Merge pull request #389 from mbaldessari/common-automatic-update

common automatic update
validatedpatterns · Jun 18, 2024 · fd29238 · fd29238
2 parents 039e748 + d95084c
commit fd29238
Show file tree

Hide file tree

Showing 26 changed files with 1,758 additions and 57 deletions.
diff --git a/common/acm/templates/policies/acm-hub-ca-policy.yaml b/common/acm/templates/policies/acm-hub-ca-policy.yaml
@@ -36,6 +36,18 @@ spec:
                 data:
                   hub-kube-root-ca.crt: '{{ `{{hub fromConfigMap "" "kube-root-ca.crt" "ca.crt" | base64enc hub}}` }}'
                   hub-openshift-service-ca.crt: '{{ `{{hub fromConfigMap "" "openshift-service-ca.crt" "service-ca.crt" | base64enc hub}}` }}'
+            - complianceType: mustonlyhave
+              objectDefinition:
+                kind: ConfigMap
+                apiVersion: v1
+                metadata:
+                  name: trusted-hub-bundle
+                  namespace: imperative
+                data:
+                  hub-kube-root-ca.crt: |
+                    {{ `{{hub fromConfigMap "" "kube-root-ca.crt" "ca.crt" | autoindent hub}}` }}
+                  hub-openshift-service-ca.crt: |
+                    {{ `{{hub fromConfigMap "" "openshift-service-ca.crt" "service-ca.crt" | autoindent hub}}` }}
 ---
 apiVersion: policy.open-cluster-management.io/v1
 kind: PlacementBinding
@@ -68,5 +80,147 @@ spec:
         operator: NotIn
         values:
           - 'true'
-{{- end }}
-{{- end }}
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  name: hub-argo-ca-openshift-gitops-policy
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+    argocd.argoproj.io/compare-options: IgnoreExtraneous
+spec:
+  remediationAction: enforce
+  disabled: false
+  policy-templates:
+    - objectDefinition:
+        apiVersion: policy.open-cluster-management.io/v1
+        kind: ConfigurationPolicy
+        metadata:
+          name: hub-argo-ca-openshift-gitops-config
+        spec:
+          remediationAction: enforce
+          severity: medium
+          namespaceSelector:
+            include:
+              - default
+          object-templates:
+            - complianceType: mustonlyhave
+              objectDefinition:
+                kind: ConfigMap
+                apiVersion: v1
+                metadata:
+                  name: trusted-hub-bundle
+                  namespace: openshift-gitops
+                data:
+                  hub-kube-root-ca.crt: |
+                    {{ `{{hub fromConfigMap "" "kube-root-ca.crt" "ca.crt" | autoindent hub}}` }}
+                  hub-openshift-service-ca.crt: |
+                    {{ `{{hub fromConfigMap "" "openshift-service-ca.crt" "service-ca.crt" | autoindent hub}}` }}
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: PlacementBinding
+metadata:
+  name: hub-argo-ca-openshift-gitops-policy-binding
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+placementRef:
+  name: hub-argo-ca-openshift-gitops-policy-placement
+  kind: PlacementRule
+  apiGroup: apps.open-cluster-management.io
+subjects:
+  - name: hub-argo-ca-openshift-gitops-policy
+    kind: Policy
+    apiGroup: policy.open-cluster-management.io
+---
+apiVersion: apps.open-cluster-management.io/v1
+kind: PlacementRule
+metadata:
+  name: hub-argo-ca-openshift-gitops-policy-placement
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  clusterConditions:
+    - status: 'True'
+      type: ManagedClusterConditionAvailable
+  clusterSelector:
+    matchExpressions:
+      - key: local-cluster
+        operator: NotIn
+        values:
+          - 'true'
+
+{{- end }}{{/* if (eq (((.Values.global).secretStore).backend) "vault") */}}
+{{- range .Values.clusterGroup.managedClusterGroups }}
+{{- $group := . }}
+{{- if not .hostedArgoSites }}
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  name: hub-argo-ca-{{ .name }}-policy
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+    argocd.argoproj.io/compare-options: IgnoreExtraneous
+spec:
+  remediationAction: enforce
+  disabled: false
+  policy-templates:
+    - objectDefinition:
+        apiVersion: policy.open-cluster-management.io/v1
+        kind: ConfigurationPolicy
+        metadata:
+          name: hub-argo-ca-{{ .name }}-config
+        spec:
+          remediationAction: enforce
+          severity: medium
+          namespaceSelector:
+            include:
+              - default
+          object-templates:
+            - complianceType: mustonlyhave
+              objectDefinition:
+                kind: ConfigMap
+                apiVersion: v1
+                metadata:
+                  name: trusted-hub-bundle
+                  namespace: {{ $.Values.global.pattern }}-{{ .name }}
+                data:
+                  hub-kube-root-ca.crt: |
+                    {{ `{{hub fromConfigMap "" "kube-root-ca.crt" "ca.crt" | autoindent hub}}` }}
+                  hub-openshift-service-ca.crt: |
+                    {{ `{{hub fromConfigMap "" "openshift-service-ca.crt" "service-ca.crt" | autoindent hub}}` }}
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: PlacementBinding
+metadata:
+  name: hub-argo-ca-{{ .name }}-placement-binding
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+placementRef:
+  name: hub-argo-ca-{{ .name }}-placement
+  kind: PlacementRule
+  apiGroup: apps.open-cluster-management.io
+subjects:
+  - name: hub-argo-ca-{{ .name }}-policy
+    kind: Policy
+    apiGroup: policy.open-cluster-management.io
+---
+apiVersion: apps.open-cluster-management.io/v1
+kind: PlacementRule
+metadata:
+  name: hub-argo-ca-{{ .name }}-placement
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  clusterConditions:
+    - status: 'True'
+      type: ManagedClusterConditionAvailable
+  clusterSelector:
+    matchExpressions:
+      - key: local-cluster
+        operator: NotIn
+        values:
+          - 'true'
+{{- end }}{{/* if not .hostedArgoSites */}}
+{{- end }}{{/* range .Values.clusterGroup.managedClusterGroups */}}
+{{- end }}{{/* isHubCluster */}}
diff --git a/common/acm/templates/policies/ocp-gitops-policy.yaml b/common/acm/templates/policies/ocp-gitops-policy.yaml
@@ -113,6 +113,11 @@ spec:
       kind: Policy
       name: openshift-gitops-policy
       namespace: open-cluster-management
+    - apiVersion: policy.open-cluster-management.io/v1
+      compliance: Compliant
+      kind: Policy
+      name: hub-argo-ca-openshift-gitops-policy
+      namespace: open-cluster-management
   policy-templates:
     - objectDefinition:
         apiVersion: policy.open-cluster-management.io/v1
@@ -209,7 +214,7 @@ spec:
                     - command:
                       - bash
                       - -c
-                      - cat /var/run/kube-root-ca/ca.crt /var/run/trusted-ca/ca-bundle.crt > /tmp/ca-bundles/ca-bundle.crt
+                      - cat /var/run/kube-root-ca/ca.crt /var/run/trusted-ca/ca-bundle.crt /var/run/trusted-hub/hub-kube-root-ca.crt > /tmp/ca-bundles/ca-bundle.crt
                         || true
                       image: registry.redhat.io/ubi9/ubi-minimal:latest
                       name: fetch-ca
@@ -219,6 +224,8 @@ spec:
                         name: kube-root-ca
                       - mountPath: /var/run/trusted-ca
                         name: trusted-ca-bundle
+                      - mountPath: /var/run/trusted-hub
+                        name: trusted-hub-bundle
                       - mountPath: /tmp/ca-bundles
                         name: ca-bundles
                     resources:
@@ -239,6 +246,10 @@ spec:
                         name: trusted-ca-bundle
                         optional: true
                       name: trusted-ca-bundle
+                    - configMap:
+                        name: trusted-hub-bundle
+                        optional: true
+                      name: trusted-hub-bundle
                     - emptyDir: {}
                       name: ca-bundles
                   resourceExclusions: |-

diff --git a/common/clustergroup/templates/imperative/_helpers.tpl b/common/clustergroup/templates/imperative/_helpers.tpl
@@ -16,13 +16,15 @@
   - 'sh'
   - '-c'
   - >-
-    cat /var/run/kube-root-ca/ca.crt /var/run/trusted-ca/ca-bundle.crt > /tmp/ca-bundles/ca-bundle.crt || true;
+    cat /var/run/kube-root-ca/ca.crt /var/run/trusted-ca/ca-bundle.crt /var/run/trusted-hub/hub-kube-root-ca.crt > /tmp/ca-bundles/ca-bundle.crt || true;
     ls -l /tmp/ca-bundles/
   volumeMounts:
   - mountPath: /var/run/kube-root-ca
     name: kube-root-ca
   - mountPath: /var/run/trusted-ca
     name: trusted-ca-bundle
+  - mountPath: /var/run/trusted-hub
+    name: trusted-hub-bundle
   - mountPath: /tmp/ca-bundles
     name: ca-bundles
 {{- end }}
@@ -95,25 +97,11 @@
   name: kube-root-ca
 - mountPath: /var/run/trusted-ca
   name: trusted-ca-bundle
+- mountPath: /var/run/trusted-hub
+  name: trusted-hub-bundle
 - mountPath: /tmp/ca-bundles
   name: ca-bundles
 {{- end }}
-{{- define "imperative.volumemounts" }}
-- name: git
-  mountPath: "/git"
-- name: values-volume
-  mountPath: /values/values.yaml
-  subPath: values.yaml
-{{- end }}
-
-{{/* volumes for all containers */}}
-{{- define "imperative.volumes" }}
-- name: git
-  emptyDir: {}
-- name: values-volume
-  configMap:
-    name: {{ $.Values.clusterGroup.imperative.valuesConfigMap }}-{{ $.Values.clusterGroup.name }}
-{{- end }}
 
 {{- define "imperative.volumes_ca" }}
 - name: git
@@ -128,6 +116,10 @@
     name: trusted-ca-bundle
     optional: true
   name: trusted-ca-bundle
+- configMap:
+    name: trusted-hub-bundle
+    optional: true
+  name: trusted-hub-bundle
 - name: ca-bundles
   emptyDir: {}
 {{- end }}
diff --git a/common/clustergroup/templates/plumbing/argocd.yaml b/common/clustergroup/templates/plumbing/argocd.yaml
@@ -36,6 +36,7 @@ spec:
       hs.message = "Waiting for PVC"
       return hs
 
+  resourceTrackingMethod: {{ $.Values.clusterGroup.argoCD.resourceTrackingMethod}}
   applicationInstanceLabelKey: argocd.argoproj.io/instance
   applicationSet:
     resources:
@@ -73,7 +74,7 @@ spec:
     - command:
       - bash
       - -c
-      - cat /var/run/kube-root-ca/ca.crt /var/run/trusted-ca/ca-bundle.crt > /tmp/ca-bundles/ca-bundle.crt || true
+      - cat /var/run/kube-root-ca/ca.crt /var/run/trusted-ca/ca-bundle.crt /var/run/trusted-hub/hub-kube-root-ca.crt > /tmp/ca-bundles/ca-bundle.crt || true
       image: {{ $.Values.clusterGroup.imperative.image }}
       name: fetch-ca
       resources: {}
@@ -82,6 +83,8 @@ spec:
         name: kube-root-ca
       - mountPath: /var/run/trusted-ca
         name: trusted-ca-bundle
+      - mountPath: /var/run/trusted-hub
+        name: trusted-hub-bundle
       - mountPath: /tmp/ca-bundles
         name: ca-bundles
     resources:
@@ -102,6 +105,10 @@ spec:
         name: trusted-ca-bundle
         optional: true
       name: trusted-ca-bundle
+    - configMap:
+        name: trusted-hub-bundle
+        optional: true
+      name: trusted-hub-bundle
     - emptyDir: {}
       name: ca-bundles
 {{- if len $.Values.clusterGroup.argoCD.initContainers }}

diff --git a/common/clustergroup/values.schema.json b/common/clustergroup/values.schema.json
@@ -549,6 +549,15 @@
           "type": "array",
           "description": "A list of initContainers to add to the repo-server if needed"
         },
+        "resourceTrackingMethod": {
+          "type": "string",
+          "description": "ResourceTrackingMethod defines how Argo CD should track resources that it manages",
+          "enum": [
+            "annotation",
+            "label",
+            "annotation+label"
+          ]
+        },
         "resourceExclusions": {
           "type": "string",
           "description": "ResourceExclusions is used to completely ignore entire classes of resource group/kinds."

diff --git a/common/clustergroup/values.yaml b/common/clustergroup/values.yaml
@@ -28,6 +28,8 @@ clusterGroup:
   argoCD:
     initContainers: []
     configManagementPlugins: []
+    # resource tracking can be set to annotation, label, or annotation+label
+    resourceTrackingMethod: label
     resourceHealthChecks:
       - kind: PersistentVolumeClaim
         check: |

diff --git a/common/tests/acm-industrial-edge-factory.expected.yaml b/common/tests/acm-industrial-edge-factory.expected.yaml
@@ -182,6 +182,11 @@ spec:
       kind: Policy
       name: openshift-gitops-policy
       namespace: open-cluster-management
+    - apiVersion: policy.open-cluster-management.io/v1
+      compliance: Compliant
+      kind: Policy
+      name: hub-argo-ca-openshift-gitops-policy
+      namespace: open-cluster-management
   policy-templates:
     - objectDefinition:
         apiVersion: policy.open-cluster-management.io/v1
@@ -278,7 +283,7 @@ spec:
                     - command:
                       - bash
                       - -c
-                      - cat /var/run/kube-root-ca/ca.crt /var/run/trusted-ca/ca-bundle.crt > /tmp/ca-bundles/ca-bundle.crt
+                      - cat /var/run/kube-root-ca/ca.crt /var/run/trusted-ca/ca-bundle.crt /var/run/trusted-hub/hub-kube-root-ca.crt > /tmp/ca-bundles/ca-bundle.crt
                         || true
                       image: registry.redhat.io/ubi9/ubi-minimal:latest
                       name: fetch-ca
@@ -288,6 +293,8 @@ spec:
                         name: kube-root-ca
                       - mountPath: /var/run/trusted-ca
                         name: trusted-ca-bundle
+                      - mountPath: /var/run/trusted-hub
+                        name: trusted-hub-bundle
                       - mountPath: /tmp/ca-bundles
                         name: ca-bundles
                     resources:
@@ -308,6 +315,10 @@ spec:
                         name: trusted-ca-bundle
                         optional: true
                       name: trusted-ca-bundle
+                    - configMap:
+                        name: trusted-hub-bundle
+                        optional: true
+                      name: trusted-hub-bundle
                     - emptyDir: {}
                       name: ca-bundles
                   resourceExclusions: |-