Added FluxCD configuration

argocd/argocd-ingress.yaml

@@ -0,0 +1,20 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: argocd-ingress
+  namespace: argocd
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: argocd.marcin00.pl
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: argocd-server
+                port:
+                  number: 80

argocd/readme.md

@@ -0,0 +1,51 @@
+# Instrukcje konfiguracji ArgoCD
+
+## Instalacja:
+Aby wdrożyć ArgoCD wykonujemy komendy:
+```
+kubectl create namespace argocd
+kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
+```
+W celu zalogowania sekret wydobywamy komendą:
+```
+kubectl get secret argocd-initial-admin-secret -n argocd -o jsonpath="{.data.password}" | base64 -d
+```
+Następnie wdrażamy obiekt Ingress z tego folderu.
+```
+kubectl apply -f argocd-ingress.yaml
+```
+
+## Jak wyłączyć HTTPS
+Aby wyłączyć HTTPS w ArgoCD należy otworzyć configmap:
+```
+kubectl edit configmap argocd-cmd-params-cm -n argocd
+```
+i dodać do configmap następujący tekst:
+```
+data:
+  server.insecure: "true"
+```
+Aby przeładować serwer zniszcz poda:
+```
+kubectl delete pod -n argocd argocd-server-<xxx>
+```
+
+## Jak ustawić wartość sekretu dla Webhooka Gitea
+Zapisujemy sekret do zmiennej środowiskowej GITEA_WEBHOOK_SECRET.
+Następnie tworzymy sekret za pomocą poniższej komendy
+```
+kubectl create secret generic gitea-webhook-secret \
+  --namespace argocd \
+  --from-literal=webhook.secret="$GITEA_WEBHOOK_SECRET" \
+  --type=Opaque \
+  --label=app.kubernetes.io/part-of=argocd \
+  --dry-run=client -o yaml | kubectl apply -f -
+```
+Potem modyfikujemy argocd-secret, otwieramy go komendą:
+```
+kubectl edit secret argocd-secret -n argocd
+```
+dodajemy pod klucz `data` taką oto linię:
+```
+webhook.gitea.secret: "$gitea-webhook-secret:webhook.secret"
+```

fluxcd/flux-receiver.yaml

@@ -0,0 +1,17 @@
+apiVersion: notification.toolkit.fluxcd.io/v1
+kind: Receiver
+metadata:
+  name: gitea-receiver
+  namespace: flux-system
+spec:
+  type: generic
+  events:
+    - "ping"
+    - "push"
+  secretRef:
+    name: webhook-token
+  resources:
+    - apiVersion: source.toolkit.fluxcd.io/v1
+      kind: GitRepository
+      name: user-microservice-repo
+      namespace: flux-system

fluxcd/fluxcd-secret.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: webhook-token
+  namespace: flux-system
+stringData:
+  token: ${GITEA_WEBHOOK_SECRET}

fluxcd/ingress.yaml

@@ -0,0 +1,20 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: webhook-receiver
+  namespace: flux-system
+  annotations:
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: flux.marcin00.pl
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: webhook-receiver
+                port:
+                  number: 80

fluxcd/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: user-microservice
+  namespace: flux-system
+spec:
+  interval: 1m
+  path: ./apps/user-microservice
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: user-microservice-repo
+  targetNamespace: user-microservice

fluxcd/source.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: user-microservice-repo
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://gitea.marcin00.pl/pikram/user-microservice-deploy.git
+  ref:
+    branch: argoworkflow-fluxcd

woodpecker/rbac-role.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: deployer-binding
+subjects:
+- kind: User
+  name: f91aef65-7d2a-4df8-a884-e33b05d54a31
+  apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: ClusterRole
+  name: cluster-admin
+  apiGroup: rbac.authorization.k8s.io

woodpecker/secret-store.yaml

@@ -0,0 +1,35 @@
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: woodpecker-secrets
+  namespace: woodpecker
+spec:
+  provider: azure
+  secretObjects:
+    - secretName: woodpecker-secret
+      type: Opaque
+      data:
+        - objectName: woodpecker-gitea-client
+          key: WOODPECKER_GITEA_CLIENT
+        - objectName: woodpecker-gitea-secret
+          key: WOODPECKER_GITEA_SECRET
+        - objectName: woodpecker-agent-secret
+          key: WOODPECKER_AGENT_SECRET
+  parameters:
+    usePodIdentity: "false"
+    useVMManagedIdentity: "true"
+    userAssignedIdentityID: "f91aef65-7d2a-4df8-a884-e33b05d54a31"     # client_id of the user-assigned managed identity
+    clientID: "f91aef65-7d2a-4df8-a884-e33b05d54a31"                   # client_id of the user-assigned managed identity
+    keyvaultName: "dev-aks"
+    objects: |
+      array:
+        - |
+          objectName: woodpecker-gitea-client
+          objectType: secret
+        - |
+          objectName: woodpecker-gitea-secret
+          objectType: secret
+        - |
+          objectName: woodpecker-agent-secret
+          objectType: secret
+    tenantID: "f4e3e6f7-d21c-460e-b201-2192174e7f41"

woodpecker/woodpecker-agent.yaml

@@ -0,0 +1,41 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: woodpecker-agent
+  namespace: woodpecker
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: woodpecker-agent
+  template:
+    metadata:
+      labels:
+        app: woodpecker-agent
+    spec:
+      containers:
+      - name: agent
+        image: woodpeckerci/woodpecker-agent:v3.8.0
+        env:
+        - name: WOODPECKER_SERVER
+          value: "woodpecker-server:9000"
+        - name: WOODPECKER_BACKEND_K8S_POD_ANNOTATIONS_ALLOW_FROM_STEP
+          value: "true"        
+        - name: WOODPECKER_BACKEND_K8S_STORAGE_CLASS
+          value: azurefile-csi
+        - name: WOODPECKER_AGENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: woodpecker-secret
+              key: WOODPECKER_AGENT_SECRET
+        volumeMounts:
+          - name: secrets-store
+            mountPath: "/mnt/secrets"
+            readOnly: true
+      volumes:
+        - name: secrets-store
+          csi:
+            driver: secrets-store.csi.k8s.io
+            readOnly: true
+            volumeAttributes:
+              secretProviderClass: "woodpecker-secrets"

woodpecker/woodpecker-ingress.yaml

@@ -0,0 +1,20 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: woodpecker-ingress
+  namespace: woodpecker
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: /
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: woodpecker.marcin00.pl
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: woodpecker-server
+            port:
+              number: 80

woodpecker/woodpecker-permissions.yaml

@@ -0,0 +1,23 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: woodpecker-ci-role
+  namespace: woodpecker
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "pods/log", "pods/exec", "pods/status", "persistentvolumeclaims", "secrets"]
+    verbs: ["get", "list", "watch", "create", "delete", "patch", "update"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: woodpecker-ci-binding
+  namespace: woodpecker
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: woodpecker
+roleRef:
+  kind: Role
+  name: woodpecker-ci-role
+  apiGroup: rbac.authorization.k8s.io

woodpecker/woodpecker-server.yaml

@@ -0,0 +1,78 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: woodpecker-server
+  namespace: woodpecker
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: woodpecker-server
+  template:
+    metadata:
+      labels:
+        app: woodpecker-server
+    spec:
+      initContainers:
+        - name: fix-permissions
+          image: busybox
+          command: ["sh", "-c", "chown -R 1000:1000 /var/lib/woodpecker"]
+          volumeMounts:
+            - name: woodpecker-data
+              mountPath: /var/lib/woodpecker
+          securityContext:
+            runAsUser: 0
+      containers:
+      - name: server
+        image: woodpeckerci/woodpecker-server:v3.8.0
+        ports:
+          - containerPort: 8000
+        env:
+        - name: WOODPECKER_GITEA
+          value: "true"
+        - name: WOODPECKER_GITEA_URL
+          value: "https://gitea.marcin00.pl"
+        - name: WOODPECKER_HOST
+          value: "https://woodpecker.marcin00.pl"
+        - name: WOODPECKER_GITEA_CLIENT
+          valueFrom:
+            secretKeyRef:
+              name: woodpecker-secret
+              key: WOODPECKER_GITEA_CLIENT
+        - name: WOODPECKER_GITEA_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: woodpecker-secret
+              key: WOODPECKER_GITEA_SECRET
+        volumeMounts:
+          - name: secrets-store
+            mountPath: "/mnt/secrets"
+            readOnly: true
+          - name: woodpecker-data
+            mountPath: /var/lib/woodpecker/
+      volumes:
+        - name: secrets-store
+          csi:
+            driver: secrets-store.csi.k8s.io
+            readOnly: true
+            volumeAttributes:
+              secretProviderClass: "woodpecker-secrets"
+        - name: woodpecker-data
+          persistentVolumeClaim:
+              claimName: woodpecker-pvc
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: woodpecker-server
+  namespace: woodpecker
+spec:
+  selector:
+    app: woodpecker-server
+  ports:
+    - name: http
+      port: 80
+      targetPort: 8000
+    - name: grpc
+      port: 9000
+      targetPort: 9000

woodpecker/woodpecker-volume.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: woodpecker-pvc
+  namespace: woodpecker
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi