From 8f8d78a9092b0bc4bb282f6b59019d2cd46c2f0f Mon Sep 17 00:00:00 2001 From: Jim Martens Date: Mon, 9 Sep 2024 13:22:33 +0200 Subject: [PATCH] Add ArgoCD keycloak configuration --- terraform/main.tf | 34 ++++++++++--------- terraform/modules/k8s-cluster/manager-node.tf | 31 ++++++++++------- .../templates/helm/argocd-values-ha.yaml | 15 ++++++++ .../templates/helm/argocd-values.yaml | 14 ++++++++ terraform/modules/k8s-cluster/variables.tf | 8 ++++- terraform/variables.tf | 10 ++++++ 6 files changed, 82 insertions(+), 30 deletions(-) diff --git a/terraform/main.tf b/terraform/main.tf index 7d51c35..fdc07ee 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -40,7 +40,7 @@ module "test_cluster" { name = data.hcloud_location.falkenstein.name, datacenter_name = data.hcloud_datacenter.falkenstein.name, network_zone = data.hcloud_location.falkenstein.network_zone - }, { + }, { id = data.hcloud_location.nuremberg.id, name = data.hcloud_location.nuremberg.name, datacenter_name = data.hcloud_datacenter.nuremberg.name, @@ -61,18 +61,19 @@ module "test_cluster" { server_type = "cax21" image_name = "ubuntu-22.04" create_loadbalancer = false - loadbalancer_ip = cidrhost(hcloud_network_subnet.k8s-network-subnet.ip_range, 3) + loadbalancer_ip = cidrhost(hcloud_network_subnet.k8s-network-subnet.ip_range, 3) vault_service_principal = { client_id : var.vault_client_id client_secret : var.vault_client_secret } vault_allowed_namespaces = ["wahlrecht", "timetable", "hcloud", "routing"] - hcloud_token_enabled = false - hcloud_token = var.hcloud_token - thanos_enabled = true - thanos_s3_bucket_name = "2martens-thanos-store" - aws_access_key = var.aws_access_key - aws_secret_key = var.aws_secret_key + hcloud_token_enabled = false + hcloud_token = var.hcloud_token + thanos_enabled = true + thanos_s3_bucket_name = "2martens-thanos-store" + aws_access_key = var.aws_access_key + aws_secret_key = var.aws_secret_key + argocd_keycloak_client_secret = var.argocd_test_keycloak_client_secret } module "monitoring_cluster" { @@ -91,7 +92,7 @@ module "monitoring_cluster" { name = data.hcloud_location.falkenstein.name, datacenter_name = data.hcloud_datacenter.falkenstein.name, network_zone = data.hcloud_location.falkenstein.network_zone - }, { + }, { id = data.hcloud_location.nuremberg.id, name = data.hcloud_location.nuremberg.name, datacenter_name = data.hcloud_datacenter.nuremberg.name, @@ -110,16 +111,17 @@ module "monitoring_cluster" { server_type = "cax21" image_name = "ubuntu-22.04" create_loadbalancer = false - loadbalancer_ip = cidrhost(hcloud_network_subnet.k8s-network-subnet.ip_range, 3) + loadbalancer_ip = cidrhost(hcloud_network_subnet.k8s-network-subnet.ip_range, 3) vault_service_principal = { client_id : var.vault_client_id client_secret : var.vault_client_secret } vault_allowed_namespaces = ["hcloud"] - hcloud_token_enabled = false - hcloud_token = var.hcloud_token - thanos_enabled = true - thanos_s3_bucket_name = "2martens-thanos-store" - aws_access_key = var.aws_access_key - aws_secret_key = var.aws_secret_key + hcloud_token_enabled = false + hcloud_token = var.hcloud_token + thanos_enabled = true + thanos_s3_bucket_name = "2martens-thanos-store" + aws_access_key = var.aws_access_key + aws_secret_key = var.aws_secret_key + argocd_keycloak_client_secret = var.argocd_monitoring_keycloak_client_secret } \ No newline at end of file diff --git a/terraform/modules/k8s-cluster/manager-node.tf b/terraform/modules/k8s-cluster/manager-node.tf index 9f0123a..49ce983 100644 --- a/terraform/modules/k8s-cluster/manager-node.tf +++ b/terraform/modules/k8s-cluster/manager-node.tf @@ -2,7 +2,7 @@ resource "inwx_nameserver_record" "manager_aaaa" { count = var.number_nodes domain = var.domain - name = format("%s-%d.%s", "node", count.index, local.kube_api_server_domain) + name = format("%s-%d.%s", "node", count.index, local.kube_api_server_domain) content = hcloud_server.manager[count.index].ipv6_address type = "AAAA" ttl = 3600 @@ -11,8 +11,8 @@ resource "inwx_nameserver_record" "manager_aaaa" { resource "hcloud_primary_ip" "ipv4_manager_address" { count = var.create_loadbalancer ? 0 : var.number_nodes - name = format("%s_%s_%s_%d", "k8s", var.cluster_name, "ipv4", count.index) - datacenter = element(var.locations.*.datacenter_name, count.index) + name = format("%s_%s_%s_%d", "k8s", var.cluster_name, "ipv4", count.index) + datacenter = element(var.locations.*.datacenter_name, count.index) type = "ipv4" assignee_type = "server" auto_delete = false @@ -29,8 +29,8 @@ resource "hcloud_rdns" "ipv4_manager" { resource "hcloud_primary_ip" "ipv6_manager_address" { count = var.number_nodes - name = format("%s_%s_%s_%d", "k8s", var.cluster_name, "ipv6", count.index) - datacenter = element(var.locations.*.datacenter_name, count.index) + name = format("%s_%s_%s_%d", "k8s", var.cluster_name, "ipv6", count.index) + datacenter = element(var.locations.*.datacenter_name, count.index) type = "ipv6" assignee_type = "server" auto_delete = false @@ -55,11 +55,11 @@ resource "hcloud_server_network" "manager_private" { resource "hcloud_server" "manager" { count = var.number_nodes - name = format("%s-%s-%s-%d", "k8s", var.cluster_name, "node", count.index) + name = format("%s-%s-%s-%d", "k8s", var.cluster_name, "node", count.index) image = var.image_name allow_deprecated_images = false server_type = var.server_type - location = element(var.locations.*.name, count.index) + location = element(var.locations.*.name, count.index) public_net { ipv4_enabled = var.create_loadbalancer ? false : true @@ -71,8 +71,8 @@ resource "hcloud_server" "manager" { ignore_remote_firewall_ids = false keep_disk = false placement_group_id = data.hcloud_placement_group.default.id - firewall_ids = [var.basic_firewall_id, var.k8s_firewall_id] - ssh_keys = [var.admin_ssh_key.id] + firewall_ids = [var.basic_firewall_id, var.k8s_firewall_id] + ssh_keys = [var.admin_ssh_key.id] shutdown_before_deletion = true labels = { @@ -90,7 +90,8 @@ resource "hcloud_server" "manager" { api_server_domain : local.kube_api_server_domain main_node : count.index == 0 main_node_ip : var.private_node_ips[0] - api_server_ip : var.create_loadbalancer ? hcloud_load_balancer.kubernetes[0].ipv4 : hcloud_primary_ip.ipv4_manager_address[0].ip_address + api_server_ip : var.create_loadbalancer ? hcloud_load_balancer.kubernetes[0].ipv4 : + hcloud_primary_ip.ipv4_manager_address[0].ip_address cluster_token : random_id.cluster_token.hex })) snapcraft : base64encode(file("${path.module}/templates/snap/snapcraft.yaml")) @@ -124,8 +125,12 @@ resource "hcloud_server" "manager" { aws_access_key : var.aws_access_key aws_secret_key : var.aws_secret_key })) - argocd_ha_values : base64encode(file("${path.module}/templates/helm/argocd-values-ha.yaml")) - argocd_values : base64encode(file("${path.module}/templates/helm/argocd-values.yaml")) + argocd_ha_values : base64encode(templatefile("${path.module}/templates/helm/argocd-values-ha.yaml", { + argocd_keycloak_client_secret : var.argocd_keycloak_client_secret + })) + argocd_values : base64encode(templatefile("${path.module}/templates/helm/argocd-values.yaml", { + argocd_keycloak_client_secret : var.argocd_keycloak_client_secret + })) cluster_setup : base64encode(templatefile("${path.module}/templates/scripts/cluster-setup.sh", { argocd_environment : var.argocd_environment high_availability : var.number_nodes > 2 @@ -139,7 +144,7 @@ resource "hcloud_server" "manager" { network { network_id = var.network_id ip = var.private_node_ips[count.index] - alias_ips = [] + alias_ips = [] } lifecycle { diff --git a/terraform/modules/k8s-cluster/templates/helm/argocd-values-ha.yaml b/terraform/modules/k8s-cluster/templates/helm/argocd-values-ha.yaml index c1259b4..a5c264f 100644 --- a/terraform/modules/k8s-cluster/templates/helm/argocd-values-ha.yaml +++ b/terraform/modules/k8s-cluster/templates/helm/argocd-values-ha.yaml @@ -2,6 +2,21 @@ global: logging: format: text +configs: + cm: + oidc.config: | + name: Keycloak + issuer: https://id.2martens.de/realms/2martens + clientID: argocd-test-oauth + clientSecret: $oidc.keycloak.clientSecret + requestedScopes: ["openid", "profile", "email", "groups"] + rbac: + policy.csv: | + g, ArgoCDAdmins, role:admin + secret: + extra: + oidc.keycloak.clientSecret: ${argocd_keycloak_client_secret} + applicationSet: replicas: 2 resources: diff --git a/terraform/modules/k8s-cluster/templates/helm/argocd-values.yaml b/terraform/modules/k8s-cluster/templates/helm/argocd-values.yaml index 792e5c6..8bea405 100644 --- a/terraform/modules/k8s-cluster/templates/helm/argocd-values.yaml +++ b/terraform/modules/k8s-cluster/templates/helm/argocd-values.yaml @@ -1,6 +1,20 @@ global: logging: format: text +configs: + cm: + oidc.config: | + name: Keycloak + issuer: https://id.2martens.de/realms/2martens + clientID: argocd-test-oauth + clientSecret: $oidc.keycloak.clientSecret + requestedScopes: ["openid", "profile", "email", "groups"] + rbac: + policy.csv: | + g, ArgoCDAdmins, role:admin + secret: + extra: + oidc.keycloak.clientSecret: ${argocd_keycloak_client_secret} applicationSet: resources: limits: diff --git a/terraform/modules/k8s-cluster/variables.tf b/terraform/modules/k8s-cluster/variables.tf index 9740a26..b272c53 100644 --- a/terraform/modules/k8s-cluster/variables.tf +++ b/terraform/modules/k8s-cluster/variables.tf @@ -205,4 +205,10 @@ variable "aws_secret_key" { type = string default = "" sensitive = true -} \ No newline at end of file +} +variable "argocd_keycloak_client_secret" { + description = "Client secret for Keycloak client of Argo CD" + type = string + default = "" + sensitive = true +} diff --git a/terraform/variables.tf b/terraform/variables.tf index dff7ac6..92c9822 100644 --- a/terraform/variables.tf +++ b/terraform/variables.tf @@ -69,4 +69,14 @@ variable "aws_secret_key" { description = "Secret key for AWS" type = string sensitive = true +} +variable "argocd_test_keycloak_client_secret" { + description = "Client secret for ArgoCD test Keycloak client" + type = string + sensitive = true +} +variable "argocd_monitoring_keycloak_client_secret" { + description = "Client secret for ArgoCD monitoring Keycloak client" + type = string + sensitive = true } \ No newline at end of file