Skip to content

Commit fea9095

Browse files
kvapskvaps
committed
[fluxcd] Add flux-aio module and migration to v22
Signed-off-by: Andrei Kvapil <[email protected]>
1 parent 1f47fbc commit fea9095

10 files changed

Lines changed: 12132 additions & 39 deletions

File tree

‎packages/core/flux-aio/Chart.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
apiVersion: v2
2+
name: cozy-fluxcd
3+
version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process

‎packages/core/flux-aio/Makefile‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
NAME=flux-aio
2+
NAMESPACE=cozy-$(NAME)
3+
4+
show:
5+
kubectl apply -R -f manifests/ --dry-run=client -o yaml
6+
7+
apply:
8+
kubectl apply -R -f manifests/ --server-side --force-conflicts
9+
10+
diff:
11+
kubectl diff -R -f manifests/
12+
13+
update:
14+
timoni bundle build -f flux-aio.cue > manifests/fluxcd.yaml
15+
sed -e 's|\.cluster\.local\.,||g' -e 's|\.cluster\.local\,||g' -e 's|\.cluster\.local\.||g' -e '/timoni/d' -i manifests/fluxcd.yaml
16+
yq eval '(select(.kind == "Namespace") | .metadata.labels."pod-security.kubernetes.io/enforce") = "privileged"' -i manifests/fluxcd.yaml

‎packages/core/flux-aio/flux-aio.cue‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
bundle: {
2+
apiVersion: "v1alpha1"
3+
name: "flux-aio"
4+
instances: {
5+
"flux": {
6+
module: {
7+
url: "oci://ghcr.io/stefanprodan/modules/flux-aio"
8+
version: "latest"
9+
}
10+
namespace: "cozy-fluxcd"
11+
values: {
12+
securityProfile: "privileged"
13+
}
14+
}
15+
}
16+
}

‎packages/core/flux-aio/manifests/fluxcd.yaml‎

Lines changed: 11951 additions & 0 deletions
Large diffs are not rendered by default.

‎packages/core/flux-aio/values.yaml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
flux-instance:
2+
instance:
3+
cluster:
4+
networkPolicy: false # -- disable due to liveness/readiness probes issues with network policies
5+
domain: cozy.local # -- default value is overriden in patches
6+
distribution:
7+
artifact: ""
8+
version: 2.7.x
9+
registry: ghcr.io/fluxcd
10+
components:
11+
- source-controller
12+
- source-watcher
13+
- kustomize-controller
14+
- helm-controller
15+
- notification-controller
16+
- image-reflector-controller
17+
- image-automation-controller
18+
kustomize:
19+
patches:
20+
- target:
21+
kind: Deployment
22+
name: "(kustomize-controller|helm-controller|source-controller)"
23+
patch: |
24+
- op: add
25+
path: /spec/template/spec/containers/0/args/-
26+
value: --concurrent=20
27+
- op: add
28+
path: /spec/template/spec/containers/0/args/-
29+
value: --requeue-dependency=5s
30+
- op: replace
31+
path: /spec/template/spec/containers/0/resources/limits
32+
value:
33+
cpu: 2000m
34+
memory: 2048Mi
35+
- target:
36+
kind: Deployment
37+
name: source-controller
38+
patch: |
39+
- op: add
40+
path: /spec/template/spec/containers/0/args/-
41+
value: --storage-adv-addr=source-controller.cozy-fluxcd.svc
42+
- target:
43+
kind: Deployment
44+
name: source-watcher
45+
patch: |
46+
- op: add
47+
path: /spec/template/spec/containers/0/args/-
48+
value: --storage-adv-addr=source-watcher.cozy-fluxcd.svc
49+
- target:
50+
kind: Deployment
51+
name: (kustomize-controller|helm-controller|image-reflector-controller|image-automation-controller|source-controller|source-watcher)
52+
patch: |
53+
- op: add
54+
path: /spec/template/spec/containers/0/args/-
55+
value: --events-addr=http://notification-controller.cozy-fluxcd.svc/

‎packages/core/installer/templates/cozystack.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,8 @@ spec:
5454
env:
5555
- name: KUBERNETES_SERVICE_HOST
5656
value: localhost
57+
- name: INSTALL_FLUX
58+
value: "true"
5759
- name: KUBERNETES_SERVICE_PORT
5860
value: "7445"
5961
- name: K8S_AWAIT_ELECTION_ENABLED

‎packages/core/platform/templates/helmrepos.yaml‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,9 @@ metadata:
88
cozystack.io/repository: system
99
spec:
1010
interval: 5m0s
11-
url: http://cozystack.cozy-system.svc/repos/system
11+
url: https://{{ include "cozystack.kubernetesAPIEndpoint" . }}/api/v1/namespaces/cozy-system/pods/cozystack-assets-0/proxy/repos/system
12+
certSecretRef:
13+
name: cozystack-assets-tls
1214
---
1315
apiVersion: source.toolkit.fluxcd.io/v1
1416
kind: HelmRepository
@@ -20,7 +22,9 @@ metadata:
2022
cozystack.io/repository: apps
2123
spec:
2224
interval: 5m0s
23-
url: http://cozystack.cozy-system.svc/repos/apps
25+
url: https://{{ include "cozystack.kubernetesAPIEndpoint" . }}/api/v1/namespaces/cozy-system/pods/cozystack-assets-0/proxy/repos/apps
26+
certSecretRef:
27+
name: cozystack-assets-tls
2428
---
2529
apiVersion: source.toolkit.fluxcd.io/v1
2630
kind: HelmRepository
@@ -31,4 +35,6 @@ metadata:
3135
cozystack.io/repository: extra
3236
spec:
3337
interval: 5m0s
34-
url: http://cozystack.cozy-system.svc/repos/extra
38+
url: https://{{ include "cozystack.kubernetesAPIEndpoint" . }}/api/v1/namespaces/cozy-system/pods/cozystack-assets-0/proxy/repos/extra
39+
certSecretRef:
40+
name: cozystack-assets-tls

‎scripts/installer.sh‎

Lines changed: 7 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -19,45 +19,18 @@ run_migrations() {
1919
done
2020
}
2121

22-
flux_is_ok() {
23-
kubectl wait --for=condition=available -n cozy-fluxcd deploy/source-controller deploy/helm-controller --timeout=1s
24-
kubectl wait --for=condition=ready -n cozy-fluxcd helmrelease/fluxcd --timeout=1s # to call "apply resume" below
25-
}
26-
27-
ensure_fluxcd() {
28-
if flux_is_ok; then
22+
install_flux() {
23+
if [ "$INSTALL_FLUX" != "true" ]; then
2924
return
3025
fi
31-
# Install fluxcd-operator
32-
if kubectl get helmreleases.helm.toolkit.fluxcd.io -n cozy-fluxcd fluxcd-operator; then
33-
make -C packages/system/fluxcd-operator apply resume
34-
else
35-
make -C packages/system/fluxcd-operator apply-locally
36-
fi
37-
wait_for_crds fluxinstances.fluxcd.controlplane.io
38-
39-
# Install fluxcd
40-
if kubectl get helmreleases.helm.toolkit.fluxcd.io -n cozy-fluxcd fluxcd; then
41-
make -C packages/system/fluxcd apply resume
42-
else
43-
make -C packages/system/fluxcd apply-locally
44-
fi
26+
make -C packages/core/flux-aio apply
4527
wait_for_crds helmreleases.helm.toolkit.fluxcd.io helmrepositories.source.toolkit.fluxcd.io
4628
}
4729

4830
wait_for_crds() {
4931
timeout 60 sh -c "until kubectl get crd $*; do sleep 1; done"
5032
}
5133

52-
install_basic_charts() {
53-
if [ "$BUNDLE" = "paas-full" ] || [ "$BUNDLE" = "distro-full" ]; then
54-
make -C packages/system/cilium apply resume
55-
fi
56-
if [ "$BUNDLE" = "paas-full" ]; then
57-
make -C packages/system/kubeovn apply resume
58-
fi
59-
}
60-
6134
cd "$(dirname "$0")/.."
6235

6336
# Run migrations
@@ -67,16 +40,14 @@ run_migrations
6740
make -C packages/core/platform namespaces-apply
6841

6942
# Install fluxcd
70-
ensure_fluxcd
43+
install_flux
44+
45+
# Install fluxcd certificates
46+
./scripts/issue-flux-certificates.sh
7147

7248
# Install platform chart
7349
make -C packages/core/platform reconcile
7450

75-
# Install basic charts
76-
if ! flux_is_ok; then
77-
install_basic_charts
78-
fi
79-
8051
# Reconcile Helm repositories
8152
kubectl annotate helmrepositories.source.toolkit.fluxcd.io -A -l cozystack.io/repository reconcile.fluxcd.io/requestedAt=$(date +"%Y-%m-%dT%H:%M:%SZ") --overwrite
8253

‎scripts/issue-flux-certificates.sh‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
#!/bin/sh
2+
set -e
3+
4+
if kubectl get secret -n cozy-system cozystack-assets-tls >/dev/null && kubectl get secret -n cozy-public cozystack-assets-tls >/dev/null; then
5+
echo "Secret cozystack-assets-tls already exists in both cozy-system and cozy-public namespaces. Exiting."
6+
exit 0
7+
fi
8+
9+
USER_CN="cozystack-assets-reader"
10+
CSR_NAME="csr-${USER_CN}-$(date +%s)"
11+
12+
# make temp directory and cleanup handler
13+
TMPDIR=$(mktemp -d)
14+
trap "rm -rf $TMPDIR" EXIT
15+
16+
# move into tmpdir
17+
cd "$TMPDIR"
18+
19+
openssl genrsa -out tls.key 2048
20+
openssl req -new -key tls.key -subj "/CN=${USER_CN}" -out tls.csr
21+
22+
CSR_B64=$(base64 < tls.csr | tr -d '\n')
23+
24+
cat <<EOF | kubectl apply -f -
25+
apiVersion: certificates.k8s.io/v1
26+
kind: CertificateSigningRequest
27+
metadata:
28+
name: ${CSR_NAME}
29+
spec:
30+
signerName: kubernetes.io/kube-apiserver-client
31+
request: ${CSR_B64}
32+
usages:
33+
- client auth
34+
EOF
35+
36+
kubectl certificate approve "${CSR_NAME}"
37+
38+
echo "Waiting for .status.certificate..."
39+
kubectl wait csr "${CSR_NAME}" \
40+
--for=jsonpath='{.status.certificate}' \
41+
--timeout=120s
42+
43+
kubectl get csr "${CSR_NAME}" \
44+
-o jsonpath='{.status.certificate}' | base64 -d > tls.crt
45+
46+
kubectl get -n kube-public configmap kube-root-ca.crt \
47+
-o jsonpath='{.data.ca\.crt}' > ca.crt
48+
49+
kubectl create secret generic "cozystack-assets-tls" \
50+
--namespace='cozy-system' \
51+
--type='kubernetes.io/tls' \
52+
--from-file=tls.crt \
53+
--from-file=tls.key \
54+
--from-file=ca.crt \
55+
--dry-run=client -o yaml | kubectl apply -f -
56+
57+
kubectl create secret generic "cozystack-assets-tls" \
58+
--namespace='cozy-public' \
59+
--type='kubernetes.io/tls' \
60+
--from-file=tls.crt \
61+
--from-file=tls.key \
62+
--from-file=ca.crt \
63+
--dry-run=client -o yaml | kubectl apply -f -

‎scripts/migrations/21‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/sh
2+
# Migration 21 --> 22
3+
4+
set -euo pipefail
5+
6+
kubectl delete hr -n cozy-fluxcd fluxcd --ignore-not-found
7+
8+
# Stamp version
9+
kubectl create configmap -n cozy-system cozystack-version \
10+
--from-literal=version=22 --dry-run=client -o yaml | kubectl apply -f-

0 commit comments

Comments
 (0)