Update Helm release argo-cd to v7.7.6

apps/faf-user-service/templates/config-hydra2.yaml

@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: faf-user-service-hydra2
+  labels:
+    app: faf-user-service-hydra2
+data:
+  # Only for testing environments
+  FAF_ENVIRONMENT: {{ eq .Values.environment "prod" | ternary "" .Values.environment }}
+  REAL_IP_HEADER: "Cf-Connecting-Ip"
+  PASSWORD_RESET_URL: "https://www.{{.Values.baseDomain}}/account/password/reset"
+  REGISTER_ACCOUNT_URL: "https://www.{{.Values.baseDomain}}/account/register"
+  ACTIVATION_URL_FORMAT: "https://user.{{.Values.baseDomain}}/register/activate?token=%s"
+  FAILED_LOGIN_ACCOUNT_THRESHOLD: "5"
+  FAILED_LOGIN_ATTEMPT_THRESHOLD: "10"
+  FAILED_LOGIN_THROTTLING_MINUTES: "5"
+  FAILED_LOGIN_DAYS_TO_CHECK: "1"
+  HYDRA_TOKEN_ISSUER: "https://login.{{.Values.baseDomain}}"
+  HYDRA_JWKS_URL: "https://login.{{.Values.baseDomain}}/.well-known/jwks.json"
+  HYDRA_BASE_ADMIN_URL: "http://ory-hydra2:4445"
+  DB_URL: "jdbc:mariadb://mariadb:3306/faf_lobby?ssl=false"
+  DB_USERNAME: "faf-user-service"
+  DB_DATABASE: "faf_lobby" # for mariadb init script
+  LOBBY_URL: "wss://ws.{{.Values.baseDomain}}"
+  IRC_TOKEN_TTL: "300"
+  JAVA_OPTS: "-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005"

apps/faf-user-service/templates/deployment-hydra2.yaml

@@ -0,0 +1,56 @@
+# This is for temporary running Ory Hydra 1.10 and 2.x in parallel.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: faf-user-service-hydra2
+  labels:
+    app: faf-user-service-hydra2
+  annotations:
+    reloader.stakater.com/auto: "true"
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: faf-user-service-hydra2
+  template:
+    metadata:
+      labels:
+        app: faf-user-service-hydra2
+      annotations:
+        prometheus.io/scrape: 'true'
+        prometheus.io/port: '8081'
+        prometheus.io/path: '/actuator/prometheus'
+    spec:
+      containers:
+        - image: faforever/faf-user-service:3.2.0-RC2
+          imagePullPolicy: Always
+          name: faf-user-service
+          envFrom:
+            - configMapRef:
+                name: faf-user-service-hydra2
+            - secretRef:
+                name: faf-user-service
+          volumeMounts:
+            - name: mail-templates
+              mountPath: /config/mail/
+              readOnly: true
+          ports:
+            - containerPort: 8080
+          startupProbe:
+            httpGet:
+              port: 8080
+              path: /q/health
+            failureThreshold: 10
+            periodSeconds: 3
+          livenessProbe:
+            httpGet:
+              port: 8080
+              path: /q/health
+            failureThreshold: 3
+            periodSeconds: 10
+      restartPolicy: Always
+      volumes:
+        - name: mail-templates
+          configMap:
+            name: faf-user-service-mail-templates

apps/faf-user-service/templates/deployment.yaml

@@ -22,7 +22,7 @@ spec:
         prometheus.io/path: '/actuator/prometheus'
     spec:
       containers:
-        - image: faforever/faf-user-service:3.1.3
+        - image: faforever/faf-user-service:3.1.5
           imagePullPolicy: Always
           name: faf-user-service
           envFrom:

apps/faf-user-service/templates/ingress.yaml

@@ -11,3 +11,9 @@ spec:
       services:
         - name: faf-user-service
           port: 8080
+    # This is for temporary running Ory Hydra 1.10 and 2.x in parallel.
+    - match: Host(`user-nx.{{.Values.baseDomain}}`)
+      kind: Rule
+      services:
+        - name: faf-user-service-hydra2
+          port: 8080

apps/faf-user-service/templates/service-hydra2.yaml

@@ -0,0 +1,13 @@
+# This is for temporary running Ory Hydra 1.10 and 2.x in parallel.
+apiVersion: v1
+kind: Service
+metadata:
+  name: faf-user-service-hydra2
+  labels:
+    app: faf-user-service-hydra2
+spec:
+  selector:
+    app: faf-user-service-hydra2
+  ports:
+    - port: 8080
+      targetPort: 8080

apps/ory-hydra2/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+name: ory-hydra2
+version: 1.0.0

apps/ory-hydra2/templates/config.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ory-hydra2
+  namespace: faf-apps
+  labels:
+    app: ory-hydra2
+data:
+  URLS_SELF_ISSUER: "https://login.{{.Values.baseDomain}}"
+  URLS_LOGIN: "https://user-nx.{{.Values.baseDomain}}/oauth2/login"
+  URLS_CONSENT: "https://user-nx.{{.Values.baseDomain}}/oauth2/consent"
+  STRATEGIES_ACCESS_TOKEN: "jwt"
+  OAUTH2_CLIENT_CREDENTIALS_DEFAULT_GRANT_ALLOWED_SCOPE: "true"
+  # These are only used for postgres init script, it is redundant in the DSN secret! Don't forget to also create a secret for DB_PASSWORD
+  DB_USER: "hydra"
+  DB_NAME: "ory-hydra"

apps/ory-hydra2/templates/deployment.yaml

@@ -0,0 +1,35 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ory-hydra2
+  namespace: faf-apps
+  labels:
+    app: ory-hydra2
+  annotations:
+    reloader.stakater.com/auto: "true"
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: ory-hydra2
+  template:
+    metadata:
+      labels:
+        app: ory-hydra2
+      annotations:
+        prometheus.io/scrape: 'false'
+    spec:
+      containers:
+        - image: oryd/hydra:v2.2.0
+          imagePullPolicy: Always
+          name: ory-hydra2
+          envFrom:
+            - configMapRef:
+                name: ory-hydra2
+            - secretRef:
+                name: ory-hydra2
+          ports:
+            - containerPort: 4444
+            - containerPort: 4445
+      restartPolicy: Always

apps/ory-hydra2/templates/ingress.yaml

@@ -0,0 +1,13 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: ory-hydra2
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`login.{{.Values.baseDomain}}`)
+      kind: Rule
+      services:
+        - name: ory-hydra2
+          port: 4444

apps/ory-hydra2/templates/migration-cronjob.yaml

@@ -0,0 +1,35 @@
+kind: CronJob
+apiVersion: batch/v1
+metadata:
+  name: ory-hydra2-migration
+  namespace: faf-apps
+  labels:
+    app: ory-hydra-migration
+spec:
+  # Disabled because triggered manually
+  schedule: "0 0 31 2 *"
+  suspend: true
+  concurrencyPolicy: Forbid
+  jobTemplate:
+    metadata:
+      labels:
+        app: ory-hydra2-migration
+      annotations:
+        prometheus.io/scrape: 'false'
+    spec:
+      template:
+        spec:
+          containers:
+            - image: oryd/hydra:v2.2.0
+              imagePullPolicy: Always
+              name: ory-hydra
+              envFrom:
+                - configMapRef:
+                    name: ory-hydra2
+                - secretRef:
+                    name: ory-hydra2
+              ports:
+                - containerPort: 4444
+                - containerPort: 4445
+              args: [ "migrate", "sql", "--read-from-env", "--yes"]
+          restartPolicy: Never

apps/ory-hydra2/templates/secret.yaml

@@ -0,0 +1,19 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: ory-hydra2
+  namespace: faf-apps
+spec:
+  authentication:
+    universalAuth:
+      credentialsRef:
+        secretName: infisical-machine-identity
+        secretNamespace: faf-ops
+      secretsScope:
+        projectSlug: {{.Values.infisical.projectSlug}}
+        envSlug: {{.Values.infisical.envSlug}}
+        secretsPath: "/ory-hydra2"
+  managedSecretReference:
+    secretName: ory-hydra2
+    secretNamespace: faf-apps
+    creationPolicy: "Owner"

apps/ory-hydra2/templates/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ory-hydra2
+  namespace: faf-apps
+  labels:
+    app: ory-hydra2
+spec:
+  selector:
+    app: ory-hydra2
+  ports:
+    - name: public-port
+      port: 4444
+      targetPort: 4444
+    - name: admin-port
+      port: 4445
+      targetPort: 4445

cluster/argocd/Chart.yaml

@@ -3,5 +3,5 @@ name: argocd
 version: 1.0.0
 dependencies:
 - name: argo-cd
-  version: 7.6.12
+  version: 7.7.6
   repository: https://argoproj.github.io/argo-helm

cluster/argocd/templates/argocd-styles.yaml

@@ -0,0 +1,35 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-styles-cm
+data:
+  production-theme.css: |
+    .sidebar {
+      background: linear-gradient(to bottom, #660f0f, #100403);
+    }
+
+    .ui-banner {
+      background: linear-gradient(to right, #660f0f, #100403);
+      color: #fff;
+    }
+
+  test-theme.css: |
+    .sidebar {
+      background: linear-gradient(to bottom, #0f660f, #100403);
+    }
+
+    .ui-banner {
+      background: linear-gradient(to right, #0f660f, #100403);
+      color: #fff;
+    }
+
+  another-theme.css: |
+    .sidebar {
+      background: linear-gradient(to bottom, #0f660f, #100403);
+    }
+
+    .ui-banner {
+      background: linear-gradient(to right, #0f660f, #100403);
+      color: #fff;
+    }

cluster/argocd/values-test.yaml

@@ -22,6 +22,12 @@ argo-cd:
       # -- Timeout to discover if a new manifests version got published to the repository
       timeout.reconciliation: 180s
 
+      # Custom theme
+      ui.cssurl: "./custom/test-theme.css"
+      ui.bannercontent: "Test FAF cluster. Be careful."
+      ui.bannerpermanent: true
+      ui.bannerposition: "top"
+
       dex.config: |
         connectors:
         - type: github

cluster/argocd/values.yaml

@@ -16,16 +16,7 @@ argo-cd:
     networkPolicy:
       create: true
 
-  server:
-
-    config:
-      resource.customizations: |-
-        networking.k8s.io/Ingress:
-          health.lua: |
-            hs = {}
-            hs.status = "Healthy"
-            return hs
-
+  server:            
     # Avoids a permanent out of sync situation with Ingress resources
     metrics:
       enabled: true

cluster/telepresence/Chart.yaml

@@ -0,0 +1,7 @@
+apiVersion: v2
+name: telepresence
+version: 1.0.0
+dependencies:
+  - name: telepresence-oss
+    version: 2.20.2
+    repository: oci://ghcr.io/telepresenceio

cluster/telepresence/values.yaml

@@ -0,0 +1,3 @@
+namespace: telepresence
+telepresence:
+  releaseName: traffic-manager