Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
75 commits
Select commit Hold shift + click to select a range
aac01c5
update: markdown
codekow Dec 1, 2023
468b28b
update: argocd structure
codekow Dec 1, 2023
c2b09f2
update: operators
codekow Dec 1, 2023
82901b9
fix: operators
codekow Dec 1, 2023
8325a2e
fix: operators
codekow Dec 1, 2023
f56955f
fix: operators
codekow Dec 1, 2023
64eeb06
fix: operators
codekow Dec 1, 2023
2ec3f49
add: operators
codekow Dec 1, 2023
2e4dd87
add: operators
codekow Dec 1, 2023
b3cfdaf
add: operators
codekow Dec 1, 2023
f4cbc3a
add: operators
codekow Dec 1, 2023
8a69232
add: operators
codekow Dec 1, 2023
11ef827
add: vault operator
codekow Dec 2, 2023
6b99fb0
add: operator git webhook
codekow Dec 2, 2023
86bc76a
add: operator git webhook
codekow Dec 2, 2023
aa891a4
add: gitlab-operator
codekow Dec 2, 2023
f185cad
update: gitlab
codekow Dec 2, 2023
b4e1709
update: gitlab
codekow Dec 2, 2023
3c11f37
update: gitlab
codekow Dec 2, 2023
bf58145
update: gitlab
codekow Dec 2, 2023
613d44f
update: gitlab
codekow Dec 2, 2023
adc11df
add: imagepuller
codekow Dec 2, 2023
96dd7f9
add: imagepuller
codekow Dec 2, 2023
e7e010f
add: the rest
codekow Dec 2, 2023
7507f18
add: the rest
codekow Dec 2, 2023
262d172
fix: names
codekow Dec 2, 2023
95fb826
fix: vault config
codekow Dec 2, 2023
f4a76e3
add: overlay
codekow Dec 2, 2023
622f8e4
fix: things
codekow Dec 2, 2023
0e39e3a
fix: vault
codekow Dec 2, 2023
67103df
fix: vault
codekow Dec 2, 2023
2afe574
fix: vault
codekow Dec 2, 2023
ed34a51
fix: vault
codekow Dec 2, 2023
d29e0b0
fix: vault
codekow Dec 2, 2023
d1f310b
fix: vault
codekow Dec 2, 2023
195a8f9
fix: vault
codekow Dec 2, 2023
2979a4c
fix: vault
codekow Dec 2, 2023
704d2d6
fix: vault
codekow Dec 2, 2023
9a60843
fix: script
codekow Dec 2, 2023
b09062e
delete: old helm
codekow Dec 2, 2023
ab15287
delete: old install
codekow Dec 2, 2023
cfafef7
delete: old vault
codekow Dec 2, 2023
d666fcb
add: new argo
codekow Dec 2, 2023
af2a35b
cleanup: gitops
codekow Dec 2, 2023
564f09d
fix: devspaces
codekow Dec 2, 2023
f76644f
fix: devspaces
codekow Dec 2, 2023
171e023
fix: gitops
codekow Dec 2, 2023
d6db0d6
fix: gitops
codekow Dec 2, 2023
78e3f28
fix: gitops
codekow Dec 2, 2023
b29e8ea
cleanup
codekow Dec 2, 2023
060d343
update: cert manager
codekow Dec 2, 2023
e977627
cleanup
codekow Dec 2, 2023
28c928b
update: cert manager
codekow Dec 2, 2023
1fc702b
update: cert manager
codekow Dec 2, 2023
640ccf2
update: cert manager
codekow Dec 2, 2023
10fcd8b
update: cert-manager
codekow Dec 2, 2023
595a0dd
delete: cert manger
codekow Dec 2, 2023
b150cb8
cleanup
codekow Dec 2, 2023
822427c
update: paths
codekow Dec 2, 2023
505921d
update: cluster config
codekow Dec 2, 2023
1992207
fix: paths
codekow Dec 2, 2023
cd5de8f
fix: ignore
codekow Dec 2, 2023
9dfde1a
fix: cert manager
codekow Dec 2, 2023
45f7b39
fix: gitwebhook
codekow Dec 2, 2023
0dfc243
fix: paths
codekow Dec 2, 2023
fa1dae6
add: cluster config
codekow Dec 2, 2023
9adcac7
add: vault-config
codekow Dec 2, 2023
6f9fe8c
cleanup
codekow Dec 2, 2023
8a4a512
update: vault config
codekow Dec 2, 2023
7358ba5
add: common label
codekow Dec 2, 2023
ddeb1d1
update: devspaces; and kustomize only
codekow Dec 2, 2023
f6ac552
update
codekow Dec 2, 2023
e6870d6
rename: scripts
codekow Dec 2, 2023
12db1c5
update: docs
codekow Dec 2, 2023
de43dd9
add: linting
codekow Dec 6, 2023
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
189 changes: 168 additions & 21 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -1,28 +1,175 @@
# Compiled class file
*.class
# custom excludes
data/
scratch/
dictionary.dic

# Log file
# swap files
*~
.*~
*.swp
.*.swp
*.swo

# bfg - because we never commit large data or passwords to git
..bfg-report/

# Byte-compiled / optimized / DLL files
__pycache__/
*.py[cod]
*$py.class

# C extensions
*.so

# Distribution / packaging
.Python
build/
develop-eggs/
dist/
downloads/
eggs/
.eggs/
lib/
lib64/
parts/
sdist/
var/
wheels/
share/python-wheels/
*.egg-info/
.installed.cfg
*.egg
MANIFEST

# PyInstaller
# Usually these files are written by a python script from a template
# before PyInstaller builds the exe, so as to inject date/other infos into it.
*.manifest
*.spec

# Installer logs
pip-log.txt
pip-delete-this-directory.txt

# Unit test / coverage reports
htmlcov/
.tox/
.nox/
.coverage
.coverage.*
.cache
nosetests.xml
coverage.xml
*.cover
*.py,cover
.hypothesis/
.pytest_cache/
cover/

# Translations
*.mo
*.pot

# Django stuff:
*.log
local_settings.py
db.sqlite3
db.sqlite3-journal

# Flask stuff:
instance/
.webassets-cache

# Scrapy stuff:
.scrapy

# Sphinx documentation
docs/_build/

# PyBuilder
.pybuilder/
target/

# Jupyter Notebook
.ipynb_checkpoints

# IPython
profile_default/
ipython_config.py

# pyenv
# For a library or package, you might want to ignore these files since the code is
# intended to run in multiple environments; otherwise, check them in:
# .python-version

# pipenv
# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
# However, in case of collaboration, if having platform-specific dependencies or dependencies
# having no cross-platform support, pipenv may install dependencies that don't work, or not
# install all needed dependencies.
#Pipfile.lock

# poetry
# Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
# This is especially recommended for binary packages to ensure reproducibility, and is more
# commonly ignored for libraries.
# https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
#poetry.lock

# pdm
# Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
#pdm.lock
# pdm stores project-wide configurations in .pdm.toml, but it is recommended to not include it
# in version control.
# https://pdm.fming.dev/#use-with-ide
.pdm.toml

# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
__pypackages__/

# Celery stuff
celerybeat-schedule
celerybeat.pid

# SageMath parsed files
*.sage.py

# Environments
.env
.venv
env/
venv/
ENV/
env.bak/
venv.bak/

# Spyder project settings
.spyderproject
.spyproject

# Rope project settings
.ropeproject

# mkdocs documentation
/site

# BlueJ files
*.ctxt
# mypy
.mypy_cache/
.dmypy.json
dmypy.json

# Mobile Tools for Java (J2ME)
.mtj.tmp/
# Pyre type checker
.pyre/

# Package Files #
*.jar
*.war
*.nar
*.ear
*.zip
*.tar.gz
*.rar
# pytype static type analyzer
.pytype/

# virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
hs_err_pid*
# Cython debug symbols
cython_debug/

*.ignored/
*.ignore
bootstrap-scripts/htpasswd-users
.vscode/
# PyCharm
# JetBrains specific template is maintained in a separate JetBrains.gitignore that can
# be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
# and can be added to the global gitignore or merged into this file. For a more nuclear
# option (not recommended) you can uncomment the following to ignore the entire idea folder.
.idea/
97 changes: 51 additions & 46 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,93 +5,98 @@ This project repo contains a set of ArgoCD manifests and a set of Ansible Playbo
It uses the ArgoCD **App of Apps pattern** to pre-install and configure a set of Openshift Operators to support Developer Workflows.

The following components should be provisioned by ArgoCD in your cluster:
* **Cert Manager**
* **Container Security Operator**
* **Openshift Devspaces**
* **Git Webhook Operator**
* **Gilab**
* **Hashicorp Vault**
* **Vault Config Operator**
* **Kubernetes Image Puller Operator**
* **Openshift Pipelines**
* **Patch Operator**
* **...** (this list keeps growing as I need to add new components to my demos)

# First things first
If you got a "naked cluster" with just the `kubeadmin` system user. You can start by enabling the `htpasswd` auth provider and creating the `admin` user by using the `bootstrap-scripts/enable-htpasswd-users.sh`.

* **Cert Manager**
* **Container Security Operator**
* **Openshift Devspaces**
* **Git Webhook Operator**
* **Gilab**
* **Hashicorp Vault**
* **Vault Config Operator**
* **Kubernetes Image Puller Operator**
* **Openshift Pipelines**
* **Patch Operator**
* **...** (this list keeps growing as I need to add new components to my demos)

## First things first

If you got a "naked cluster" with just the `kubeadmin` system user. You can start by enabling the `htpasswd` auth provider and creating the `admin` user by using the `scripts/enable-htpasswd-users.sh`.

This script will create the `admin` user as `cluster-admin` and 5 other regular (non-admin) users.

# Openshift GitOps installation and cluster bootstrap
## Openshift GitOps installation and cluster bootstrap

You can choose to install **Openshift GitOps** Operator manually from the Operator Hub using the Openshift Console (Administrator Perspective) or you can

1. Authenticate as a `cluster-admin` on your cluster and execute

```shell
./bootstrap-scripts/cluster-boostrap.sh
./scripts/cluster-boostrap.sh
```

This script will:
* install Openshift GitOps (ArgoCD)
* apply the ArgoCD root app
* kickoff the cluster bootstrap


* Install Openshift GitOps (ArgoCD) operator
* Configure OpenShift GitOps (ArgoCD) instance
* Bootstrap the ArgoCD app of app

After applying this manifest go to the ArgoCD web console and watch the provisioning.
> **IMPORTANT**: It will take a while to have all components provisioned and in healthy state. The provisioning happens in "waves". You may have to refresh od sync come apps in case they remain in unhealthy state.

![ArgoCD Root App tree](./docs/images/ArgoCD-root-app-tree.png)

# Enabling Github oAuth provider
## Enabling Github oAuth provider

I use this repo to bootstrap an Openshift Cluster to showcase Openshift Dev Tooling and Developer workflows on top of Openshift Platform.
For this I like to integrate Openshift and Openshift DevSpaces with Github.
For this I like to integrate Openshift and Openshift DevSpaces with Github.

To enable github users to authenticate on Openshift and DevSpaces using their Github accounts you need to configure Github oAuth.
To enable github users to authenticate on Openshift and DevSpaces using their Github accounts you need to configure Github oAuth.

## Enabling Github users (developers) to access Openshift

* Go to https://github.com/account/organizations/new?plan=free and create a new Github Personal Org"
* Fill the fields with:
* Organization Account Name: 'my-openshift-dev-team'
* Contact email: 'your email address'
* Check 'My personal account' for the Organization type
* Go to https://github.com/account/organizations/new?plan=free and create a new Github Personal Org"
* Fill the fields with:
* Organization Account Name: 'my-openshift-dev-team'
* Contact email: 'your email address'
* Check 'My personal account' for the Organization type

![](./docs/images/new-gb-personal-org.png)
![image](./docs/images/new-gb-personal-org.png)

> **IMPORTANT:** After creating your Personal Org, make sure you add members to it (including yourself)
> Go to https://github.com/orgs/your-org-name/people and invite/add members

![](./docs/images/gb-org-members.png)
![image](./docs/images/gb-org-members.png)

* Now go to https://github.com/settings/applications/new and create a new GitHub app
* Fill the fields with:
* Application Name: `Red Hat Openshift oAuth provider`
* Homepage URL: `https://console-openshift-console.apps.cluster-domain.com/`
* Authorization callback URL: `https://oauth-openshift.apps.cluster-domain.com/oauth2callback/github`
* Now go to https://github.com/settings/applications/new and create a new GitHub app
* Fill the fields with:
* Application Name: `Red Hat Openshift oAuth provider`
* Homepage URL: `https://console-openshift-console.apps.cluster-domain.com/`
* Authorization callback URL: `https://oauth-openshift.apps.cluster-domain.com/oauth2callback/github`

> **IMPORTANT:** <mark>Remember to copy the Client Id and the Client Secret values</mark>

![](./docs/images/new-gb-ocp-oauth-app.png)
![image](./docs/images/new-gb-ocp-oauth-app.png)

## Configuring Github oAuth for DevSpaces

* Now go to https://github.com/settings/applications/new and create another GitHub app (now for DevSpaces)
* Fill the fields with:
* Application Name: `Openshift DevSpaces oAuth provider`
* Homepage URL: `https://devspaces.apps.cluster-domain.com/`
* Authorization callback URL: `https://devspaces.apps.cluster-domain.com/api/oauth/callback`
* Now go to https://github.com/settings/applications/new and create another GitHub app (now for DevSpaces)
* Fill the fields with:
* Application Name: `Openshift DevSpaces oAuth provider`
* Homepage URL: `https://devspaces.apps.cluster-domain.com/`
* Authorization callback URL: `https://devspaces.apps.cluster-domain.com/api/oauth/callback`

> **IMPORTANT:** <mark>Remember to copy the Client Id and the Client Secret values</mark>

![](./docs/images/new-gb-devspaces-oauth-app.png)
![image](./docs/images/new-gb-devspaces-oauth-app.png)

## Applying the Github oAuth configuration to your Openshift cluster

With the Github Org and oAuth Apps properly created, now is time to apply the required configuration in your cluster.
With the Github Org and oAuth Apps properly created, now is time to apply the required configuration in your cluster.

**To make things easy I created a script to guide you in this configuration. Just execute the `bootstrap-scripts/setup-github-oauth.sh` and follow the instructions.**
**To make things easy I created a script to guide you in this configuration. Just execute the `scripts/setup-github-oauth.sh` and follow the instructions.**

> **NOTE:** After you create the github secrets the Patch Operator will catch the secret `ocp-github-app-credentials` (should be present in the `openshift-config` namespaces) and automatically configure the Cluster oAuth resource for you.
> **NOTE:** After you create the github secrets the Patch Operator will catch the secret `ocp-github-app-credentials` (should be present in the `openshift-config` namespaces) and automatically configure the Cluster oAuth resource for you.

In a couple of seconds you should be able to access the cluster using Github as an Identity Provider.

![](./docs/images/gb-oauth-openshift-console.png)
![image](./docs/images/gb-oauth-openshift-console.png)
24 changes: 0 additions & 24 deletions argo-applications/Chart.yaml

This file was deleted.

Loading