diff --git a/charts/hub/acs/central/templates/integration/policy-acs-integrations-token.yaml b/charts/hub/acs/central/templates/integration/policy-acs-integrations-token.yaml index f51c00fc..f6f1cc7d 100644 --- a/charts/hub/acs/central/templates/integration/policy-acs-integrations-token.yaml +++ b/charts/hub/acs/central/templates/integration/policy-acs-integrations-token.yaml @@ -1,3 +1,4 @@ +{{ if .Values.global.acm }} {{- if $.Values.acs.integrations }} apiVersion: policy.open-cluster-management.io/v1 kind: Policy @@ -66,3 +67,4 @@ spec: - status: 'True' type: ManagedClusterConditionAvailable {{- end }} +{{ end }} diff --git a/charts/hub/acs/central/templates/policy/policy-acs-central-status.yaml b/charts/hub/acs/central/templates/policy/policy-acs-central-status.yaml index 8c19da5c..5e08271c 100644 --- a/charts/hub/acs/central/templates/policy/policy-acs-central-status.yaml +++ b/charts/hub/acs/central/templates/policy/policy-acs-central-status.yaml @@ -1,3 +1,4 @@ +{{ if .Values.global.acm }} apiVersion: policy.open-cluster-management.io/v1 kind: Policy metadata: @@ -55,4 +56,5 @@ spec: - status: "True" type: Available remediationAction: inform - severity: medium \ No newline at end of file + severity: medium +{{ end }} \ No newline at end of file diff --git a/charts/hub/acs/central/templates/policy/policy-acs-secured-status.yaml b/charts/hub/acs/central/templates/policy/policy-acs-secured-status.yaml index 43fb247c..841db303 100644 --- a/charts/hub/acs/central/templates/policy/policy-acs-secured-status.yaml +++ b/charts/hub/acs/central/templates/policy/policy-acs-secured-status.yaml @@ -1,3 +1,4 @@ +{{ if .Values.global.acm }} apiVersion: policy.open-cluster-management.io/v1 kind: Policy metadata: @@ -42,4 +43,5 @@ spec: status: numberMisscheduled: 0 remediationAction: inform - severity: medium \ No newline at end of file + severity: medium +{{ end }} \ No newline at end of file diff --git a/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-binding.yaml b/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-binding.yaml index 152477e1..aae2b30e 100644 --- a/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-binding.yaml +++ b/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-binding.yaml @@ -1,3 +1,4 @@ +{{ if .Values.global.acm }} apiVersion: policy.open-cluster-management.io/v1 kind: PlacementBinding metadata: @@ -12,4 +13,5 @@ placementRef: subjects: - name: secured-cluster-secret-policy kind: Policy - apiGroup: policy.open-cluster-management.io \ No newline at end of file + apiGroup: policy.open-cluster-management.io +{{ end }} \ No newline at end of file diff --git a/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-rule.yaml b/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-rule.yaml index 528ab5a3..45628292 100644 --- a/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-rule.yaml +++ b/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-rule.yaml @@ -1,3 +1,4 @@ +{{ if $.Values.global.acm }} apiVersion: apps.open-cluster-management.io/v1 kind: PlacementRule metadata: @@ -9,4 +10,5 @@ spec: # This will go to all managed clusters clusterConditions: - status: 'True' - type: ManagedClusterConditionAvailable \ No newline at end of file + type: ManagedClusterConditionAvailable +{{ end }} \ No newline at end of file diff --git a/charts/hub/acs/central/templates/policy/secured-cluster-secret-policy.yaml b/charts/hub/acs/central/templates/policy/secured-cluster-secret-policy.yaml index e3421664..9be0c919 100644 --- a/charts/hub/acs/central/templates/policy/secured-cluster-secret-policy.yaml +++ b/charts/hub/acs/central/templates/policy/secured-cluster-secret-policy.yaml @@ -1,3 +1,4 @@ +{{ if .Values.global.acm }} apiVersion: policy.open-cluster-management.io/v1 kind: Policy metadata: @@ -91,3 +92,4 @@ spec: name: scanner-db-tls namespace: stackrox type: Opaque +{{ end }} \ No newline at end of file diff --git a/charts/hub/external-secrets/templates/policy-git-secret.yaml b/charts/hub/external-secrets/templates/policy-git-secret.yaml index a7e65e10..e28d8893 100644 --- a/charts/hub/external-secrets/templates/policy-git-secret.yaml +++ b/charts/hub/external-secrets/templates/policy-git-secret.yaml @@ -1,3 +1,4 @@ +{{ if .Values.global.acm }} # The policy needs to be added to the ACM HUB and then it will be pushed on all clusters # except the HUB (see placementrule on the bottom) {{ if .Values.clusterGroup.isHubCluster }} @@ -82,3 +83,4 @@ spec: - status: 'True' type: ManagedClusterConditionAvailable {{ end }} +{{ end }} \ No newline at end of file diff --git a/charts/hub/external-secrets/templates/policy-quayio-registry-secret.yaml b/charts/hub/external-secrets/templates/policy-quayio-registry-secret.yaml index 0b31bc0c..ac2cf019 100644 --- a/charts/hub/external-secrets/templates/policy-quayio-registry-secret.yaml +++ b/charts/hub/external-secrets/templates/policy-quayio-registry-secret.yaml @@ -1,5 +1,6 @@ # The policy needs to be added to the ACM HUB and then it will be pushed on all clusters # except the HUB (see placementrule on the bottom) +{{ if .Values.global.acm }} {{ if .Values.clusterGroup.isHubCluster }} --- apiVersion: policy.open-cluster-management.io/v1 @@ -81,3 +82,4 @@ spec: - status: 'True' type: ManagedClusterConditionAvailable {{ end }} +{{ end }} \ No newline at end of file diff --git a/charts/hub/external-secrets/templates/policy-reports-nginx-secret.yaml b/charts/hub/external-secrets/templates/policy-reports-nginx-secret.yaml index 2f477618..756529b1 100644 --- a/charts/hub/external-secrets/templates/policy-reports-nginx-secret.yaml +++ b/charts/hub/external-secrets/templates/policy-reports-nginx-secret.yaml @@ -1,5 +1,6 @@ # The policy needs to be added to the ACM HUB and then it will be pushed on all clusters # except the HUB (see placementrule on the bottom) +{{ if .Values.global.acm }} {{ if .Values.clusterGroup.isHubCluster }} --- apiVersion: policy.open-cluster-management.io/v1 @@ -79,3 +80,4 @@ spec: - status: 'True' type: ManagedClusterConditionAvailable {{ end }} +{{ end }} diff --git a/charts/hub/odf/templates/policy-odf-status.yaml b/charts/hub/odf/templates/policy-odf-status.yaml index fec1e3d8..7cb3dd4f 100644 --- a/charts/hub/odf/templates/policy-odf-status.yaml +++ b/charts/hub/odf/templates/policy-odf-status.yaml @@ -1,3 +1,4 @@ +{{ if .Values.global.acm }} apiVersion: policy.open-cluster-management.io/v1 kind: Policy metadata: @@ -55,4 +56,5 @@ spec: - status: "True" type: Available remediationAction: inform - severity: medium \ No newline at end of file + severity: medium +{{ end }} \ No newline at end of file diff --git a/charts/hub/opp/templates/policyset-hub.yaml b/charts/hub/opp/templates/policyset-hub.yaml index 2a64ac41..fd467c0b 100644 --- a/charts/hub/opp/templates/policyset-hub.yaml +++ b/charts/hub/opp/templates/policyset-hub.yaml @@ -15,4 +15,4 @@ spec: - policy-acs-secured-status - policy-ocm-observability - policy-odf-status - - policy-quay-status \ No newline at end of file + - policy-quay-status diff --git a/charts/hub/quay/templates/policy-quay-status.yaml b/charts/hub/quay/templates/policy-quay-status.yaml index da468955..e4d1b615 100644 --- a/charts/hub/quay/templates/policy-quay-status.yaml +++ b/charts/hub/quay/templates/policy-quay-status.yaml @@ -1,3 +1,4 @@ +{{ if .Values.global.acm }} apiVersion: policy.open-cluster-management.io/v1 kind: Policy metadata: @@ -44,4 +45,5 @@ spec: - status: "True" type: Available remediationAction: inform - severity: medium \ No newline at end of file + severity: medium +{{ end }} \ No newline at end of file diff --git a/charts/hub/quay/templates/quayRegistry/policy-quay-pull-secret.yaml b/charts/hub/quay/templates/quayRegistry/policy-quay-pull-secret.yaml index 3db8961f..87a4db88 100644 --- a/charts/hub/quay/templates/quayRegistry/policy-quay-pull-secret.yaml +++ b/charts/hub/quay/templates/quayRegistry/policy-quay-pull-secret.yaml @@ -1,3 +1,4 @@ +{{ if .Values.global.acm }} apiVersion: policy.open-cluster-management.io/v1 kind: Policy metadata: @@ -71,3 +72,4 @@ spec: clusterConditions: - status: 'True' type: ManagedClusterConditionAvailable +{{ end }} \ No newline at end of file diff --git a/values-global.yaml b/values-global.yaml index 141c2da6..f70feca2 100644 --- a/values-global.yaml +++ b/values-global.yaml @@ -1,6 +1,7 @@ --- global: pattern: multicluster-devsecops + acm: false cicd: namespace: devsecops-ci @@ -35,4 +36,6 @@ global: opp: false main: - clusterGroupName: hub + clusterGroupName: singlecluster + + diff --git a/values-singlecluster.yaml b/values-singlecluster.yaml new file mode 100644 index 00000000..83bbcd2f --- /dev/null +++ b/values-singlecluster.yaml @@ -0,0 +1,195 @@ +clusterGroup: + name: hub + isHubCluster: true + +# Namespaces that are expected to be created. +# The pattern will apply these namespaces +# and creates an operator group for that namespace + namespaces: + - vault + - golang-external-secrets + - rhacs-operator + - stackrox + - policies + - openshift-storage + - quay-enterprise + - openshift-pipelines + - devsecops-ci + - devsecops-dev + - devsecops-qa + +# subscriptions: OpenShift Operator subscriptions from OLM/OperatorHub +# - name: the Operator package name (required) +# namespace: expected namespace as specified by Operator (defaults to openshift-operators) +# channel: operator channel from package manifest (required) +# csv: Operator CSV from package manifest. +# only used if global.options.useCSV: true in values-global.yaml + + subscriptions: +# If specific channels are required then uncomment channel line and add the name of the channel + acs: + name: rhacs-operator #packageName + namespace: openshift-operators # operator namespace + + odf: + name: odf-operator + namespace: openshift-storage + + quay: + name: quay-operator + namespace: openshift-operators + + openshift-pipelines: + name: openshift-pipelines-operator-rh + namespace: openshift-operators + +# The following section is used by +# OpenShift GitOps (ArgoCD) +# Projects are just ArgoCD groupings that can be filtered on. + projects: + - hub + - external-secrets + - ci + - dev + + sharedValueFiles: + - '/overrides/values-{{ $.Values.global.clusterPlatform }}.yaml' + - '/overrides/values-{{ $.Values.global.clusterPlatform }}-{{ $.Values.global.clusterVersion }}.yaml' # E: line too long (115 > 80 characters) + + applications: + acs-central: + name: acs-central + namespace: stackrox + project: hub + path: charts/hub/acs/central + + acs-secured: + name: acs-secured + namespace: stackrox + project: hub + path: charts/hub/acs/secured + + storage: + name: storage + namespace: openshift-storage + project: hub + path: charts/hub/odf + + quay-registry: + name: quay-registry + namespace: quay-enterprise + project: hub + path: charts/hub/quay + +# opp-policy: +# name: opp-policy +# namespace: openshift +# project: opp +# path: charts/hub/opp +# ignoreDifferences: +# - group: operators.openshift.io +# kind: Console +# jsonPointers: +# - /spec/plugins + + vault: + name: vault + namespace: vault + project: hub + path: common/hashicorp-vault + + golang-external-secrets: + name: golang-external-secrets + namespace: golang-external-secrets + project: external-secrets + path: common/golang-external-secrets + + external-secrets: + name: external-secrets + namespace: devsecops-ci + project: external-secrets + path: charts/hub/external-secrets + + cli-tools: + name: cli-tools + namespace: openshift + project: hub + path: charts/hub/cli-tools + + pipelines: + name: pipelines + namespace: devsecops-ci + project: ci + path: charts/region/pipelines + ignoreDifferences: + - kind: ServiceAccount + jsonPointers: + - /imagePullSecrets + - /secrets + + nexus: + name: nexus + namespace: devsecops-ci + project: ci + path: charts/region/nexus + + reports-repo: + name: reports-repo + namespace: devsecops-ci + project: ci + path: charts/region/reports + + sonarqube: + name: sonarqube + namespace: devsecops-ci + project: ci + path: charts/region/sonarqube + + cosign: + name: cosign + namespace: devsecops-ci + project: ci + path: charts/region/cosign + + rekor: + name: rekor + namespace: devsecops-ci + project: ci + path: charts/region/rekor + + roxctl: + name: roxctl + namespace: devsecops-ci + project: ci + path: charts/region/roxctl + + + imperative: {} + # NOTE: We *must* use lists and not hashes. As hashes lose ordering once parsed by helm + # The default schedule is every 10 minutes: imperative.schedule + # Total timeout of all jobs is 1h: imperative.activeDeadlineSeconds + # imagePullPolicy is set to always: imperative.imagePullPolicy + # For additional overrides that apply to the jobs, please refer to + # https://hybrid-cloud-patterns.io/imperative-actions/#additional-job-customizations + #jobs: + #- name: regional-ca + # ansible playbook to be run + # playbook: common/ansible/playbooks/hello-world/hello-world.yaml + # per playbook timeout in seconds + # timeout: 234 + # verbosity: "-v" + + +# +# Additional applications +# Be sure to include additional resources your apps will require +# +X machines +# +Y RAM +# +Z CPU +# - name: vendor-app +# namespace: default +# project: vendor +# path: path/to/myapp +# repoURL: https://github.com/vendor/applications.git +# targetRevision: main + \ No newline at end of file