feat: refactor resources

Signed-off-by: Mateusz Urbanek <[email protected]>
anza-labs · Aug 7, 2024 · 6c84a66 · 6c84a66
1 parent 2767fd9
commit 6c84a66
Show file tree

Hide file tree

Showing 14 changed files with 239 additions and 0 deletions.
diff --git a/certificates/bitwarden-tls/CertManager.yaml b/certificates/bitwarden-tls/CertManager.yaml
@@ -0,0 +1,67 @@
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: bitwarden-bootstrap-issuer
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: bitwarden-bootstrap-certificate
+  namespace: cert-manager
+spec:
+  # this is discouraged but required by ios
+  commonName: cert-manager-bitwarden-tls
+  isCA: true
+  secretName: bitwarden-tls-certs
+  subject:
+    organizations:
+      - external-secrets.io
+  dnsNames:
+    - external-secrets-bitwarden-sdk-server.default.svc.cluster.local
+    - bitwarden-sdk-server.default.svc.cluster.local
+    - localhost
+  ipAddresses:
+    - 127.0.0.1
+    - ::1
+  privateKey:
+    algorithm: RSA
+    encoding: PKCS8
+    size: 2048
+  issuerRef:
+    name: bitwarden-bootstrap-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: bitwarden-certificate-issuer
+spec:
+  ca:
+    secretName: bitwarden-tls-certs
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: bitwarden-tls-certs
+  namespace: external-secrets
+spec:
+  secretName: bitwarden-tls-certs
+  dnsNames:
+    - bitwarden-sdk-server.default.svc.cluster.local
+    - external-secrets-bitwarden-sdk-server.default.svc.cluster.local
+    - localhost
+  ipAddresses:
+    - 127.0.0.1
+    - ::1
+  privateKey:
+    algorithm: RSA
+    encoding: PKCS8
+    size: 2048
+  issuerRef:
+    name: bitwarden-certificate-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io
diff --git a/certificates/bitwarden-tls/kustomization.yaml b/certificates/bitwarden-tls/kustomization.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./CertManager.yaml
diff --git a/clusters/lke/core/cert-manager/HelmRelease.yaml b/clusters/lke/core/cert-manager/HelmRelease.yaml
@@ -0,0 +1,24 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  chart:
+    spec:
+      chart: cert-manager
+      reconcileStrategy: ChartVersion
+      sourceRef:
+        kind: HelmRepository
+        name: jetstack
+      version: "v1.15.1"
+  interval: 1m0s
+  releaseName: cert-manager
+  targetNamespace: cert-manager
+  install:
+    crds: CreateReplace
+  upgrade:
+    crds: CreateReplace
+  values:
+    installCRDs: true
diff --git a/clusters/lke/core/cert-manager/HelmRepository.yaml b/clusters/lke/core/cert-manager/HelmRepository.yaml
@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: jetstack
+  namespace: cert-manager
+spec:
+  interval: 5m0s
+  url: https://charts.jetstack.io
diff --git a/clusters/lke/core/cert-manager/Namespace.yaml b/clusters/lke/core/cert-manager/Namespace.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
diff --git a/clusters/lke/core/external-secrets/CustomResources.yaml b/clusters/lke/core/external-secrets/CustomResources.yaml
@@ -0,0 +1,30 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: certificates-bitwarden-tls
+  namespace: external-secrets
+spec:
+  interval: 10m0s
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  path: "./certificates/bitwarden-tls"
+  prune: true
+  timeout: 10m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: secrets-bitwarden
+  namespace: external-secrets
+spec:
+  interval: 10m0s
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  path: "./secrets/bitwarden"
+  prune: true
+  timeout: 10m
diff --git a/clusters/lke/core/external-secrets/HelmRelease.yaml b/clusters/lke/core/external-secrets/HelmRelease.yaml
@@ -0,0 +1,25 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: external-secrets
+  namespace: external-secrets
+spec:
+  chart:
+    spec:
+      chart: external-secrets
+      reconcileStrategy: ChartVersion
+      sourceRef:
+        kind: HelmRepository
+        name: external-secrets
+      version: "0.9.20"
+  interval: 1m0s
+  releaseName: external-secrets
+  targetNamespace: external-secrets
+  install:
+    crds: CreateReplace
+  upgrade:
+    crds: CreateReplace
+  values:
+    bitwarden-sdk-server:
+      enabled: true
diff --git a/clusters/lke/core/external-secrets/HelmRepository.yaml b/clusters/lke/core/external-secrets/HelmRepository.yaml
@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: external-secrets
+  namespace: external-secrets
+spec:
+  interval: 5m0s
+  url: https://charts.external-secrets.io
diff --git a/clusters/lke/core/external-secrets/Namespace.yaml b/clusters/lke/core/external-secrets/Namespace.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: external-secrets
diff --git a/clusters/lke/core/ingress-nginx/HelmRelease.yaml b/clusters/lke/core/ingress-nginx/HelmRelease.yaml
@@ -0,0 +1,22 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ingress-nginx
+  namespace: kube-system
+spec:
+  chart:
+    spec:
+      chart: ingress-nginx
+      reconcileStrategy: ChartVersion
+      sourceRef:
+        kind: HelmRepository
+        name: ingress-nginx
+      version: "4.10.1"
+  interval: 1m0s
+  releaseName: ingress-nginx
+  targetNamespace: kube-system
+  install:
+    crds: CreateReplace
+  upgrade:
+    crds: CreateReplace
diff --git a/clusters/lke/core/ingress-nginx/HelmRepository.yaml b/clusters/lke/core/ingress-nginx/HelmRepository.yaml
@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: ingress-nginx
+  namespace: kube-system
+spec:
+  interval: 5m0s
+  url: https://kubernetes.github.io/ingress-nginx
diff --git a/scripts/flux.sh b/scripts/flux.sh
@@ -4,6 +4,11 @@ set -e
 set -o pipefail
 
 X_NAME="${1:-kubernetes}"
+BW_TOKEN="${2}"
+
+kubectl create secret generic bitwarden \
+    --namespace=kube-system \
+    --from-literal=token="${BW_TOKEN}"
 
 flux bootstrap github \
     --token-auth \

diff --git a/secrets/bitwarden/ClusterSecretStore.yaml b/secrets/bitwarden/ClusterSecretStore.yaml
@@ -0,0 +1,21 @@
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: bitwarden-secretsmanager
+  namespace: external-secrets
+spec:
+  provider:
+    bitwardensecretsmanager:
+      apiURL: https://vault.bitwarden.com
+      identityURL: https://identity.bitwarden.com
+      auth:
+        secretRef:
+          credentials:
+            name: bitwarden
+            namespace: kube-system
+            key: token
+      bitwardenServerSDKURL: https://bitwarden-sdk-server.default.svc.cluster.local:9998
+      caBundle: ''
+      organizationID: 554098a1-1b76-4d11-89d1-b1c500b11b2e
+      projectID: 2728ee07-5f6d-4c5c-97d8-b1c500b28bb9
diff --git a/secrets/bitwarden/kustomization.yaml b/secrets/bitwarden/kustomization.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./SecretStore.yaml