Add ArgoCD keycloak configuration

terraform/main.tf

@@ -40,7 +40,7 @@ module "test_cluster" {
       name            = data.hcloud_location.falkenstein.name,
       datacenter_name = data.hcloud_datacenter.falkenstein.name,
       network_zone    = data.hcloud_location.falkenstein.network_zone
-      }, {
+    }, {
       id              = data.hcloud_location.nuremberg.id,
       name            = data.hcloud_location.nuremberg.name,
       datacenter_name = data.hcloud_datacenter.nuremberg.name,
@@ -61,18 +61,19 @@ module "test_cluster" {
   server_type         = "cax21"
   image_name          = "ubuntu-22.04"
   create_loadbalancer = false
-  loadbalancer_ip     = cidrhost(hcloud_network_subnet.k8s-network-subnet.ip_range, 3)
+  loadbalancer_ip = cidrhost(hcloud_network_subnet.k8s-network-subnet.ip_range, 3)
   vault_service_principal = {
     client_id : var.vault_client_id
     client_secret : var.vault_client_secret
   }
   vault_allowed_namespaces = ["wahlrecht", "timetable", "hcloud", "routing"]
-  hcloud_token_enabled     = false
-  hcloud_token             = var.hcloud_token
-  thanos_enabled           = true
-  thanos_s3_bucket_name    = "2martens-thanos-store"
-  aws_access_key           = var.aws_access_key
-  aws_secret_key           = var.aws_secret_key
+  hcloud_token_enabled          = false
+  hcloud_token                  = var.hcloud_token
+  thanos_enabled                = true
+  thanos_s3_bucket_name         = "2martens-thanos-store"
+  aws_access_key                = var.aws_access_key
+  aws_secret_key                = var.aws_secret_key
+  argocd_keycloak_client_secret = var.argocd_test_keycloak_client_secret
 }
 
 module "monitoring_cluster" {
@@ -91,7 +92,7 @@ module "monitoring_cluster" {
       name            = data.hcloud_location.falkenstein.name,
       datacenter_name = data.hcloud_datacenter.falkenstein.name,
       network_zone    = data.hcloud_location.falkenstein.network_zone
-      }, {
+    }, {
       id              = data.hcloud_location.nuremberg.id,
       name            = data.hcloud_location.nuremberg.name,
       datacenter_name = data.hcloud_datacenter.nuremberg.name,
@@ -110,16 +111,17 @@ module "monitoring_cluster" {
   server_type         = "cax21"
   image_name          = "ubuntu-22.04"
   create_loadbalancer = false
-  loadbalancer_ip     = cidrhost(hcloud_network_subnet.k8s-network-subnet.ip_range, 3)
+  loadbalancer_ip = cidrhost(hcloud_network_subnet.k8s-network-subnet.ip_range, 3)
   vault_service_principal = {
     client_id : var.vault_client_id
     client_secret : var.vault_client_secret
   }
   vault_allowed_namespaces = ["hcloud"]
-  hcloud_token_enabled     = false
-  hcloud_token             = var.hcloud_token
-  thanos_enabled           = true
-  thanos_s3_bucket_name    = "2martens-thanos-store"
-  aws_access_key           = var.aws_access_key
-  aws_secret_key           = var.aws_secret_key
+  hcloud_token_enabled          = false
+  hcloud_token                  = var.hcloud_token
+  thanos_enabled                = true
+  thanos_s3_bucket_name         = "2martens-thanos-store"
+  aws_access_key                = var.aws_access_key
+  aws_secret_key                = var.aws_secret_key
+  argocd_keycloak_client_secret = var.argocd_monitoring_keycloak_client_secret
 }

terraform/modules/k8s-cluster/manager-node.tf

@@ -2,7 +2,7 @@ resource "inwx_nameserver_record" "manager_aaaa" {
   count = var.number_nodes
 
   domain  = var.domain
-  name    = format("%s-%d.%s", "node", count.index, local.kube_api_server_domain)
+  name = format("%s-%d.%s", "node", count.index, local.kube_api_server_domain)
   content = hcloud_server.manager[count.index].ipv6_address
   type    = "AAAA"
   ttl     = 3600
@@ -11,8 +11,8 @@ resource "inwx_nameserver_record" "manager_aaaa" {
 resource "hcloud_primary_ip" "ipv4_manager_address" {
   count = var.create_loadbalancer ? 0 : var.number_nodes
 
-  name          = format("%s_%s_%s_%d", "k8s", var.cluster_name, "ipv4", count.index)
-  datacenter    = element(var.locations.*.datacenter_name, count.index)
+  name = format("%s_%s_%s_%d", "k8s", var.cluster_name, "ipv4", count.index)
+  datacenter = element(var.locations.*.datacenter_name, count.index)
   type          = "ipv4"
   assignee_type = "server"
   auto_delete   = false
@@ -29,8 +29,8 @@ resource "hcloud_rdns" "ipv4_manager" {
 resource "hcloud_primary_ip" "ipv6_manager_address" {
   count = var.number_nodes
 
-  name          = format("%s_%s_%s_%d", "k8s", var.cluster_name, "ipv6", count.index)
-  datacenter    = element(var.locations.*.datacenter_name, count.index)
+  name = format("%s_%s_%s_%d", "k8s", var.cluster_name, "ipv6", count.index)
+  datacenter = element(var.locations.*.datacenter_name, count.index)
   type          = "ipv6"
   assignee_type = "server"
   auto_delete   = false
@@ -55,11 +55,11 @@ resource "hcloud_server_network" "manager_private" {
 resource "hcloud_server" "manager" {
   count = var.number_nodes
 
-  name                    = format("%s-%s-%s-%d", "k8s", var.cluster_name, "node", count.index)
+  name = format("%s-%s-%s-%d", "k8s", var.cluster_name, "node", count.index)
   image                   = var.image_name
   allow_deprecated_images = false
   server_type             = var.server_type
-  location                = element(var.locations.*.name, count.index)
+  location = element(var.locations.*.name, count.index)
 
   public_net {
     ipv4_enabled = var.create_loadbalancer ? false : true
@@ -71,8 +71,8 @@ resource "hcloud_server" "manager" {
   ignore_remote_firewall_ids = false
   keep_disk                  = false
   placement_group_id         = data.hcloud_placement_group.default.id
-  firewall_ids               = [var.basic_firewall_id, var.k8s_firewall_id]
-  ssh_keys                   = [var.admin_ssh_key.id]
+  firewall_ids = [var.basic_firewall_id, var.k8s_firewall_id]
+  ssh_keys = [var.admin_ssh_key.id]
   shutdown_before_deletion   = true
 
   labels = {
@@ -90,7 +90,8 @@ resource "hcloud_server" "manager" {
       api_server_domain : local.kube_api_server_domain
       main_node : count.index == 0
       main_node_ip : var.private_node_ips[0]
-      api_server_ip : var.create_loadbalancer ? hcloud_load_balancer.kubernetes[0].ipv4 : hcloud_primary_ip.ipv4_manager_address[0].ip_address
+      api_server_ip : var.create_loadbalancer ? hcloud_load_balancer.kubernetes[0].ipv4 :
+        hcloud_primary_ip.ipv4_manager_address[0].ip_address
       cluster_token : random_id.cluster_token.hex
     }))
     snapcraft : base64encode(file("${path.module}/templates/snap/snapcraft.yaml"))
@@ -124,8 +125,12 @@ resource "hcloud_server" "manager" {
       aws_access_key : var.aws_access_key
       aws_secret_key : var.aws_secret_key
     }))
-    argocd_ha_values : base64encode(file("${path.module}/templates/helm/argocd-values-ha.yaml"))
-    argocd_values : base64encode(file("${path.module}/templates/helm/argocd-values.yaml"))
+    argocd_ha_values : base64encode(templatefile("${path.module}/templates/helm/argocd-values-ha.yaml", {
+      argocd_keycloak_client_secret : var.argocd_keycloak_client_secret
+    }))
+    argocd_values : base64encode(templatefile("${path.module}/templates/helm/argocd-values.yaml", {
+      argocd_keycloak_client_secret : var.argocd_keycloak_client_secret
+    }))
     cluster_setup : base64encode(templatefile("${path.module}/templates/scripts/cluster-setup.sh", {
       argocd_environment : var.argocd_environment
       high_availability : var.number_nodes > 2
@@ -139,7 +144,7 @@ resource "hcloud_server" "manager" {
   network {
     network_id = var.network_id
     ip         = var.private_node_ips[count.index]
-    alias_ips  = []
+    alias_ips = []
   }
 
   lifecycle {

terraform/modules/k8s-cluster/templates/helm/argocd-values-ha.yaml

@@ -2,6 +2,21 @@ global:
   logging:
     format: text
 
+configs:
+  cm:
+    oidc.config: |
+      name: Keycloak
+      issuer: https://id.2martens.de/realms/2martens
+      clientID: argocd-test-oauth
+      clientSecret: $oidc.keycloak.clientSecret
+      requestedScopes: ["openid", "profile", "email", "groups"]
+  rbac:
+    policy.csv: |
+      g, ArgoCDAdmins, role:admin
+  secret:
+    extra:
+      oidc.keycloak.clientSecret: ${argocd_keycloak_client_secret}
+
 applicationSet:
   replicas: 2
   resources:

terraform/modules/k8s-cluster/templates/helm/argocd-values.yaml

@@ -1,6 +1,20 @@
 global:
   logging:
     format: text
+configs:
+  cm:
+    oidc.config: |
+      name: Keycloak
+      issuer: https://id.2martens.de/realms/2martens
+      clientID: argocd-test-oauth
+      clientSecret: $oidc.keycloak.clientSecret
+      requestedScopes: ["openid", "profile", "email", "groups"]
+  rbac:
+    policy.csv: |
+      g, ArgoCDAdmins, role:admin
+  secret:
+    extra:
+      oidc.keycloak.clientSecret: ${argocd_keycloak_client_secret}
 applicationSet:
   resources:
    limits:

terraform/modules/k8s-cluster/variables.tf

@@ -205,4 +205,10 @@ variable "aws_secret_key" {
   type        = string
   default     = ""
   sensitive   = true
-}
+}
+variable "argocd_keycloak_client_secret" {
+  description = "Client secret for Keycloak client of Argo CD"
+  type        = string
+  default     = ""
+  sensitive   = true
+}

terraform/variables.tf

@@ -69,4 +69,14 @@ variable "aws_secret_key" {
   description = "Secret key for AWS"
   type        = string
   sensitive   = true
+}
+variable "argocd_test_keycloak_client_secret" {
+  description = "Client secret for ArgoCD test Keycloak client"
+  type        = string
+  sensitive   = true
+}
+variable "argocd_monitoring_keycloak_client_secret" {
+  description = "Client secret for ArgoCD monitoring Keycloak client"
+  type        = string
+  sensitive   = true
 }