123 lines
3.2 KiB
YAML
123 lines
3.2 KiB
YAML
global:
|
|
domain: "argocd.k8s.hnrx.net"
|
|
|
|
extraObjects:
|
|
- apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: argocd-gateway
|
|
labels:
|
|
bgp.cilium.io/ip-pool: default # Damit bekommt das Gateway eine IP aus deinem Pool
|
|
annotations:
|
|
# Damit external-dns diesen Gateway findet und einen DNS-Eintrag erstellt
|
|
# (falls external-dns Gateway API unterstützt, was es tut)
|
|
cert-manager.io/cluster-issuer: cloudflare-cluster-issuer
|
|
spec:
|
|
gatewayClassName: cilium
|
|
listeners:
|
|
- name: argocd-http
|
|
hostname: "argocd.k8s.hnrx.net"
|
|
protocol: HTTP
|
|
port: 80
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
- name: argocd-https
|
|
hostname: "argocd.k8s.hnrx.net"
|
|
protocol: HTTPS
|
|
port: 443
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
tls:
|
|
certificateRefs:
|
|
- kind: Secret
|
|
name: argocd-gateway-tls
|
|
|
|
- apiVersion: secrets.phase.dev/v1alpha1
|
|
kind: PhaseSecret
|
|
metadata:
|
|
name: argocd-phase-secret
|
|
labels:
|
|
app.kubernetes.io/part-of: argocd
|
|
spec:
|
|
phaseApp: 'argocd' # The name of your Phase application
|
|
phaseAppEnv: 'production' # OPTIONAL - The Phase App Environment to fetch secrets from
|
|
phaseAppEnvPath: '/' # OPTIONAL Path within the Phase application environment to fetch secrets from
|
|
phaseHost: 'https://phase.hnrx.net' # OPTIONAL - URL of a Phase Console instance
|
|
authentication:
|
|
serviceToken:
|
|
serviceTokenSecretReference:
|
|
secretName: 'phase-service-token' # Name of the Phase Service Token with access to your application
|
|
secretNamespace: 'default'
|
|
managedSecretReferences:
|
|
- secretName: 'argocd-authentik-client-secret' # Name of the Kubernetes managed secret that Phase will sync
|
|
secretNamespace: 'argocd'
|
|
|
|
configs:
|
|
cm:
|
|
url: https://argocd.k8s.hnrx.net
|
|
dex.config: |
|
|
connectors:
|
|
- config:
|
|
issuer: $AUTHENTIK_ISSUER_URL
|
|
clientID: $AUTHENTIK_CLIENT_ID
|
|
clientSecret: $AUTHENTIK_CLIENT_SECRET
|
|
insecureEnableGroups: true
|
|
scopes:
|
|
- openid
|
|
- profile
|
|
- email
|
|
name: authentik
|
|
type: oidc
|
|
id: authentik
|
|
|
|
params:
|
|
server.insecure: true
|
|
rbac:
|
|
policy.csv: |
|
|
g, ArgoCD Admins, role:admin
|
|
g, ArgoCD Viewers, role:readonly
|
|
secret:
|
|
extra:
|
|
dex.authentik.clientSecret: $AUTHENTIK_CLIENT_SECRET
|
|
cmp:
|
|
credentialTemplates:
|
|
https-creds:
|
|
url: https://git.hnrx.net
|
|
username: $GIT_USER
|
|
password: $GIT_PASSWORD
|
|
|
|
|
|
dex:
|
|
envFrom:
|
|
- secretRef:
|
|
name: argocd-authentik-client-secret
|
|
|
|
server:
|
|
|
|
httproute:
|
|
enabled: true
|
|
parentRefs:
|
|
- name: argocd-gateway
|
|
hostnames:
|
|
- "argocd.k8s.hnrx.net"
|
|
|
|
repoServer:
|
|
resources:
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
|
|
controller:
|
|
resources:
|
|
limits:
|
|
cpu: 2000m
|
|
memory: 2Gi
|
|
requests:
|
|
cpu: 500m
|
|
memory: 512Mi
|