add gke test cluster and bootstrap-v2

common/bootstrap-v2/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+type: application
+name: bootstrap-v2
+description: A Helm chart bootstrapping the cluster
+version: 0.2.0
+appVersion: 1.0.0

common/bootstrap-v2/templates/argocd-appproject-infra.yaml

@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: infra
+spec:
+  description: In-cluster applications managed by DevOps team
+  sourceRepos:
+  - '*'
+  destinations:
+  - namespace: '*'
+    server: https://kubernetes.default.svc
+  clusterResourceWhitelist:
+  - group: '*'
+    kind: '*'
+  namespaceResourceWhitelist:
+  - group: '*'
+    kind: '*'

common/bootstrap-v2/templates/argocd-secretstore.yaml

@@ -0,0 +1,20 @@
+apiVersion: external-secrets.io/v1beta1
+kind: SecretStore
+metadata:
+  name: argocd-secretstore
+  namespace: argocd
+spec:
+  provider:
+    {{- if eq .Values.provider "AWS" }}
+    aws:
+      service: SecretsManager
+      region: {{ .Values.AWS.region }}
+    {{- else if eq .Values.provider "GCP" }}
+    gcpsm:
+      projectID: {{ .Values.GCP.projectID }}
+    {{- else }}
+    fake:
+      data:
+      - key: {{ .Values.clusterName }}-argocd-github-ssh-client
+        value: '{"dex.github.clientId":"DUMMY","dex.github.clientSecret":""}'
+    {{- end }}

common/bootstrap-v2/templates/argocd.yaml

@@ -0,0 +1,75 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: argocd
+  namespace: argocd
+spec:
+  project: infra
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  source:
+    repoURL: https://argoproj.github.io/argo-helm
+    chart: argo-cd
+    targetRevision: 7.7.16
+    helm:
+      values: |-
+        global:
+          domain: {{ .Values.argocd.domain }}
+        controller:
+          replicas: 1
+        redis-ha:
+          enabled: true
+        repoServer:
+          autoscaling:
+            enabled: true
+        server:
+          autoscaling:
+            enabled: true
+          ingress:
+            enabled: true
+            ingressClassName: traefik
+        configs:
+          params:
+            server.insecure: true
+          rbac:
+            scopes: "[email, groups]"
+            policy.default: role:readonly
+            policy.csv: |
+              g, planetarium:DevOps, role:admin
+          cm:
+            admin.enabled: true
+            statusbadge.enabled: true
+            dex.config: |-
+              connectors:
+              - type: github
+                id: github
+                name: GitHub
+                config:
+                  orgs:
+                  - name: planetarium
+                  clientID: "$github-ssh-client:dex.github.clientId"
+                  clientSecret: "$github-ssh-client:dex.github.clientSecret"
+        extraObjects:
+        - apiVersion: external-secrets.io/v1beta1
+          kind: ExternalSecret
+          metadata:
+            name: github-ssh-client
+          spec:
+            refreshInterval: 1m
+            secretStoreRef:
+              kind: SecretStore
+              name: argocd-secretstore
+            target:
+              name: github-ssh-client
+              template:
+                metadata:
+                  labels:
+                    app.kubernetes.io/instance: argocd
+                    app.kubernetes.io/part-of: argocd
+            dataFrom:
+            - extract:
+                key: {{ .Values.clusterName }}-argocd-github-ssh-client

common/bootstrap-v2/templates/external-secrets.yaml

@@ -0,0 +1,28 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-secrets
+  namespace: argocd
+spec:
+  project: infra
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-secrets
+  source:
+    repoURL: https://charts.external-secrets.io
+    chart: external-secrets
+    targetRevision: 0.12.1
+    helm:
+      values: |-
+        certController:
+          create: false
+        webhook:
+          create: false
+        serviceAccount:
+          annotations:
+            {{- if eq .Values.provider "GCP" }}
+            iam.gke.io/gcp-service-account: external-secrets@{{ .Values.GCP.projectID }}.iam.gserviceaccount.com
+            {{- end }}

common/bootstrap-v2/templates/traefik.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: traefik
+  namespace: argocd
+spec:
+  project: infra
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: traefik
+  source:
+    repoURL: https://traefik.github.io/charts
+    chart: traefik
+    targetRevision: 34.1.0
+    helm:
+      values: |-
+        service:
+          annotations:
+            {{- with $.Values.global.service.annotations }}
+              {{- toYaml . | nindent 12 }}
+            {{- end }}

common/bootstrap-v2/values.yaml

@@ -0,0 +1,9 @@
+clusterName:
+provider:
+
+global:
+  service:
+    annotations:
+
+argocd:
+  domain:

gke-ninechronicles-internal/bootstrap.yaml

@@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: bootstrap
+  namespace: argocd
+spec:
+  project: infra
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  source:
+    repoURL: https://github.com/planetarium/9c-infra
+    targetRevision: gke
+    path: common/bootstrap-v2
+    helm:
+      values: |
+        clusterName: ninechronicles-internal-test-1
+        provider: GCP
+        GCP:
+          projectID: devops-test-445104
+        global:
+          service:
+            annotations:
+              cloud.google.com/network-tier: Standard
+        argocd:
+          domain: argocd-internal-gke.planetarium.network