Will Anderson
163 lines
4.1 KiB
Terraform
163 lines
4.1 KiB
Terraform
# Argo CD — GitOps controller watching will/infrastructure on Gitea
|
|
# App manifests live in: servers/legion/apps/
|
|
|
|
resource "kubernetes_namespace" "argocd" {
|
|
metadata {
|
|
name = "argocd"
|
|
labels = {
|
|
managed-by = "terraform"
|
|
tier = "infrastructure"
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "helm_release" "argocd" {
|
|
name = "argocd"
|
|
namespace = kubernetes_namespace.argocd.metadata[0].name
|
|
repository = "https://argoproj.github.io/argo-helm"
|
|
chart = "argo-cd"
|
|
version = "7.8.0"
|
|
|
|
values = [<<-YAML
|
|
global:
|
|
domain: argocd.${var.infra_domain}
|
|
|
|
server:
|
|
ingress:
|
|
enabled: true
|
|
ingressClassName: traefik
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
tls: true
|
|
|
|
configs:
|
|
params:
|
|
server.insecure: true # TLS terminated at Traefik
|
|
repositories:
|
|
gitea-infrastructure:
|
|
url: https://git.neuralplatform.ai/will/infrastructure.git
|
|
name: infrastructure
|
|
type: git
|
|
YAML
|
|
]
|
|
|
|
depends_on = [kubernetes_namespace.argocd, helm_release.cert_manager]
|
|
}
|
|
|
|
resource "kubernetes_ingress_v1" "argocd" {
|
|
metadata {
|
|
name = "argocd"
|
|
namespace = kubernetes_namespace.argocd.metadata[0].name
|
|
annotations = {
|
|
"traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
|
|
"cert-manager.io/cluster-issuer" = "letsencrypt-prod"
|
|
}
|
|
}
|
|
|
|
spec {
|
|
tls {
|
|
hosts = ["argocd.${var.infra_domain}"]
|
|
secret_name = "argocd-tls"
|
|
}
|
|
|
|
rule {
|
|
host = "argocd.${var.infra_domain}"
|
|
http {
|
|
path {
|
|
path = "/"
|
|
path_type = "Prefix"
|
|
backend {
|
|
service {
|
|
name = "argocd-server"
|
|
port {
|
|
number = 80
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
depends_on = [helm_release.argocd, helm_release.cert_manager]
|
|
}
|
|
|
|
# Gitea repo credentials for Argo CD (internal cluster IP)
|
|
# Label argocd.argoproj.io/secret-type=repository tells Argo CD to use this as a repo credential
|
|
resource "kubernetes_secret" "argocd_gitea_repo" {
|
|
metadata {
|
|
name = "argocd-repo-gitea-infrastructure"
|
|
namespace = kubernetes_namespace.argocd.metadata[0].name
|
|
labels = {
|
|
"argocd.argoproj.io/secret-type" = "repository"
|
|
}
|
|
}
|
|
|
|
data = {
|
|
type = "git"
|
|
url = "https://git.neuralplatform.ai/will/infrastructure.git"
|
|
username = "will"
|
|
password = var.gitea_api_token
|
|
}
|
|
|
|
depends_on = [helm_release.argocd]
|
|
}
|
|
|
|
# Gitea repo credentials via public hostname (for apps referencing git.neuralplatform.ai)
|
|
resource "kubernetes_secret" "argocd_gitea_repo_public" {
|
|
metadata {
|
|
name = "argocd-repo-gitea-infrastructure-public"
|
|
namespace = kubernetes_namespace.argocd.metadata[0].name
|
|
labels = {
|
|
"argocd.argoproj.io/secret-type" = "repository"
|
|
}
|
|
}
|
|
|
|
data = {
|
|
type = "git"
|
|
url = "https://git.neuralplatform.ai/will/infrastructure.git"
|
|
username = "will"
|
|
password = var.gitea_api_token
|
|
}
|
|
|
|
depends_on = [helm_release.argocd]
|
|
}
|
|
|
|
# Root application — watches servers/legion/apps/ for app manifests
|
|
resource "kubernetes_manifest" "argocd_root_app" {
|
|
manifest = {
|
|
apiVersion = "argoproj.io/v1alpha1"
|
|
kind = "Application"
|
|
metadata = {
|
|
name = "legion-apps"
|
|
namespace = kubernetes_namespace.argocd.metadata[0].name
|
|
}
|
|
spec = {
|
|
project = "default"
|
|
source = {
|
|
repoURL = "https://git.neuralplatform.ai/will/infrastructure.git"
|
|
targetRevision = "main"
|
|
path = "servers/legion/apps"
|
|
}
|
|
destination = {
|
|
server = "https://kubernetes.default.svc"
|
|
namespace = "argocd"
|
|
}
|
|
syncPolicy = {
|
|
automated = {
|
|
prune = true
|
|
selfHeal = true
|
|
}
|
|
syncOptions = ["CreateNamespace=true"]
|
|
}
|
|
}
|
|
}
|
|
|
|
field_manager {
|
|
force_conflicts = true
|
|
}
|
|
|
|
depends_on = [helm_release.argocd, kubernetes_secret.argocd_gitea_repo]
|
|
}
|