From 7b6d7d5db3a104434b84ee5ab446cf597ba734a7 Mon Sep 17 00:00:00 2001 From: ipbabble Date: Fri, 1 Dec 2023 14:54:02 -0700 Subject: [PATCH 01/21] update key values files --- values-global.yaml | 3 +- values-singlecluster.yaml | 173 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 175 insertions(+), 1 deletion(-) create mode 100644 values-singlecluster.yaml diff --git a/values-global.yaml b/values-global.yaml index 141c2da6..ccb1a4d1 100644 --- a/values-global.yaml +++ b/values-global.yaml @@ -35,4 +35,5 @@ global: opp: false main: - clusterGroupName: hub + clusterGroupName: singlecluster + no-acm: true diff --git a/values-singlecluster.yaml b/values-singlecluster.yaml new file mode 100644 index 00000000..5ac6183d --- /dev/null +++ b/values-singlecluster.yaml @@ -0,0 +1,173 @@ +clusterGroup: + name: singlecluster + isHubCluster: true + +# Namespaces that are expected to be created. +# The pattern will apply these namespaces +# and creates an operator group for that namespace + namespaces: + - vault + - golang-external-secrets + - rhacs-operator + - stackrox + - policies + - openshift-storage + - quay-enterprise + - openshift-pipelines + - devsecops-ci + - devsecops-dev + - devsecops-qa + +# subscriptions: OpenShift Operator subscriptions from OLM/OperatorHub +# - name: the Operator package name (required) +# namespace: expected namespace as specified by Operator (defaults to openshift-operators) +# channel: operator channel from package manifest (required) +# csv: Operator CSV from package manifest. +# only used if global.options.useCSV: true in values-global.yaml + + subscriptions: +# If specific channels are required then uncomment channel line and add the name of the channel + acs: + name: rhacs-operator #packageName + namespace: openshift-operators # operator namespace + + odf: + name: odf-operator + namespace: openshift-storage + + quay: + name: quay-operator + namespace: openshift-operators + + openshift-pipelines: + name: openshift-pipelines-operator-rh + namespace: openshift-operators + +# The following section is used by +# OpenShift GitOps (ArgoCD) +# Projects are just ArgoCD groupings that can be filtered on. + projects: + - hub + - opp + - external-secrets + + sharedValueFiles: + - '/overrides/values-{{ $.Values.global.clusterPlatform }}.yaml' + - '/overrides/values-{{ $.Values.global.clusterPlatform }}-{{ $.Values.global.clusterVersion }}.yaml' # E: line too long (115 > 80 characters) + + applications: + acs-central: + name: acs-central + namespace: stackrox + project: opp + path: charts/hub/acs/central + + acs-secured: + name: acs-secured + namespace: stackrox + project: opp + path: charts/hub/acs/secured + + storage: + name: storage + namespace: openshift-storage + project: opp + path: charts/hub/odf + + quay-registry: + name: quay-registry + namespace: quay-enterprise + project: opp + path: charts/hub/quay + + opp-policy: + name: opp-policy + namespace: openshift + project: opp + path: charts/hub/opp + ignoreDifferences: + - group: operators.openshift.io + kind: Console + jsonPointers: + - /spec/plugins + + vault: + name: vault + namespace: vault + project: hub + path: common/hashicorp-vault + + golang-external-secrets: + name: golang-external-secrets + namespace: golang-external-secrets + project: external-secrets + path: common/golang-external-secrets + + external-secrets: + name: external-secrets + namespace: devsecops-ci + project: external-secrets + path: charts/hub/external-secrets + + cli-tools: + name: cli-tools + namespace: openshift + project: hub + path: charts/hub/cli-tools + + imperative: {} + # NOTE: We *must* use lists and not hashes. As hashes lose ordering once parsed by helm + # The default schedule is every 10 minutes: imperative.schedule + # Total timeout of all jobs is 1h: imperative.activeDeadlineSeconds + # imagePullPolicy is set to always: imperative.imagePullPolicy + # For additional overrides that apply to the jobs, please refer to + # https://hybrid-cloud-patterns.io/imperative-actions/#additional-job-customizations + #jobs: + #- name: regional-ca + # ansible playbook to be run + # playbook: common/ansible/playbooks/hello-world/hello-world.yaml + # per playbook timeout in seconds + # timeout: 234 + # verbosity: "-v" + +# This section is used by ACM + managedClusterGroups: + - name: development + helmOverrides: + - name: clusterGroup.isHubCluster + value: "false" + clusterSelector: + matchLabels: + clusterGroup: devel + matchExpressions: + - key: vendor + operator: In + values: + - OpenShift + + - name: production + helmOverrides: + - name: clusterGroup.isHubCluster + value: "false" + clusterSelector: + matchLabels: + clusterGroup: prod + matchExpressions: + - key: vendor + operator: In + values: + - OpenShift + +# +# Additional applications +# Be sure to include additional resources your apps will require +# +X machines +# +Y RAM +# +Z CPU +# - name: vendor-app +# namespace: default +# project: vendor +# path: path/to/myapp +# repoURL: https://github.com/vendor/applications.git +# targetRevision: main + \ No newline at end of file From fd691b5e5a3394de2905568b063974f4aea6ed95 Mon Sep 17 00:00:00 2001 From: ipbabble Date: Fri, 1 Dec 2023 16:25:06 -0700 Subject: [PATCH 02/21] adjust schema --- values-global.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/values-global.yaml b/values-global.yaml index ccb1a4d1..5173b39f 100644 --- a/values-global.yaml +++ b/values-global.yaml @@ -1,6 +1,7 @@ --- global: pattern: multicluster-devsecops + no-acm: true cicd: namespace: devsecops-ci @@ -36,4 +37,5 @@ global: main: clusterGroupName: singlecluster - no-acm: true + + From e4616708081a0ef56ac1d6a19ee2fd8112cf33e5 Mon Sep 17 00:00:00 2001 From: ipbabble Date: Fri, 1 Dec 2023 16:32:07 -0700 Subject: [PATCH 03/21] rm acm managed cluster specs. --- values-singlecluster.yaml | 29 +---------------------------- 1 file changed, 1 insertion(+), 28 deletions(-) diff --git a/values-singlecluster.yaml b/values-singlecluster.yaml index 5ac6183d..7a571dba 100644 --- a/values-singlecluster.yaml +++ b/values-singlecluster.yaml @@ -130,34 +130,7 @@ clusterGroup: # timeout: 234 # verbosity: "-v" -# This section is used by ACM - managedClusterGroups: - - name: development - helmOverrides: - - name: clusterGroup.isHubCluster - value: "false" - clusterSelector: - matchLabels: - clusterGroup: devel - matchExpressions: - - key: vendor - operator: In - values: - - OpenShift - - - name: production - helmOverrides: - - name: clusterGroup.isHubCluster - value: "false" - clusterSelector: - matchLabels: - clusterGroup: prod - matchExpressions: - - key: vendor - operator: In - values: - - OpenShift - + # # Additional applications # Be sure to include additional resources your apps will require From 1bb3b62641ee8aa3a3ccbf1f278da5192c176d5c Mon Sep 17 00:00:00 2001 From: ipbabble Date: Fri, 1 Dec 2023 16:34:11 -0700 Subject: [PATCH 04/21] revert cluster name to hub --- values-global.yaml | 2 +- values-singlecluster.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/values-global.yaml b/values-global.yaml index 5173b39f..1273b246 100644 --- a/values-global.yaml +++ b/values-global.yaml @@ -36,6 +36,6 @@ global: opp: false main: - clusterGroupName: singlecluster + clusterGroupName: hub diff --git a/values-singlecluster.yaml b/values-singlecluster.yaml index 7a571dba..aa137985 100644 --- a/values-singlecluster.yaml +++ b/values-singlecluster.yaml @@ -1,5 +1,5 @@ clusterGroup: - name: singlecluster + name: hub isHubCluster: true # Namespaces that are expected to be created. From 8eedfde9474e5e14c54dd5a8d4f4f04dd3760289 Mon Sep 17 00:00:00 2001 From: ipbabble Date: Fri, 1 Dec 2023 16:44:56 -0700 Subject: [PATCH 05/21] remove opp PolicySet --- charts/hub/opp/templates/policyset-hub.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/charts/hub/opp/templates/policyset-hub.yaml b/charts/hub/opp/templates/policyset-hub.yaml index 2a64ac41..f0980a7d 100644 --- a/charts/hub/opp/templates/policyset-hub.yaml +++ b/charts/hub/opp/templates/policyset-hub.yaml @@ -1,3 +1,4 @@ +{{ if eq .Values.global.no-acm "false" }} apiVersion: policy.open-cluster-management.io/v1beta1 kind: PolicySet metadata: @@ -15,4 +16,5 @@ spec: - policy-acs-secured-status - policy-ocm-observability - policy-odf-status - - policy-quay-status \ No newline at end of file + - policy-quay-status + {{ end }} \ No newline at end of file From d7c75ecf4fc428b55c1c3b0ae5dc428928d7627c Mon Sep 17 00:00:00 2001 From: ipbabble Date: Fri, 1 Dec 2023 16:48:06 -0700 Subject: [PATCH 06/21] fix if condition --- charts/hub/opp/templates/policyset-hub.yaml | 2 +- values-global.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/hub/opp/templates/policyset-hub.yaml b/charts/hub/opp/templates/policyset-hub.yaml index f0980a7d..f9cbab30 100644 --- a/charts/hub/opp/templates/policyset-hub.yaml +++ b/charts/hub/opp/templates/policyset-hub.yaml @@ -1,4 +1,4 @@ -{{ if eq .Values.global.no-acm "false" }} +{{ if .Values.global.acm }} apiVersion: policy.open-cluster-management.io/v1beta1 kind: PolicySet metadata: diff --git a/values-global.yaml b/values-global.yaml index 1273b246..a93da4c8 100644 --- a/values-global.yaml +++ b/values-global.yaml @@ -1,7 +1,7 @@ --- global: pattern: multicluster-devsecops - no-acm: true + amc: true cicd: namespace: devsecops-ci From f0baf5bc6dcd020bfc605778c579626a590c3e18 Mon Sep 17 00:00:00 2001 From: ipbabble Date: Fri, 1 Dec 2023 16:53:15 -0700 Subject: [PATCH 07/21] rm OPP app --- .../hub/odf/templates/policy-odf-status.yaml | 4 +++- values-singlecluster.yaml | 20 +++++++++---------- 2 files changed, 13 insertions(+), 11 deletions(-) diff --git a/charts/hub/odf/templates/policy-odf-status.yaml b/charts/hub/odf/templates/policy-odf-status.yaml index fec1e3d8..8d15d468 100644 --- a/charts/hub/odf/templates/policy-odf-status.yaml +++ b/charts/hub/odf/templates/policy-odf-status.yaml @@ -1,3 +1,4 @@ +{{ if .Values.global.acm }} apiVersion: policy.open-cluster-management.io/v1 kind: Policy metadata: @@ -55,4 +56,5 @@ spec: - status: "True" type: Available remediationAction: inform - severity: medium \ No newline at end of file + severity: medium + {{ end }} \ No newline at end of file diff --git a/values-singlecluster.yaml b/values-singlecluster.yaml index aa137985..4ff85d25 100644 --- a/values-singlecluster.yaml +++ b/values-singlecluster.yaml @@ -80,16 +80,16 @@ clusterGroup: project: opp path: charts/hub/quay - opp-policy: - name: opp-policy - namespace: openshift - project: opp - path: charts/hub/opp - ignoreDifferences: - - group: operators.openshift.io - kind: Console - jsonPointers: - - /spec/plugins +# opp-policy: +# name: opp-policy +# namespace: openshift +# project: opp +# path: charts/hub/opp +# ignoreDifferences: +# - group: operators.openshift.io +# kind: Console +# jsonPointers: +# - /spec/plugins vault: name: vault From c957c9dfb6650fc19c8c9b1eb3e77e8461b45bf4 Mon Sep 17 00:00:00 2001 From: ipbabble Date: Fri, 1 Dec 2023 17:08:33 -0700 Subject: [PATCH 08/21] add global.acm value --- .../templates/integration/policy-acs-integrations-token.yaml | 2 ++ charts/hub/opp/templates/policyset-hub.yaml | 2 -- values-global.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/hub/acs/central/templates/integration/policy-acs-integrations-token.yaml b/charts/hub/acs/central/templates/integration/policy-acs-integrations-token.yaml index f51c00fc..b3ffd4e3 100644 --- a/charts/hub/acs/central/templates/integration/policy-acs-integrations-token.yaml +++ b/charts/hub/acs/central/templates/integration/policy-acs-integrations-token.yaml @@ -1,3 +1,4 @@ +{{- if $.Values.global.acm }} {{- if $.Values.acs.integrations }} apiVersion: policy.open-cluster-management.io/v1 kind: Policy @@ -66,3 +67,4 @@ spec: - status: 'True' type: ManagedClusterConditionAvailable {{- end }} +{{- end }} diff --git a/charts/hub/opp/templates/policyset-hub.yaml b/charts/hub/opp/templates/policyset-hub.yaml index f9cbab30..fd467c0b 100644 --- a/charts/hub/opp/templates/policyset-hub.yaml +++ b/charts/hub/opp/templates/policyset-hub.yaml @@ -1,4 +1,3 @@ -{{ if .Values.global.acm }} apiVersion: policy.open-cluster-management.io/v1beta1 kind: PolicySet metadata: @@ -17,4 +16,3 @@ spec: - policy-ocm-observability - policy-odf-status - policy-quay-status - {{ end }} \ No newline at end of file diff --git a/values-global.yaml b/values-global.yaml index a93da4c8..7e04b83f 100644 --- a/values-global.yaml +++ b/values-global.yaml @@ -1,7 +1,7 @@ --- global: pattern: multicluster-devsecops - amc: true + acm: true cicd: namespace: devsecops-ci From 925864192018b052e6443576f8db40ddef75518d Mon Sep 17 00:00:00 2001 From: ipbabble Date: Fri, 1 Dec 2023 17:13:45 -0700 Subject: [PATCH 09/21] rm acs central policies --- .../central/templates/policy/policy-acs-central-status.yaml | 4 +++- .../central/templates/policy/policy-acs-secured-status.yaml | 4 +++- .../policy/secured-cluster-secret-placement-binding.yaml | 4 +++- .../policy/secured-cluster-secret-placement-rule.yaml | 4 +++- .../templates/policy/secured-cluster-secret-policy.yaml | 2 ++ 5 files changed, 14 insertions(+), 4 deletions(-) diff --git a/charts/hub/acs/central/templates/policy/policy-acs-central-status.yaml b/charts/hub/acs/central/templates/policy/policy-acs-central-status.yaml index 8c19da5c..9e1f6029 100644 --- a/charts/hub/acs/central/templates/policy/policy-acs-central-status.yaml +++ b/charts/hub/acs/central/templates/policy/policy-acs-central-status.yaml @@ -1,3 +1,4 @@ +{{- if $.Values.global.acm }} apiVersion: policy.open-cluster-management.io/v1 kind: Policy metadata: @@ -55,4 +56,5 @@ spec: - status: "True" type: Available remediationAction: inform - severity: medium \ No newline at end of file + severity: medium +{{- end }} \ No newline at end of file diff --git a/charts/hub/acs/central/templates/policy/policy-acs-secured-status.yaml b/charts/hub/acs/central/templates/policy/policy-acs-secured-status.yaml index 43fb247c..082a63b9 100644 --- a/charts/hub/acs/central/templates/policy/policy-acs-secured-status.yaml +++ b/charts/hub/acs/central/templates/policy/policy-acs-secured-status.yaml @@ -1,3 +1,4 @@ +{{- if $.Values.global.acm }} apiVersion: policy.open-cluster-management.io/v1 kind: Policy metadata: @@ -42,4 +43,5 @@ spec: status: numberMisscheduled: 0 remediationAction: inform - severity: medium \ No newline at end of file + severity: medium +{{- end }} \ No newline at end of file diff --git a/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-binding.yaml b/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-binding.yaml index 152477e1..cf906ac4 100644 --- a/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-binding.yaml +++ b/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-binding.yaml @@ -1,3 +1,4 @@ +{{- if $.Values.global.acm }} apiVersion: policy.open-cluster-management.io/v1 kind: PlacementBinding metadata: @@ -12,4 +13,5 @@ placementRef: subjects: - name: secured-cluster-secret-policy kind: Policy - apiGroup: policy.open-cluster-management.io \ No newline at end of file + apiGroup: policy.open-cluster-management.io +{{- end }} \ No newline at end of file diff --git a/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-rule.yaml b/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-rule.yaml index 528ab5a3..ccab73d1 100644 --- a/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-rule.yaml +++ b/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-rule.yaml @@ -1,3 +1,4 @@ +{{- if $.Values.global.acm }} apiVersion: apps.open-cluster-management.io/v1 kind: PlacementRule metadata: @@ -9,4 +10,5 @@ spec: # This will go to all managed clusters clusterConditions: - status: 'True' - type: ManagedClusterConditionAvailable \ No newline at end of file + type: ManagedClusterConditionAvailable +{{- end }} \ No newline at end of file diff --git a/charts/hub/acs/central/templates/policy/secured-cluster-secret-policy.yaml b/charts/hub/acs/central/templates/policy/secured-cluster-secret-policy.yaml index e3421664..bb07edae 100644 --- a/charts/hub/acs/central/templates/policy/secured-cluster-secret-policy.yaml +++ b/charts/hub/acs/central/templates/policy/secured-cluster-secret-policy.yaml @@ -1,3 +1,4 @@ +{{- if $.Values.global.acm }} apiVersion: policy.open-cluster-management.io/v1 kind: Policy metadata: @@ -91,3 +92,4 @@ spec: name: scanner-db-tls namespace: stackrox type: Opaque +{{- end }} \ No newline at end of file From 4635c43adce8c386525d8b08f381293e4b373559 Mon Sep 17 00:00:00 2001 From: ipbabble Date: Fri, 1 Dec 2023 17:18:49 -0700 Subject: [PATCH 10/21] add pipelines app --- values-singlecluster.yaml | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/values-singlecluster.yaml b/values-singlecluster.yaml index 4ff85d25..3a4c4e9b 100644 --- a/values-singlecluster.yaml +++ b/values-singlecluster.yaml @@ -48,7 +48,6 @@ clusterGroup: # Projects are just ArgoCD groupings that can be filtered on. projects: - hub - - opp - external-secrets sharedValueFiles: @@ -59,25 +58,25 @@ clusterGroup: acs-central: name: acs-central namespace: stackrox - project: opp + project: hub path: charts/hub/acs/central acs-secured: name: acs-secured namespace: stackrox - project: opp + project: hub path: charts/hub/acs/secured storage: name: storage namespace: openshift-storage - project: opp + project: hub path: charts/hub/odf quay-registry: name: quay-registry namespace: quay-enterprise - project: opp + project: hub path: charts/hub/quay # opp-policy: @@ -114,7 +113,18 @@ clusterGroup: namespace: openshift project: hub path: charts/hub/cli-tools - + + pipelines: + name: pipelines + namespace: devsecops-ci + project: ci + path: charts/region/pipelines + ignoreDifferences: + - kind: ServiceAccount + jsonPointers: + - /imagePullSecrets + - /secrets + imperative: {} # NOTE: We *must* use lists and not hashes. As hashes lose ordering once parsed by helm # The default schedule is every 10 minutes: imperative.schedule From 611b016622df979c57dae52a6e6c8c57c117b88c Mon Sep 17 00:00:00 2001 From: ipbabble Date: Fri, 1 Dec 2023 17:31:34 -0700 Subject: [PATCH 11/21] test if statement --- .../templates/integration/policy-acs-integrations-token.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/hub/acs/central/templates/integration/policy-acs-integrations-token.yaml b/charts/hub/acs/central/templates/integration/policy-acs-integrations-token.yaml index b3ffd4e3..0a61a46e 100644 --- a/charts/hub/acs/central/templates/integration/policy-acs-integrations-token.yaml +++ b/charts/hub/acs/central/templates/integration/policy-acs-integrations-token.yaml @@ -1,4 +1,4 @@ -{{- if $.Values.global.acm }} +{{ if .Values.global.acm }} {{- if $.Values.acs.integrations }} apiVersion: policy.open-cluster-management.io/v1 kind: Policy From c66ec61fce2cb58e55075a3eace7fd662ab5f7d6 Mon Sep 17 00:00:00 2001 From: ipbabble Date: Tue, 5 Dec 2023 15:39:42 -0700 Subject: [PATCH 12/21] use singlecluster GroupName for values- file pick up --- values-global.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/values-global.yaml b/values-global.yaml index 7e04b83f..8a297fee 100644 --- a/values-global.yaml +++ b/values-global.yaml @@ -36,6 +36,6 @@ global: opp: false main: - clusterGroupName: hub + clusterGroupName: singlecluster From d8bbdfe1073992813d55cafe839a758d91bb0f84 Mon Sep 17 00:00:00 2001 From: ipbabble Date: Tue, 5 Dec 2023 16:23:20 -0700 Subject: [PATCH 13/21] fix if condition --- .../central/templates/policy/policy-acs-central-status.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/hub/acs/central/templates/policy/policy-acs-central-status.yaml b/charts/hub/acs/central/templates/policy/policy-acs-central-status.yaml index 9e1f6029..5e08271c 100644 --- a/charts/hub/acs/central/templates/policy/policy-acs-central-status.yaml +++ b/charts/hub/acs/central/templates/policy/policy-acs-central-status.yaml @@ -1,4 +1,4 @@ -{{- if $.Values.global.acm }} +{{ if .Values.global.acm }} apiVersion: policy.open-cluster-management.io/v1 kind: Policy metadata: @@ -57,4 +57,4 @@ spec: type: Available remediationAction: inform severity: medium -{{- end }} \ No newline at end of file +{{ end }} \ No newline at end of file From b3cd56895f8e90ea512f0030b5a46107e18af424 Mon Sep 17 00:00:00 2001 From: ipbabble Date: Tue, 5 Dec 2023 16:28:29 -0700 Subject: [PATCH 14/21] fix if conditions --- .../templates/integration/policy-acs-integrations-token.yaml | 2 +- .../central/templates/policy/policy-acs-secured-status.yaml | 4 ++-- .../policy/secured-cluster-secret-placement-binding.yaml | 4 ++-- .../policy/secured-cluster-secret-placement-rule.yaml | 4 ++-- .../templates/policy/secured-cluster-secret-policy.yaml | 4 ++-- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/charts/hub/acs/central/templates/integration/policy-acs-integrations-token.yaml b/charts/hub/acs/central/templates/integration/policy-acs-integrations-token.yaml index 0a61a46e..f6f1cc7d 100644 --- a/charts/hub/acs/central/templates/integration/policy-acs-integrations-token.yaml +++ b/charts/hub/acs/central/templates/integration/policy-acs-integrations-token.yaml @@ -67,4 +67,4 @@ spec: - status: 'True' type: ManagedClusterConditionAvailable {{- end }} -{{- end }} +{{ end }} diff --git a/charts/hub/acs/central/templates/policy/policy-acs-secured-status.yaml b/charts/hub/acs/central/templates/policy/policy-acs-secured-status.yaml index 082a63b9..841db303 100644 --- a/charts/hub/acs/central/templates/policy/policy-acs-secured-status.yaml +++ b/charts/hub/acs/central/templates/policy/policy-acs-secured-status.yaml @@ -1,4 +1,4 @@ -{{- if $.Values.global.acm }} +{{ if .Values.global.acm }} apiVersion: policy.open-cluster-management.io/v1 kind: Policy metadata: @@ -44,4 +44,4 @@ spec: numberMisscheduled: 0 remediationAction: inform severity: medium -{{- end }} \ No newline at end of file +{{ end }} \ No newline at end of file diff --git a/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-binding.yaml b/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-binding.yaml index cf906ac4..aae2b30e 100644 --- a/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-binding.yaml +++ b/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-binding.yaml @@ -1,4 +1,4 @@ -{{- if $.Values.global.acm }} +{{ if .Values.global.acm }} apiVersion: policy.open-cluster-management.io/v1 kind: PlacementBinding metadata: @@ -14,4 +14,4 @@ subjects: - name: secured-cluster-secret-policy kind: Policy apiGroup: policy.open-cluster-management.io -{{- end }} \ No newline at end of file +{{ end }} \ No newline at end of file diff --git a/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-rule.yaml b/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-rule.yaml index ccab73d1..45628292 100644 --- a/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-rule.yaml +++ b/charts/hub/acs/central/templates/policy/secured-cluster-secret-placement-rule.yaml @@ -1,4 +1,4 @@ -{{- if $.Values.global.acm }} +{{ if $.Values.global.acm }} apiVersion: apps.open-cluster-management.io/v1 kind: PlacementRule metadata: @@ -11,4 +11,4 @@ spec: clusterConditions: - status: 'True' type: ManagedClusterConditionAvailable -{{- end }} \ No newline at end of file +{{ end }} \ No newline at end of file diff --git a/charts/hub/acs/central/templates/policy/secured-cluster-secret-policy.yaml b/charts/hub/acs/central/templates/policy/secured-cluster-secret-policy.yaml index bb07edae..9be0c919 100644 --- a/charts/hub/acs/central/templates/policy/secured-cluster-secret-policy.yaml +++ b/charts/hub/acs/central/templates/policy/secured-cluster-secret-policy.yaml @@ -1,4 +1,4 @@ -{{- if $.Values.global.acm }} +{{ if .Values.global.acm }} apiVersion: policy.open-cluster-management.io/v1 kind: Policy metadata: @@ -92,4 +92,4 @@ spec: name: scanner-db-tls namespace: stackrox type: Opaque -{{- end }} \ No newline at end of file +{{ end }} \ No newline at end of file From bc77bd7dad9849b7afd4c294e7068e50ca30e424 Mon Sep 17 00:00:00 2001 From: ipbabble Date: Tue, 5 Dec 2023 16:32:51 -0700 Subject: [PATCH 15/21] fix if conditions --- charts/hub/external-secrets/templates/policy-git-secret.yaml | 2 ++ .../templates/policy-quayio-registry-secret.yaml | 2 ++ .../external-secrets/templates/policy-reports-nginx-secret.yaml | 2 ++ 3 files changed, 6 insertions(+) diff --git a/charts/hub/external-secrets/templates/policy-git-secret.yaml b/charts/hub/external-secrets/templates/policy-git-secret.yaml index a7e65e10..e28d8893 100644 --- a/charts/hub/external-secrets/templates/policy-git-secret.yaml +++ b/charts/hub/external-secrets/templates/policy-git-secret.yaml @@ -1,3 +1,4 @@ +{{ if .Values.global.acm }} # The policy needs to be added to the ACM HUB and then it will be pushed on all clusters # except the HUB (see placementrule on the bottom) {{ if .Values.clusterGroup.isHubCluster }} @@ -82,3 +83,4 @@ spec: - status: 'True' type: ManagedClusterConditionAvailable {{ end }} +{{ end }} \ No newline at end of file diff --git a/charts/hub/external-secrets/templates/policy-quayio-registry-secret.yaml b/charts/hub/external-secrets/templates/policy-quayio-registry-secret.yaml index 0b31bc0c..ac2cf019 100644 --- a/charts/hub/external-secrets/templates/policy-quayio-registry-secret.yaml +++ b/charts/hub/external-secrets/templates/policy-quayio-registry-secret.yaml @@ -1,5 +1,6 @@ # The policy needs to be added to the ACM HUB and then it will be pushed on all clusters # except the HUB (see placementrule on the bottom) +{{ if .Values.global.acm }} {{ if .Values.clusterGroup.isHubCluster }} --- apiVersion: policy.open-cluster-management.io/v1 @@ -81,3 +82,4 @@ spec: - status: 'True' type: ManagedClusterConditionAvailable {{ end }} +{{ end }} \ No newline at end of file diff --git a/charts/hub/external-secrets/templates/policy-reports-nginx-secret.yaml b/charts/hub/external-secrets/templates/policy-reports-nginx-secret.yaml index 2f477618..756529b1 100644 --- a/charts/hub/external-secrets/templates/policy-reports-nginx-secret.yaml +++ b/charts/hub/external-secrets/templates/policy-reports-nginx-secret.yaml @@ -1,5 +1,6 @@ # The policy needs to be added to the ACM HUB and then it will be pushed on all clusters # except the HUB (see placementrule on the bottom) +{{ if .Values.global.acm }} {{ if .Values.clusterGroup.isHubCluster }} --- apiVersion: policy.open-cluster-management.io/v1 @@ -79,3 +80,4 @@ spec: - status: 'True' type: ManagedClusterConditionAvailable {{ end }} +{{ end }} From 9604d92f0abfa0f0ca89df600d1221bade30de40 Mon Sep 17 00:00:00 2001 From: ipbabble Date: Tue, 5 Dec 2023 17:02:08 -0700 Subject: [PATCH 16/21] turn off global.acm --- values-global.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/values-global.yaml b/values-global.yaml index 8a297fee..f70feca2 100644 --- a/values-global.yaml +++ b/values-global.yaml @@ -1,7 +1,7 @@ --- global: pattern: multicluster-devsecops - acm: true + acm: false cicd: namespace: devsecops-ci From d7a3ccf5c09d3ac15272b2fc4e9ba75898b7d546 Mon Sep 17 00:00:00 2001 From: ipbabble Date: Tue, 5 Dec 2023 17:11:22 -0700 Subject: [PATCH 17/21] if statement added to quay policy; i.e. trun off --- charts/hub/quay/templates/policy-quay-status.yaml | 4 +++- .../quay/templates/quayRegistry/policy-quay-pull-secret.yaml | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/charts/hub/quay/templates/policy-quay-status.yaml b/charts/hub/quay/templates/policy-quay-status.yaml index da468955..6228bf90 100644 --- a/charts/hub/quay/templates/policy-quay-status.yaml +++ b/charts/hub/quay/templates/policy-quay-status.yaml @@ -1,3 +1,4 @@ +{{ if .Values.global.acm }} apiVersion: policy.open-cluster-management.io/v1 kind: Policy metadata: @@ -44,4 +45,5 @@ spec: - status: "True" type: Available remediationAction: inform - severity: medium \ No newline at end of file + severity: medium + {{ end }} \ No newline at end of file diff --git a/charts/hub/quay/templates/quayRegistry/policy-quay-pull-secret.yaml b/charts/hub/quay/templates/quayRegistry/policy-quay-pull-secret.yaml index 3db8961f..87a4db88 100644 --- a/charts/hub/quay/templates/quayRegistry/policy-quay-pull-secret.yaml +++ b/charts/hub/quay/templates/quayRegistry/policy-quay-pull-secret.yaml @@ -1,3 +1,4 @@ +{{ if .Values.global.acm }} apiVersion: policy.open-cluster-management.io/v1 kind: Policy metadata: @@ -71,3 +72,4 @@ spec: clusterConditions: - status: 'True' type: ManagedClusterConditionAvailable +{{ end }} \ No newline at end of file From 12bd26be6ff53b704ed94db3ab534a5928eb491e Mon Sep 17 00:00:00 2001 From: ipbabble Date: Wed, 6 Dec 2023 16:25:56 -0700 Subject: [PATCH 18/21] {{}} edits --- charts/hub/odf/templates/policy-odf-status.yaml | 2 +- charts/hub/quay/templates/policy-quay-status.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/hub/odf/templates/policy-odf-status.yaml b/charts/hub/odf/templates/policy-odf-status.yaml index 8d15d468..7cb3dd4f 100644 --- a/charts/hub/odf/templates/policy-odf-status.yaml +++ b/charts/hub/odf/templates/policy-odf-status.yaml @@ -57,4 +57,4 @@ spec: type: Available remediationAction: inform severity: medium - {{ end }} \ No newline at end of file +{{ end }} \ No newline at end of file diff --git a/charts/hub/quay/templates/policy-quay-status.yaml b/charts/hub/quay/templates/policy-quay-status.yaml index 6228bf90..e4d1b615 100644 --- a/charts/hub/quay/templates/policy-quay-status.yaml +++ b/charts/hub/quay/templates/policy-quay-status.yaml @@ -46,4 +46,4 @@ spec: type: Available remediationAction: inform severity: medium - {{ end }} \ No newline at end of file +{{ end }} \ No newline at end of file From 0d82e751967b71246bf0900879c4d4cb648acafe Mon Sep 17 00:00:00 2001 From: ipbabble Date: Fri, 8 Dec 2023 16:23:43 -0700 Subject: [PATCH 19/21] added pipeline tools apps --- values-singlecluster.yaml | 44 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 43 insertions(+), 1 deletion(-) diff --git a/values-singlecluster.yaml b/values-singlecluster.yaml index 3a4c4e9b..be865e6e 100644 --- a/values-singlecluster.yaml +++ b/values-singlecluster.yaml @@ -124,7 +124,49 @@ clusterGroup: jsonPointers: - /imagePullSecrets - /secrets - + + nexus: + name: nexus + namespace: devsecops-ci + project: ci + path: charts/region/nexus + + reports-repo: + name: reports-repo + namespace: devsecops-ci + project: ci + path: charts/region/reports + + sonarqube: + name: sonarqube + namespace: devsecops-ci + project: ci + path: charts/region/sonarqube + + cosign: + name: cosign + namespace: devsecops-ci + project: ci + path: charts/region/cosign + + rekor: + name: rekor + namespace: devsecops-ci + project: ci + path: charts/region/rekor + + roxctl: + name: roxctl + namespace: devsecops-ci + project: ci + path: charts/region/roxctl + + petclinic: + name: spring-petclinic + namespace: devsecops-dev + project: dev + path: charts/region/spring-petclinic-config + imperative: {} # NOTE: We *must* use lists and not hashes. As hashes lose ordering once parsed by helm # The default schedule is every 10 minutes: imperative.schedule From 25690241dddbe90f7fb923288855d6831ca05e5c Mon Sep 17 00:00:00 2001 From: ipbabble Date: Fri, 8 Dec 2023 16:25:33 -0700 Subject: [PATCH 20/21] add ci/dev ns --- values-singlecluster.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/values-singlecluster.yaml b/values-singlecluster.yaml index be865e6e..fdf25704 100644 --- a/values-singlecluster.yaml +++ b/values-singlecluster.yaml @@ -49,6 +49,8 @@ clusterGroup: projects: - hub - external-secrets + - ci + - dev sharedValueFiles: - '/overrides/values-{{ $.Values.global.clusterPlatform }}.yaml' From 25455b7824ba303bf0e50e87963825558c6c3afc Mon Sep 17 00:00:00 2001 From: ipbabble Date: Fri, 8 Dec 2023 16:28:17 -0700 Subject: [PATCH 21/21] rm petclinic --- values-singlecluster.yaml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/values-singlecluster.yaml b/values-singlecluster.yaml index fdf25704..83bbcd2f 100644 --- a/values-singlecluster.yaml +++ b/values-singlecluster.yaml @@ -163,11 +163,6 @@ clusterGroup: project: ci path: charts/region/roxctl - petclinic: - name: spring-petclinic - namespace: devsecops-dev - project: dev - path: charts/region/spring-petclinic-config imperative: {} # NOTE: We *must* use lists and not hashes. As hashes lose ordering once parsed by helm