diff --git a/charts/external-snapshotter/.helmignore b/charts/external-snapshotter/.helmignore new file mode 100644 index 00000000..0e8a0eb3 --- /dev/null +++ b/charts/external-snapshotter/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/external-snapshotter/Chart.yaml b/charts/external-snapshotter/Chart.yaml new file mode 100644 index 00000000..49a41ce8 --- /dev/null +++ b/charts/external-snapshotter/Chart.yaml @@ -0,0 +1,29 @@ +apiVersion: v2 +name: external-snapshotter +description: A Helm chart for Kubernetes + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.1.0 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "1.16.0" + +#dependencies: +#- name: velero +# version: 5.0.2 +# repository: "https://vmware-tanzu.github.io/helm-charts" diff --git a/charts/external-snapshotter/values.yaml b/charts/external-snapshotter/values.yaml new file mode 100644 index 00000000..e69de29b diff --git a/charts/infrastructure/templates/external-snapshotter.yaml b/charts/infrastructure/templates/external-snapshotter.yaml new file mode 100644 index 00000000..911167a4 --- /dev/null +++ b/charts/infrastructure/templates/external-snapshotter.yaml @@ -0,0 +1,70 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: external-snapshotter + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + destination: + name: '' + namespace: external-snapshotter + server: 'https://kubernetes.default.svc' + source: + path: charts/external-snapshotter + repoURL: 'https://gitlab.com/deepcypher/dc-kc.git' + targetRevision: HEAD + #helm: + # values: | + project: default + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ApplyOutOfSyncOnly=true +--- +apiVersion: argoproj.io/v1alpha1 +kind: AppProject +metadata: + name: external-snapshotter + namespace: argocd + # Finalizer that ensures that project is not deleted until it is not referenced by any application + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + description: Infra-level project to isolate external-snapshotter + # Allow manifests to deploy from any Git repos + sourceRepos: + - '*' + # Only permit applications to deploy to the guestbook namespace in the same cluster + destinations: + - namespace: external-snapshotter + server: https://kubernetes.default.svc + # Deny all cluster-scoped resources from being created, except for Namespace + clusterResourceWhitelist: + - group: '' + kind: Namespace + # Allow all namespaced-scoped resources to be created, except for ResourceQuota, LimitRange, NetworkPolicy + namespaceResourceBlacklist: + - group: '' + kind: ResourceQuota + - group: '' + kind: LimitRange + #- group: '' + # kind: NetworkPolicy + # # Deny all namespaced-scoped resources from being created, except for Deployment and StatefulSet + # namespaceResourceWhitelist: + # - group: 'apps' + # kind: Deployment + # - group: 'apps' + # kind: StatefulSet + roles: + # A role which provides read-only access to all applications in the project + - name: read-only + description: Read-only privileges to external-snapshotter + policies: + - p, proj:my-project:read-only, applications, get, external-snapshotter/*, allow + groups: + - my-oidc-group diff --git a/charts/velero/templates/s3-volume-snapshot.yaml b/charts/velero/templates/s3-volume-snapshot.yaml index da3b4005..909d3dff 100644 --- a/charts/velero/templates/s3-volume-snapshot.yaml +++ b/charts/velero/templates/s3-volume-snapshot.yaml @@ -1,21 +1,21 @@ -#apiVersion: velero.io/v1 -#kind: VolumeSnapshotLocation -#metadata: -# name: aws-default -# namespace: velero -#spec: -# # Name of the volume snapshotter plugin to use to connect to this location. -# # -# # Required. -# provider: velero.io/aws -# -# config: -# # The AWS region where the volumes/snapshots are located. -# # -# # Required. -# region: us-east-1 -# -# # AWS profile within the credentials file to use for the volume snapshot location. -# # -# # Optional (defaults to "default"). -# profile: "default" +apiVersion: velero.io/v1 +kind: VolumeSnapshotLocation +metadata: + name: aws-default + namespace: velero +spec: + # Name of the volume snapshotter plugin to use to connect to this location. + # + # Required. + provider: velero.io/aws + + config: + # The AWS region where the volumes/snapshots are located. + # + # Required. + region: "eu-west-2" + + # AWS profile within the credentials file to use for the volume snapshot location. + # + # Optional (defaults to "default"). + #profile: "default"