Since I am sharing my configution publicly, I will be using sealed-secrets to encrypt certificates and passwords. In your lab environent you can just use your certs/passwords as normal - or I'd encourage you to experiment with sealed-secrets which is open-source/community supported.
After installing the cluster, we'll need to install ArgoCD and the Sealed Secrets Operator(optional). \
Apply the OpenShift GitOps Operator:
kubectl apply -k bootstrap/openshift-gitops/openshift-gitops-operator/base
Configure OpenShift GitOps.
kubectl apply -k bootstrap/openshift-gitops/base
For security, I'm running the sealed-secrets-operatator from the command line.
kustomize build bootstrap/sealed-secrets-operator/base | kubectl apply -f -
The filesystem is layed out like this:
openshift-cluster > cluster-name > argocd > manifests (direct the install to tasks on github)
openshift-cluster > cluster-name > argocd > tasks (initiates the apps for automation)
openshift-cluster > cluster-name > app-source > (installs the app and supporting configuration data) \
Kickoff the install and let the magic happen.
kubectl apply -k openshift-cluster/redcloud/argocd/apps/manifests/base
What's installed?
- The api-server is configured with a redcloud.land certificate
- The cluster-proxy is configured with the redcloud.land ca
- The ingress-controller is configured with a redclou.land wildcard certificate
- The "resource-locker" operator is installed can configured with the service-accounts for the above certificates and the internal registry.
- Setup the required node-labels.
- Configure Chrony using the default MachineConfigs
- The internal registry is patched.
- Configures OpenShift Virtualization (CNV) operator and subscription, addressed labeled 'cnv' nodes.
- Configures OAUTH for htpasswd and LDAP (Red Hat IdM) using the Group-Sync Operator.