Initial commit

apps/argocd/manifests/argocd-health-checks.yaml

@@ -0,0 +1,84 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cm-custom-health
+  namespace: argocd
+  labels:
+    app.kubernetes.io/part-of: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+data:
+  resource.customizations.health.ceph.rook.io_CephCluster: |
+    hs = {}
+    if obj.status ~= nil then
+      if obj.status.phase == "Ready" and obj.status.ceph ~= nil and obj.status.ceph.health == "HEALTH_OK" then
+        hs.status = "Healthy"
+        hs.message = "CephCluster is healthy"
+      elseif obj.status.phase == "Progressing" then
+        hs.status = "Progressing"
+        hs.message = obj.status.message or "CephCluster is progressing"
+      else
+        hs.status = "Degraded"
+        hs.message = obj.status.message or "CephCluster is not healthy"
+      end
+    else
+      hs.status = "Progressing"
+      hs.message = "Waiting for CephCluster status"
+    end
+    return hs
+  resource.customizations.health.postgresql.cnpg.io_Cluster: |
+    hs = {}
+    if obj.status ~= nil then
+      if obj.status.phase == "Cluster in healthy state" then
+        hs.status = "Healthy"
+        hs.message = "CNPG Cluster is healthy"
+      elseif obj.status.phase == "Setting up primary" or obj.status.phase == "Creating primary" then
+        hs.status = "Progressing"
+        hs.message = obj.status.phase
+      else
+        hs.status = "Degraded"
+        hs.message = obj.status.phase or "CNPG Cluster is not healthy"
+      end
+    else
+      hs.status = "Progressing"
+      hs.message = "Waiting for CNPG Cluster status"
+    end
+    return hs
+  resource.customizations.health.external-secrets.io_ClusterSecretStore: |
+    hs = {}
+    if obj.status ~= nil and obj.status.conditions ~= nil then
+      for i, condition in ipairs(obj.status.conditions) do
+        if condition.type == "Ready" then
+          if condition.status == "True" then
+            hs.status = "Healthy"
+            hs.message = "ClusterSecretStore is ready"
+          else
+            hs.status = "Degraded"
+            hs.message = condition.message or "ClusterSecretStore is not ready"
+          end
+          return hs
+        end
+      end
+    end
+    hs.status = "Progressing"
+    hs.message = "Waiting for ClusterSecretStore status"
+    return hs
+  resource.customizations.health.kiali.io_Kiali: |
+    hs = {}
+    if obj.status ~= nil then
+      if obj.status.conditions ~= nil then
+        for i, condition in ipairs(obj.status.conditions) do
+          if condition.type == "Successful" and condition.status == "True" then
+            hs.status = "Healthy"
+            hs.message = "Kiali is healthy"
+            return hs
+          end
+        end
+      end
+      hs.status = "Progressing"
+      hs.message = "Kiali is being deployed"
+    else
+      hs.status = "Progressing"
+      hs.message = "Waiting for Kiali status"
+    end
+    return hs

apps/argocd/manifests/envoy-route.yaml

@@ -0,0 +1,20 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: argocd
+  namespace: argocd
+spec:
+  parentRefs:
+    - name: edge
+      namespace: gateway
+      sectionName: https
+  hostnames:
+    - argocd.kube.huskypup.net
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: argocd-server
+          port: 80

apps/argocd/manifests/external-secret.yaml

@@ -0,0 +1,23 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: argocd-oauth
+  namespace: argocd
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: argocd-oauth-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: client-id
+      remoteRef:
+        key: argocd-oauth
+        property: client-id
+    - secretKey: client-secret
+      remoteRef:
+        key: argocd-oauth
+        property: client-secret

apps/argocd/manifests/istio-virtualservice.yaml

@@ -0,0 +1,16 @@
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: argocd
+  namespace: argocd
+spec:
+  hosts:
+    - argocd.kube.huskypup.net
+  gateways:
+    - istio-system/edge
+  http:
+    - route:
+        - destination:
+            host: argocd-server.argocd.svc.cluster.local
+            port:
+              number: 80

apps/argocd/values.yaml

@@ -0,0 +1,78 @@
+# values/argocd.values.yaml
+
+global:
+  domain: argocd.kube.huskypup.net
+
+configs:
+  cm:
+    url: https://argocd.kube.huskypup.net
+    oidc.config: |
+      name: Authentik
+      issuer: https://auth.kube.huskypup.net/application/o/argocd/
+      clientID: $oidc.authentik.clientId
+      clientSecret: $oidc.authentik.clientSecret
+      requestedScopes:
+        - openid
+        - profile
+        - email
+        - groups
+  
+  rbac:
+    policy.default: role:readonly
+    policy.csv: |
+      g, Authentik Admins, role:admin
+      g, ArgoCD Admins, role:admin
+
+server:
+  extraArgs:
+    - --insecure  # TLS is terminated at Istio gateway
+
+  ingress:
+    enabled: false
+
+  env:
+    - name: oidc.authentik.clientId
+      valueFrom:
+        secretKeyRef:
+          name: argocd-oauth-secret
+          key: client-id
+    - name: oidc.authentik.clientSecret
+      valueFrom:
+        secretKeyRef:
+          name: argocd-oauth-secret
+          key: client-secret
+
+dex:
+  enabled: false  # using Authentik instead of built-in Dex
+
+# Enable Prometheus metrics
+metrics:
+  enabled: true
+  serviceMonitor:
+    enabled: true
+    additionalLabels:
+      release: prometheus
+
+controller:
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: true
+      additionalLabels:
+        release: prometheus
+
+repoServer:
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: true
+      additionalLabels:
+        release: prometheus
+
+applicationSet:
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: true
+      additionalLabels:
+        release: prometheus