/home-infra/postgres-backups + metadataPolicy: None + property: secret diff --git a/clusters/cl01tl/management/argo-workflows/templates/http-route.yaml b/clusters/cl01tl/management/argo-workflows/templates/http-route.yaml new file mode 100644 index 000000000..98afd88c3 --- /dev/null +++ b/clusters/cl01tl/management/argo-workflows/templates/http-route.yaml @@ -0,0 +1,30 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: http-route-argo-workflows + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: http-route-argo-workflows + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: web + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: traefik-gateway + namespace: traefik + hostnames: + - argo-workflows.alexlebens.net + rules: + - matches: + - path: + type: PathPrefix + value: / + backendRefs: + - group: '' + kind: Service + name: argo-workflows + port: 80 + weight: 100 diff --git a/clusters/cl01tl/management/argo-workflows/values.yaml b/clusters/cl01tl/management/argo-workflows/values.yaml new file mode 100644 index 000000000..990a496da --- /dev/null +++ b/clusters/cl01tl/management/argo-workflows/values.yaml @@ -0,0 +1,106 @@ +argo-workflows: + controller: + metricsConfig: + enabled: true + persistence: + connectionPool: + maxIdleConns: 100 + maxOpenConns: 0 + nodeStatusOffLoad: true + archive: true + postgresql: + host: argo-workflows-postgresql-17-cluster-rw + port: 5432 + database: app + tableName: app + userNameSecret: + name: argo-workflows-postgresql-17-cluster-app + key: username + passwordSecret: + name: argo-workflows-postgresql-17-cluster-app + key: password + ssl: false + sslMode: disable + workflowWorkers: 2 + workflowTTLWorkers: 1 + podCleanupWorkers: 1 + cronWorkflowWorkers: 1 + resources: + requests: + cpu: 10m + memory: 128Mi + serviceMonitor: + enabled: true + name: workflow-controller + workflowNamespaces: + - argocd + - argo-workflows + server: + authModes: + - sso + ingress: + enabled: false + sso: + enabled: true + issuer: https://authentik.alexlebens.net/application/o/argo-workflows/ + clientId: + name: argo-workflows-oidc-secret + key: client + clientSecret: + name: argo-workflows-oidc-secret + key: secret + redirectUrl: https://argo-workflows.alexlebens.net/oauth2/callback + rbac: + enabled: false + scopes: + - openid + - email + - profile + useStaticCredentials: true + artifactRepository: + archiveLogs: false + s3: {} + # accessKeySecret: + # name: "{{ .Release.Name }}-minio" + # key: accesskey + # secretKeySecret: + # name: "{{ .Release.Name }}-minio" + # key: secretkey + # insecure: true + # bucket: + # endpoint: + # region: + # encryptionOptions: + # enableEncryption: true + +argo-events: + controller: + resources: + requests: + cpu: 10m + memory: 128Mi + metrics: + enabled: true + serviceMonitor: + enabled: true + webhook: + enabled: true + resources: + requests: + cpu: 10m + memory: 128Mi +postgres-17-cluster: + mode: standalone + cluster: + walStorage: + storageClass: local-path + storage: + storageClass: local-path + monitoring: + enabled: true + backup: + enabled: true + endpointURL: https://nyc3.digitaloceanspaces.com + destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/argo-workflows/argo-workflows-postgresql-17-cluster + endpointCredentials: argo-workflows-postgresql-17-cluster-backup-secret + backupIndex: 2