diff --git a/DEPLOYMENT_VERIFICATION.md b/DEPLOYMENT_VERIFICATION.md new file mode 100644 index 0000000..3fe184d --- /dev/null +++ b/DEPLOYMENT_VERIFICATION.md @@ -0,0 +1,479 @@ +# Post-Deployment Verification and Troubleshooting + +This guide describes the standard verification flow after deploying the Kubernetes platform with ArgoCD. It covers cluster validation, application health checks, Kubernetes object inspection, AWS authentication, and common troubleshooting steps for the GitOps deployment lifecycle. + +--- + +## 1. Confirm you are connected to the correct EKS cluster + +Start by verifying the active Kubernetes context: + +```bash +kubectl config current-context +``` + +You want the context to point to the correct AWS EKS cluster. If the command returns an unexpected cluster or no value, update the kubeconfig. + +### Check cluster reachability + +```bash +kubectl get nodes +``` + +Expected result: + +```text +NAME STATUS ROLES AGE +ip-10-0-1-45.ec2.internal Ready 3h +``` + +If you see any of the following: + +```text +No resources found +Unable to connect to the server +``` + +Then the cluster is either incorrect or kubeconfig is stale. + +### Refresh kubeconfig + +```bash +aws eks update-kubeconfig \ + --region \ + --name +``` + +Then confirm again: + +```bash +kubectl config current-context +kubectl get nodes +``` + +--- + +## 2. Verify AWS credentials and cluster identity + +Check the AWS identity used by your local environment: + +```bash +aws sts get-caller-identity +``` + +This confirms whether your AWS session is authenticated and associated with the expected account. + +Verify the EKS cluster is visible in the target region: + +```bash +aws eks list-clusters --region us-east-1 +``` + +If the AWS authentication plugin is failing, test it directly: + +```bash +aws eks get-token \ + --region us-east-1 \ + --cluster-name +``` + +If this command fails, the issue is usually related to: + +- expired AWS credentials +- incorrect IAM role assignment +- wrong AWS region +- missing CLI configuration + +--- + +## 3. Check whether ArgoCD applications exist + +Verify the ArgoCD Application resources: + +```bash +kubectl get applications -A +``` + +Expected output should look similar to: + +```text +NAMESPACE NAME SYNC STATUS HEALTH STATUS +argocd user-service Synced Healthy +argocd order-service Synced Healthy +argocd monitoring Synced Healthy +``` + +If no Application resources are present, the root application or ApplicationSet may not have been applied successfully. + +If you use the ArgoCD CLI, you can also verify with: + +```bash +argocd app list +``` + +An `OutOfSync` or missing application state usually means the manifests were not reconciled yet. + +--- + +## 4. Validate the ArgoCD control plane + +Check the ArgoCD namespace: + +```bash +kubectl get pods -n argocd +``` + +You should see components such as: + +```text +argocd-server +argocd-repo-server +argocd-application-controller +argocd-applicationset-controller +``` + +If the namespace does not exist, ArgoCD may not have been installed or bootstrapped correctly. + +Inspect the ArgoCD controller logs for reconciliation problems: + +```bash +kubectl logs -n argocd deployment/argocd-application-controller +``` + +This often reveals: + +- invalid Kustomize configuration +- missing namespaces +- invalid Git repository access +- manifest generation issues +- sync failures caused by bad YAML or resource naming + +If needed, force a refresh: + +```bash +kubectl annotate application \ + -n argocd \ + argocd.argoproj.io/refresh=hard \ + --overwrite +``` + +Inspect the application state: + +```bash +kubectl describe application -n argocd +``` + +--- + +## 5. Check project namespaces + +List all namespaces: + +```bash +kubectl get ns +``` + +You should see namespaces similar to: + +```text +argocd +user +order +payment +product +monitoring +``` + +If expected namespaces are missing, verify whether ArgoCD has created them from the applied manifests. + +--- + +## 6. Verify deployments and service availability + +Check all deployments across namespaces: + +```bash +kubectl get deployments -A +``` + +Expected pattern: + +```text +NAMESPACE NAME READY +order order-service 1/1 +user user-service 1/1 +``` + +If deployments exist but pods are not ready, inspect the deployment resource: + +```bash +kubectl describe deployment -n +``` + +Check pods: + +```bash +kubectl get pods -A +``` + +Common problem states: + +- Pending +- ImagePullBackOff +- CrashLoopBackOff +- Init:Error + +When a pod is unhealthy, inspect it: + +```bash +kubectl describe pod -n +kubectl logs -n +``` + +To view the previous container logs if the app restarted: + +```bash +kubectl logs -n --previous +``` + +--- + +## 7. Common deployment troubleshooting + +### Deployment exists but no pods are running + +This often indicates a scheduling or image issue. Verify the deployment status and inspect events: + +```bash +kubectl describe deployment -n +``` + +Look for problems such as: + +- insufficient resources +- image pull failures +- invalid volume mounts +- readiness probe failures +- node pressure or taints + +### Pods are stuck in Pending + +Check node capacity and scheduling constraints: + +```bash +kubectl get nodes +kubectl describe node +``` + +### Image pull failures + +```bash +kubectl describe pod -n +``` + +Typical causes include: + +- private ECR image permissions +- wrong image name or tag +- registry authentication issue + +### CrashLoopBackOff + +```bash +kubectl logs -n +``` + +Check whether the process is failing because of: + +- application startup errors +- missing environment variables +- secret/config map issues +- database connectivity failures + +--- + +## 8. Restart workloads after a failed sync or config change + +To restart a specific deployment: + +```bash +kubectl rollout restart deployment -n +``` + +For multiple services: + +```bash +kubectl rollout restart deployment order-service -n +kubectl rollout restart deployment payment-service -n +kubectl rollout restart deployment product-service -n +kubectl rollout restart deployment user-service -n +``` + +Restart all deployments in a namespace: + +```bash +kubectl rollout restart deployment -n +``` + +Monitor rollout status: + +```bash +kubectl rollout status deployment/ -n +``` + +--- + +## 9. Kyverno troubleshooting + +If Kyverno is causing issues, start by checking its namespace and workloads: + +```bash +kubectl get pods -n kyverno +``` + +Temporarily scale Kyverno down if needed: + +```bash +kubectl scale deployment -n kyverno --all --replicas=0 +``` + +Confirm pods are removed: + +```bash +kubectl get pods -n kyverno +``` + +Check Helm release records: + +```bash +kubectl get secret -n kyverno | grep sh.helm.release +``` + +If the Helm release metadata is corrupt, remove it: + +```bash +kubectl delete secret -n kyverno sh.helm.release.v1.kyverno.v1 +``` + +Disable Kyverno webhooks if needed: + +```bash +kubectl get validatingwebhookconfiguration | grep kyverno +kubectl get mutatingwebhookconfiguration | grep kyverno +``` + +Delete problematic resources if they are not recoverable: + +```bash +kubectl delete mutatingwebhookconfiguration \ + kyverno-policy-mutating-webhook-cfg \ + kyverno-resource-mutating-webhook-cfg \ + kyverno-verify-mutating-webhook-cfg + +kubectl delete validatingwebhookconfiguration \ + kyverno-cel-exception-validating-webhook-cfg \ + kyverno-cleanup-validating-webhook-cfg \ + kyverno-exception-validating-webhook-cfg \ + kyverno-global-context-validating-webhook-cfg \ + kyverno-policy-validating-webhook-cfg \ + kyverno-resource-validating-webhook-cfg \ + kyverno-ttl-validating-webhook-cfg +``` + +Finally, confirm Kyverno has been removed cleanly: + +```bash +kubectl get all -n kyverno +``` + +--- + +## 10. Monitoring and observability checks + +Check whether Prometheus and Grafana pods are running: + +```bash +kubectl get pods -n monitoring +``` + +Check exposed services: + +```bash +kubectl get svc -n monitoring +``` + +Port-forward Grafana locally: + +```bash +kubectl port-forward -n monitoring svc/kube-prometheus-stack-grafana 3000:80 +``` + +Open: + +```text +http://localhost:3000 +``` + +Retrieve the admin password: + +```bash +kubectl get secret -n monitoring \ + kube-prometheus-stack-grafana \ + -o jsonpath="{.data.admin-password}" | base64 --decode && echo +``` + +Port-forward Prometheus locally: + +```bash +kubectl port-forward -n monitoring svc/kube-prometheus-stack-prometheus 9090:9090 +``` + +Open: + +```text +http://localhost:9090 +``` + +--- + +## 11. Final deployment validation checklist + +Use this quick checklist after every deployment: + +```bash +kubectl config current-context +kubectl get nodes +kubectl get applications -A +kubectl get pods -A +kubectl get deployments -A +kubectl get svc -A +kubectl get ns +``` + +At minimum, the environment should show: + +- connected cluster context +- healthy nodes +- ArgoCD applications present +- expected namespaces created +- deployments ready +- pods running without crash loops +- platform services healthy + +--- + +## 12. Troubleshooting summary + +If the deployment is not working, follow this order: + +1. Confirm the correct cluster and kubeconfig +2. Verify AWS identity and EKS access +3. Check ArgoCD application presence and sync state +4. Inspect ArgoCD controller logs +5. Check namespaces, deployments, and pods +6. Review pod logs and events +7. Restart the affected deployment if needed +8. Validate monitoring services for platform health +9. Resolve Kyverno or policy issues when relevant + +This methodical approach quickly narrows the issue to either cluster access, ArgoCD reconciliation, Kubernetes resource health, or application runtime failures. diff --git a/README.md b/README.md index 3cc01c3..1cdd354 100644 --- a/README.md +++ b/README.md @@ -1,417 +1,375 @@ -# Kubernetes-argocd +# Kubernetes ArgoCD Platform -### Architecture +

+ + GitHub Actions Build Status + + ArgoCD GitOps + Kubernetes + AWS EKS + Multi-environment +

+A production-oriented GitOps control plane for deploying, governing, and operating the Ja-Mics application platform across multiple Kubernetes environments. This repository defines the ArgoCD application manifests, environment overlays, and platform services required to reconcile application workloads and shared infrastructure in a secure, repeatable, and auditable way. -### Action Runner Controller (ARC) - Self hosted runner +This repo works in conjunction with: +- Application source code: [ja-mics-ap](https://github.com/Emmy-github-webdev/ja-mics-ap) +- Infrastructure repository: internal enterprise infrastructure platform (AWS/EKS and supporting cloud resources) +- This GitOps repository: [Kubernetes-argocd](https://github.com/Emmy-github-webdev/Kubernetes-argocd) + +--- + +## Why this repository exists + +This repository exists to provide a declarative, version-controlled delivery model for enterprise workloads. Instead of applying Kubernetes manifests manually, teams commit desired state into Git, and ArgoCD continuously reconciles the live cluster to match that state. + +This approach improves: + +- Deployment consistency across environments +- Auditability and change traceability +- Faster rollback and recovery +- Security and policy enforcement through Git-based review workflows +- Standardized platform operations for multiple services + +The repository is designed for a multi-service architecture with shared platform components such as ingress, monitoring, logging, tracing, networking, storage, and security policy enforcement. + +--- + +## Drawbacks and considerations + +While GitOps is powerful, it is not without trade-offs: + +- Requires strong Git and CI/CD governance to prevent drift or misconfiguration +- Cluster access and secrets management must be tightly controlled +- ArgoCD introduces another operational dependency in the platform stack +- Multi-environment drift can occur if overlays are not reviewed carefully +- Platform changes can affect many teams if shared components are modified broadly + +These are manageable by using review policies, environment isolation, RBAC controls, and structured platform ownership. + +--- + +## Architecture + +The platform follows a GitOps-first operational model where application manifests and platform definitions are stored in Git and applied by ArgoCD to the target cluster. + +```mermaid +flowchart LR + A[GitHub Repositories] --> B[Infrastructure Repo] + A --> C[ja-mics-ap Source Repo] + A --> D[Kubernetes-argocd GitOps Repo] + + D --> E[ArgoCD ApplicationSets] + E --> F[Dev Cluster] + E --> G[Staging Cluster] + E --> H[Prod Cluster] + + C --> I[Container Image Build] + I --> J[Amazon ECR] + J --> F + J --> G + J --> H + + B --> K[AWS EKS / Networking / Security / Storage] + K --> F + K --> G + K --> H + + F --> L[Applications: user-service, order-service, payment-service, product-service] + G --> L + H --> L + + L --> M[Monitoring / Logging / Tracing / Ingress / Policy] +``` + +### Repository layout + +```text +Kubernetes-argocd/ +├── apps/ +│ ├── user-service/ +│ ├── order-service/ +│ ├── payment-service/ +│ └── product-service/ +├── argocd/ +│ ├── dev/ +│ ├── staging/ +│ └── prod/ +├── infrastructure/ +├── platform/ +│ ├── ingress/ +│ ├── monitoring/ +│ ├── logging/ +│ ├── tracing/ +│ ├── networking/ +│ ├── security/ +│ └── storage/ +├── .github/ +│ └── workflows/ +├── README.md +└── LICENSE (if added for production compliance) +``` + +### Included platform capabilities + +- Kubernetes application deployment via ArgoCD +- Multi-environment overlays for dev, staging, and prod +- Shared ingress and service exposure patterns +- Monitoring with Prometheus and Grafana +- Logging with Loki / Fluent Bit / Promtail +- Distributed tracing with Tempo and OpenTelemetry +- Policy enforcement with Kyverno +- Storage and CSI integrations for AWS-backed workloads +- Network security and ingress governance + +--- + +## Project status + +

+ Status + CI + Deploy + Environments +

+ +- Build status: [GitHub Actions](https://github.com/Emmy-github-webdev/Kubernetes-argocd/actions) +- Coverage: tracked as part of the application CI and release pipeline in the application repository +- Deployment model: GitOps with ArgoCD and Kustomize-based overlays + +--- + +## Quick start guide + +### Prerequisites + +Before deploying or modifying this platform, ensure you have the following: + +- Access to an AWS EKS cluster or equivalent Kubernetes cluster +- ArgoCD installed and bootstrapped in the target cluster +- kubectl configured for cluster access +- GitHub access to the repository and deployment workflows +- AWS credentials with permissions to manage EKS and supporting resources +- A working understanding of Kubernetes, Kustomize, and GitOps workflow practices +- A running application image registry such as Amazon ECR + +### Installation + +1. Clone the repository: + +```bash +git clone https://github.com/Emmy-github-webdev/Kubernetes-argocd.git +cd Kubernetes-argocd +``` + +2. Review the ArgoCD bootstrap definitions under the [argocd](argocd) folder. + +3. Apply the root ArgoCD application for the target environment: + +```bash +kubectl apply -f argocd/dev/root-app.yaml +``` + +4. Validate ArgoCD resources: + +```bash +kubectl get applications -n argocd +kubectl get applicationsets -n argocd +``` + +5. Confirm the platform and application workloads are reconciled successfully. + +--- + +## Basic usage examples + +### Apply the development GitOps root + +```bash +kubectl apply -f argocd/dev/root-app.yaml ``` - GitHub - │ - │ Workflow Dispatch - ▼ - Actions Runner Controller - (EKS) - │ - Creates ephemeral runner Pods - │ - ▼ - GitHub Runner Pod - (private subnet) - │ - ┌─────────────────┴─────────────────┐ - │ │ - ▼ ▼ -Terraform AWS Provider PostgreSQL Provider - │ │ - ▼ ▼ - AWS APIs Private RDS (5432) + +### Inspect ArgoCD application state + +```bash +kubectl get application -A +kubectl describe application dev-platform-root -n argocd ``` -### Steps - -1. Create a GitHub App -- Go to settings -- Developer settings -- GitHub Apps -- New GitHub App -- Permissions - - Repository - - Actions - read/Write - - Contents - Read - - Metadata - Read - - - Organization - - Self-hosted runners - - Read/Write -- Download private-key.pem after creation - private-key.pem. You will need - - App ID - - Installation ID - - Private Key - -2. Create namespace - - -Source Repo -├── user-service -├── order-service -├── payment-service -└── product-service - -↓ - -GitHub Actions - -↓ - -ECR - -↓ - -Kubernetes-argocd Repo -├── apps -│ ├── user-service -│ │ ├── base -| │ | ├── deployment.yaml -| │ | ├── kustomization.yaml -| │ | └── poddistruption.yaml -| │ | └── service.yaml -│ │ └── overlays -| │ | ├── dev -| | | | ├── external-secret-patch.yaml -| | | | ├── Image-patch.yaml -| | | | ├── kustomization.yaml -| │ | ├── staging -| │ | └── prod -│ ├── order-service -│ ├── payment-service -│ └── product-service -| -├── platform - │ - ├── monitoring - │ ├── base - │ │ ├── namespace.yaml - │ │ ├── kustomization.yaml - | │ ├── grafana/ - │ | │ ├── datasources.yaml - │ │ | ├── dashboardproviders.yaml - │ │ | └── dashboards/ - │ │ | ├── kubernetes.json - │ │ | ├── nodes.json - │ │ | ├── ingress-nginx.json - │ │ | ├── springboot.json - │ │ | ├── jvm.json - │ │ | ├── postgres.json - │ │ | └── redis.json - │ │ | - │ | | ├── alertmanager/ - │ │ | | ├── config.yaml - │ │ | | ├── receivers.yaml - │ │ | | ├── routes.yaml - │ │ | | ├── inhibit-rules.yaml - │ │ | └── templates/ - │ │ ├── slack.tmpl - │ │ └── email.tmpl - │ │ ├── servicemonitors/ - │ │ │ ├── order.yaml - │ │ │ ├── user.yaml - │ │ │ ├── payment.yaml - │ │ │ ├── ingress-nginx.yaml - │ │ │ ├── postgres.yaml - │ │ │ ├── redis.yaml - │ │ │ └── product.yaml - │ │ │ - │ │ └── prometheusrules/ - │ │ ├── high-cpu.yaml - │ │ ├── high-memory.yaml - │ │ ├── pod-restarts.yaml - │ │ ├── node-health.yaml - │ │ ├── api-errors.yaml - │ │ ├── latency.yaml - │ │ ├── disk-space.yaml - │ │ └── database-down.yaml - │ │ ├── recording-rules/ - │ │ │ ├── cluster.yaml - │ │ │ ├── nodes.yaml - │ │ │ ├── workloads.yaml - │ │ │ └── applications.yaml - │ │ ├── exporters/ - │ │ │ ├── blackbox-exporter.yaml - │ │ │ ├── postgres-exporter.yaml - │ │ │ ├── Redis-exporter.yaml - │ │ │ └── jmx-exporter.yaml - │ │ ├── exporters/ - │ │ │ └── allow-prometheus.yaml - │ │ - │ └── overlays - │ ├── dev - │ │ ├── kustomization.yaml - │ │ └── values-patch.yaml - │ │ - │ ├── staging - │ └── prod -│ - logging/ - ├── base/ - │ ├── namespace.yaml - │ ├── kustomization.yaml - │ │ - │ ├── loki/ - │ │ ├── helm-release.yaml - │ │ └── values.yaml - │ │ - │ ├── promtail/ - │ │ ├── helm-release.yaml - │ │ └── values.yaml - │ │ - │ ├── fluent-bit/ - │ │ ├── helm-release.yaml - │ │ └── values.yaml - │ │ - │ ├── log-retention/ - │ │ └── retention.yaml - │ │ - │ └── networkpolicy/ - │ └── allow-logging.yaml - │ - └── overlays/ - ├── dev/ - ├── staging/ - └── prod/ -| -| - tracing/ - ├── base/ - │ ├── namespace.yaml - │ ├── kustomization.yaml - │ │ - │ ├── tempo/ - │ │ ├── helm-release.yaml - │ │ └── values.yaml - │ │ - │ ├── opentelemetry-collector/ - │ │ ├── helm-release.yaml - │ │ ├── values.yaml - │ │ └── pipelines.yaml - │ │ - │ └── networkpolicy/ - │ └── allow-tracing.yaml - │ - └── overlays/ - ├── dev/ - ├── staging/ - └── prod/ -| -| - ingress/ - ├── base/ - │ ├── namespace.yaml - │ ├── kustomization.yaml - │ │ - │ ├── aws-load-balancer-controller/ - │ │ ├── helm-release.yaml - │ │ └── values.yaml - │ │ - │ ├── ingress-nginx/ - │ │ ├── helm-release.yaml - │ │ └── values.yaml - │ │ - │ ├── external-dns/ - │ │ ├── helm-release.yaml - │ │ └── values.yaml - │ │ - │ └── cert-manager/ - │ ├── helm-release.yaml - │ ├── values.yaml - │ └── clusterissuers/ - │ ├── letsencrypt-prod.yaml - │ └── letsencrypt-staging.yaml - │ - └── overlays/ - ├── dev/ - ├── staging/ - └── prod/ -| - security/ - ├── base/ - │ ├── namespace.yaml - │ ├── kustomization.yaml - │ │ - │ ├── kyverno/ - │ │ ├── helm-release.yaml - │ │ └── values.yaml - │ │ - │ ├── external-secrets/ - │ │ ├── helm-release.yaml - │ │ └── values.yaml - │ │ - │ ├── sealed-secrets/ - │ │ ├── helm-release.yaml - │ │ └── values.yaml - │ │ - │ ├── networkpolicies/ - │ │ - │ ├── podsecurity/ - │ │ - │ └── policies/ - │ ├── restrict-privileged.yaml - │ ├── require-limits.yaml - │ ├── require-probes.yaml - │ └── disallow-latest-tag.yaml - │ - └── overlays/ - ├── dev/ - ├── staging/ - └── prod/ -| -| - networking/ - ├── base/ - │ ├── namespace.yaml - │ ├── kustomization.yaml - │ │ - │ ├── cni/ - │ │ - │ ├── metrics-server/ - │ │ ├── helm-release.yaml - │ │ └── values.yaml - │ │ - │ ├── gateway-api/ - │ │ - │ ├── networkpolicies/ - │ │ - │ └── dns/ - │ └── coredns-patch.yaml - │ - └── overlays/ - ├── dev/ - ├── staging/ - └── prod/ -| -| -storage/ -├── base/ -│ ├── namespace.yaml -│ ├── kustomization.yaml -│ │ -│ ├── ebs-csi-driver/ -│ │ ├── helm-release.yaml -│ │ └── values.yaml -│ │ -│ ├── efs-csi-driver/ -│ │ ├── helm-release.yaml -│ │ └── values.yaml -│ │ -│ ├── storageclasses/ -│ │ ├── gp3.yaml -│ │ ├── efs.yaml -│ │ └── io2.yaml -│ │ -│ ├── volume-snapshots/ -│ │ ├── snapshotclass.yaml -│ │ └── schedules.yaml -│ │ -│ └── backup/ -│ ├── velero/ -│ │ ├── helm-release.yaml -│ │ └── values.yaml -│ └── backup-schedules.yaml -│ -└── overlays/ - ├── dev/ - ├── staging/ - └── prod/ -| -|___argocd -│ ├── dev -│ | ├── applicationset-apps.yaml -| | ├── applicationset-infra.yaml -| | ├── applicationset-monitoring.yaml -│ | └── root-app.yaml -| | -│ ├── prod -| | -│ ├── staging -| -|___infrastructure -│ | ├── dev -│ | | ├── postgres-master-secret.yaml -│ | | ├── order-db-secret.yaml -│ | | ├── user-db-secret.yaml -│ | | ├── payment-db-secret.yaml -│ | | ├── product-db-secret.yaml -│ | | └── postgres-bootstrap-job.yaml -│ | | ├── cluster-secret-store.yaml -│ | | ├── ingress.yaml -│ | | └── namespace-database.yaml -│ | ├── prod -│ | | -│ | ├── staging - - -↓ - -EKS -### App Repo GitHub Action - -name: Build - -on: - push: - branches: - - main - -jobs: - - build: -9949494944994/C runs-on: ubuntu-latest - - permissions: - id-token: write - contents: read - - steps: - - uses: actions/checkout@v4 - - - uses: aws-actions/configure-aws-credentials@v4 - with: - role-to-assume: arn:aws:iam:::role/github-ecr-push - aws-region: us-east-1 - - - uses: aws-actions/amazon-ecr-login@v2 - - - run: | - docker build -t my-app:${GITHUB_SHA} . - docker tag my-app:${GITHUB_SHA} $ECR_REPO:${GITHUB_SHA} - docker push $ECR_REPO:${GITHUB_SHA} - - - -Update GitOps repo - -After push - -- name: Update GitOps - run: | - yq -i '.spec.template.spec.containers[0].image = "'"$ECR_REPO:${GITHUB_SHA}"'"' deployment.yaml - - git commit -am "Deploy ${GITHUB_SHA}" - git push - - - - - -infrastructure - -├── dev -│ ├── postgres-master-secret.yaml -│ ├── order-db-secret.yaml -│ ├── user-db-secret.yaml -│ ├── payment-db-secret.yaml -│ ├── product-db-secret.yaml -│ └── postgres-bootstrap-job.yaml -│ ├── cluster-secret-store.yaml -│ ├── ingress.yaml -│ └── namespace-database.yaml +### Synced environment structure + +This repository supports environment-specific application layering via overlays: + +```bash +argocd/dev/ +argocd/staging/ +argocd/prod/ +``` + +Each environment can reconcile different application versions, settings, and infrastructure constraints while preserving a common platform foundation. + +--- + +## Architecture and deployment flow + +The deployment flow is intentionally simple and enterprise-friendly: + +1. Application source is maintained in the application repo. +2. Containers are built and pushed to the registry. +3. This GitOps repository declares the target state. +4. ArgoCD compares live cluster state with Git state. +5. Kubernetes resources are reconciled automatically. +6. Platform components and service workloads remain consistent across environments. + +This repository is the control plane layer that connects application delivery to operational governance. + +--- + +## Comprehensive documentation + +For deeper implementation details, refer to the structured repository folders and environment manifests: + +- [argocd](argocd) +- [apps](apps) +- [platform](platform) +- [infrastructure](infrastructure) +- [GitHub Actions workflow](.github/workflows/bootstrap-argocd.yml) + +This repository is intentionally organized so platform engineers, DevOps teams, and application teams can work from a common system of record. + +--- + +## Contributing guidelines + +Contributions are welcome. To keep the platform stable, please follow these norms: + +- Create feature branches from the main branch +- Keep changes scoped and environment-aware +- Validate YAML and Kustomize manifests before submission +- Use clear commit messages and meaningful PR descriptions +- Review security, networking, and observability impact before merging +- Ensure environment-specific changes are intentional and supported by the appropriate overlay + +Please open a pull request against the main branch and include a concise summary of the operational impact. + +--- + +## License + +This repository currently does not include a public license file in the root directory. Before production release or external distribution, it is recommended to add an appropriate enterprise license such as MIT, Apache 2.0, or a company-specific policy. + +If you are preparing for open-source publication, add a LICENSE file and update this section to match the selected license. + +--- + +## Technologies used + +- Kubernetes +- ArgoCD +- Kustomize +- GitHub Actions +- AWS EKS +- Prometheus +- Grafana +- Loki +- Tempo +- OpenTelemetry +- Kyverno +- NGINX Ingress / AWS load balancer patterns +- External Secrets / Secret Store integrations +- Docker / containerized microservices + +--- + +## Repository links + +- GitHub repository: [Kubernetes-argocd](https://github.com/Emmy-github-webdev/Kubernetes-argocd) +- GitHub Actions: [Workflow runs](https://github.com/Emmy-github-webdev/Kubernetes-argocd/actions) +- Application source repo: [ja-mics-ap](https://github.com/Emmy-github-webdev/ja-mics-ap) +- Infrastructure repo: enterprise internal infrastructure repository + +--- + +## Deployment verification + +After deployment, confirm the platform is healthy with the following checks. + +### 1. Verify cluster context and connectivity + +```bash +kubectl config current-context +kubectl get nodes +``` + +If you see `No resources found` or `Unable to connect to the server`, refresh the kubeconfig: + +```bash +aws eks update-kubeconfig \ + --region \ + --name +``` + +### 2. Check ArgoCD and application state + +```bash +kubectl get applications -A +kubectl get pods -n argocd +``` + +You should see ArgoCD pods and synced application resources in the `argocd` namespace. + +### 3. Verify namespaces and workloads + +```bash +kubectl get ns +kubectl get deployments -A +kubectl get pods -A +``` + +If pods are stuck in `Pending`, `ImagePullBackOff`, or `CrashLoopBackOff`, inspect the pod and logs: + +```bash +kubectl describe pod -n +kubectl logs -n +``` + +### 4. Troubleshoot common issues + +```bash +kubectl logs -n argocd deployment/argocd-application-controller +kubectl describe deployment -n +``` + +Typical causes include invalid Kustomize configuration, missing namespaces, image pull errors, secret issues, or Git access problems. + +### 5. Restart workloads if necessary + +```bash +kubectl rollout restart deployment -n +``` + +### 6. Validate monitoring stack + +```bash +kubectl get pods -n monitoring +kubectl get svc -n monitoring +``` + +For Grafana: + +```bash +kubectl port-forward -n monitoring svc/kube-prometheus-stack-grafana 3000:80 +``` + +Then open: + +```text +http://localhost:3000 +``` + +--- + +## Summary + +This repository is the GitOps backbone for an enterprise Kubernetes platform. It provides a secure, scalable, and auditable way to manage application delivery, platform components, and environment consistency across multiple deployments. The result is a modern operating model that fits the expectations of enterprise DevOps, platform engineering, and cloud-native delivery teams. diff --git a/README1.md b/README1.md new file mode 100644 index 0000000..43c9445 --- /dev/null +++ b/README1.md @@ -0,0 +1,458 @@ +# Kubernetes-argocd + +Building it this way will help you understand not only Kubernetes, but also how production platforms are assembled: GitOps, observability, security, networking, and application instrumentation. + +### Architecture + + +### Action Runner Controller (ARC) - Self hosted runner + +``` + GitHub + │ + │ Workflow Dispatch + ▼ + Actions Runner Controller + (EKS) + │ + Creates ephemeral runner Pods + │ + ▼ + GitHub Runner Pod + (private subnet) + │ + ┌─────────────────┴─────────────────┐ + │ │ + ▼ ▼ +Terraform AWS Provider PostgreSQL Provider + │ │ + ▼ ▼ + AWS APIs Private RDS (5432) +``` + +### Steps + +1. Create a GitHub App +- Go to settings +- Developer settings +- GitHub Apps +- New GitHub App +- Permissions + - Repository + - Actions - read/Write + - Contents - Read + - Metadata - Read + + - Organization + - Self-hosted runners + - Read/Write +- Download private-key.pem after creation - private-key.pem. You will need + - App ID + - Installation ID + - Private Key + +2. Create namespace + + +Source Repo +├── user-service +├── order-service +├── payment-service +└── product-service + +↓ + +GitHub Actions + +↓ + +ECR + +↓ + +Kubernetes-argocd Repo +├── apps +│ ├── user-service +│ │ ├── base +| │ | ├── deployment.yaml +| │ | ├── kustomization.yaml +| │ | └── poddistruption.yaml +| │ | └── service.yaml +│ │ └── overlays +| │ | ├── dev +| | | | ├── external-secret-patch.yaml +| | | | ├── Image-patch.yaml +| | | | ├── kustomization.yaml +| │ | ├── staging +| │ | └── prod +│ ├── order-service +│ ├── payment-service +│ └── product-service +| +├── platform + │ + ├── monitoring + │ ├── base + │ │ ├── namespace.yaml + │ │ ├── kustomization.yaml + | │ ├── grafana/ + │ | │ ├── datasources.yaml + │ │ | ├── dashboardproviders.yaml + │ │ | └── dashboards/ + │ │ | ├── kubernetes.json + │ │ | ├── nodes.json + │ │ | ├── ingress-nginx.json + │ │ | ├── springboot.json + │ │ | ├── jvm.json + │ │ | ├── postgres.json + │ │ | └── redis.json + │ │ | + │ | | ├── alertmanager/ + │ │ | | ├── config.yaml + │ │ | | ├── receivers.yaml + │ │ | | ├── routes.yaml + │ │ | | ├── inhibit-rules.yaml + │ │ | └── templates/ + │ │ ├── slack.tmpl + │ │ └── email.tmpl + │ │ ├── servicemonitors/ + │ │ │ ├── order.yaml + │ │ │ ├── user.yaml + │ │ │ ├── payment.yaml + │ │ │ ├── ingress-nginx.yaml + │ │ │ ├── postgres.yaml + │ │ │ ├── redis.yaml + │ │ │ └── product.yaml + │ │ │ + │ │ └── prometheusrules/ + │ │ ├── high-cpu.yaml + │ │ ├── high-memory.yaml + │ │ ├── pod-restarts.yaml + │ │ ├── node-health.yaml + │ │ ├── api-errors.yaml + │ │ ├── latency.yaml + │ │ ├── disk-space.yaml + │ │ ├── application-latency.yaml + │ │ ├── disk-pressure.yaml + │ │ ├── ingress-5xx.yaml + │ │ ├── node-not-ready.yaml + │ │ ├── pod-crashloop.yaml + │ │ ├── postgres-connections.yaml + │ │ ├── redis.yaml + │ │ ├── deployment-unavailable.yaml + │ │ └── database-down.yaml + │ │ ├── recording-rules/ + │ │ │ ├── cluster.yaml + │ │ │ ├── nodes.yaml + │ │ │ ├── workloads.yaml + │ │ │ └── applications.yaml + │ │ ├── exporters/ + │ │ │ ├── blackbox-exporter.yaml + │ │ │ ├── postgres-exporter.yaml + │ │ │ ├── Redis-exporter.yaml + │ │ │ └── jmx-exporter.yaml + │ │ ├── exporters/ + │ │ │ └── allow-prometheus.yaml + │ │ + │ └── overlays + │ ├── dev + │ │ ├── kustomization.yaml + │ │ └── values-patch.yaml + │ │ + │ ├── staging + │ └── prod +│ + logging/ + ├── base/ + │ ├── namespace.yaml + │ ├── kustomization.yaml + │ │ + │ ├── loki/ + │ │ ├── helm-release.yaml + │ │ └── values.yaml + │ │ + │ ├── promtail/ + │ │ ├── helm-release.yaml + │ │ └── values.yaml + │ │ + │ ├── fluent-bit/ + │ │ ├── helm-release.yaml + │ │ └── values.yaml + │ │ + │ ├── log-retention/ + │ │ └── retention.yaml + │ │ + │ └── networkpolicy/ + │ └── allow-logging.yaml + │ + └── overlays/ + ├── dev/ + ├── staging/ + └── prod/ +| +| + tracing/ + ├── base/ + │ ├── namespace.yaml + │ ├── kustomization.yaml + │ │ + │ ├── tempo/ + │ │ ├── helm-release.yaml + │ │ └── values.yaml + │ │ + │ ├── opentelemetry-collector/ + │ │ ├── helm-release.yaml + │ │ ├── values.yaml + │ │ └── pipelines.yaml + │ │ + │ └── networkpolicy/ + │ └── allow-tracing.yaml + │ + └── overlays/ + ├── dev/ + ├── staging/ + └── prod/ +| +| + ingress/ + ├── base/ + │ ├── namespace.yaml + │ ├── kustomization.yaml + │ │ + │ ├── aws-load-balancer-controller/ + │ │ ├── helm-release.yaml + │ │ └── values.yaml + │ │ + │ ├── ingress-nginx/ + │ │ ├── helm-release.yaml + │ │ └── values.yaml + │ │ + │ ├── external-dns/ + │ │ ├── helm-release.yaml + │ │ └── values.yaml + │ │ + │ └── cert-manager/ + │ ├── helm-release.yaml + │ ├── values.yaml + │ └── clusterissuers/ + │ ├── letsencrypt-prod.yaml + │ └── letsencrypt-staging.yaml + │ + └── overlays/ + ├── dev/ + ├── staging/ + └── prod/ +| + security/ + ├── base/ + │ ├── namespace.yaml + │ ├── kustomization.yaml + │ │ + │ ├── kyverno/ + │ │ ├── helm-release.yaml + │ │ └── values.yaml + │ │ + │ ├── external-secrets/ + │ │ ├── helm-release.yaml + │ │ └── values.yaml + │ │ + │ ├── sealed-secrets/ + │ │ ├── helm-release.yaml + │ │ └── values.yaml + │ │ + │ ├── networkpolicies/ + │ │ + │ ├── podsecurity/ + │ │ + │ └── policies/ + │ ├── restrict-privileged.yaml + │ ├── require-limits.yaml + │ ├── require-probes.yaml + │ └── disallow-latest-tag.yaml + │ + └── overlays/ + ├── dev/ + ├── staging/ + └── prod/ +| +| + networking/ + ├── base/ + │ ├── namespace.yaml + │ ├── kustomization.yaml + │ │ + │ ├── cni/ + │ │ + │ ├── metrics-server/ + │ │ ├── helm-release.yaml + │ │ └── values.yaml + │ │ + │ ├── gateway-api/ + │ │ + │ ├── networkpolicies/ + │ │ + │ └── dns/ + │ └── coredns-patch.yaml + │ + └── overlays/ + ├── dev/ + ├── staging/ + └── prod/ +| +| +storage/ +├── base/ +│ ├── namespace.yaml +│ ├── kustomization.yaml +│ │ +│ ├── ebs-csi-driver/ +│ │ ├── helm-release.yaml +│ │ └── values.yaml +│ │ +│ ├── efs-csi-driver/ +│ │ ├── helm-release.yaml +│ │ └── values.yaml +│ │ +│ ├── storageclasses/ +│ │ ├── gp3.yaml +│ │ ├── efs.yaml +│ │ └── io2.yaml +│ │ +│ ├── volume-snapshots/ +│ │ ├── snapshotclass.yaml +│ │ └── schedules.yaml +│ │ +│ └── backup/ +│ ├── velero/ +│ │ ├── helm-release.yaml +│ │ └── values.yaml +│ └── backup-schedules.yaml +│ +└── overlays/ + ├── dev/ + ├── staging/ + └── prod/ +| +|___argocd +│ ├── dev +│ | ├── applicationset-apps.yaml +| | ├── applicationset-infra.yaml +| | ├── applicationset-monitoring.yaml +│ | └── root-app.yaml +| | +│ ├── prod +| | +│ ├── staging +| +|___infrastructure +│ | ├── dev +│ | | ├── postgres-master-secret.yaml +│ | | ├── order-db-secret.yaml +│ | | ├── user-db-secret.yaml +│ | | ├── payment-db-secret.yaml +│ | | ├── product-db-secret.yaml +│ | | └── postgres-bootstrap-job.yaml +│ | | ├── cluster-secret-store.yaml +│ | | ├── ingress.yaml +│ | | └── namespace-database.yaml +│ | ├── prod +│ | | +│ | ├── staging + + +↓ + +EKS +### App Repo GitHub Action + +name: Build + +on: + push: + branches: + - main + +jobs: + + build: +9949494944994/C runs-on: ubuntu-latest + + permissions: + id-token: write + contents: read + + steps: + - uses: actions/checkout@v4 + + - uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: arn:aws:iam:::role/github-ecr-push + aws-region: us-east-1 + + - uses: aws-actions/amazon-ecr-login@v2 + + - run: | + docker build -t my-app:${GITHUB_SHA} . + docker tag my-app:${GITHUB_SHA} $ECR_REPO:${GITHUB_SHA} + docker push $ECR_REPO:${GITHUB_SHA} + + + +Update GitOps repo + +After push + +- name: Update GitOps + run: | + yq -i '.spec.template.spec.containers[0].image = "'"$ECR_REPO:${GITHUB_SHA}"'"' deployment.yaml + + git commit -am "Deploy ${GITHUB_SHA}" + git push + + + + + +infrastructure + +├── dev +│ ├── postgres-master-secret.yaml +│ ├── order-db-secret.yaml +│ ├── user-db-secret.yaml +│ ├── payment-db-secret.yaml +│ ├── product-db-secret.yaml +│ └── postgres-bootstrap-job.yaml +│ ├── cluster-secret-store.yaml +│ ├── ingress.yaml +│ └── namespace-database.yaml + + +platform/ +├── monitoring/ +│ ├── base/ +│ └── overlays/ +│ ├── dev/ +│ ├── staging/ +│ └── prod/ +├── logging/ +│ ├── base/ +│ └── overlays/ +│ ├── dev/ +│ ├── staging/ +│ └── prod/ +├── networking/ +│ ├── base/ +│ └── overlays/ +│ ├── dev/ +│ ├── staging/ +│ └── prod/ +└── tracing/ +| ├── base/ +| └── overlays/ +| ├── dev/ +| ├── staging/ +| └── prod/ +├── overlays/ +│ ├── dev/ +│ ├── staging/ +│ └── prod/ \ No newline at end of file diff --git a/apps/order-service/base/deployment.yaml b/apps/order-service/base/deployment.yaml index 0164a39..dd57db3 100644 --- a/apps/order-service/base/deployment.yaml +++ b/apps/order-service/base/deployment.yaml @@ -3,6 +3,10 @@ kind: Deployment metadata: name: order-service + annotations: + + instrumentation.opentelemetry.io/inject-java: "true" + spec: replicas: 2 @@ -22,6 +26,8 @@ spec: metadata: labels: app: order-service + networkpolicy.enabled: "true" + pdb.enabled: "true" spec: terminationGracePeriodSeconds: 30 @@ -97,6 +103,14 @@ spec: - containerPort: 8083 env: + - name: OTEL_SERVICE_NAME + value: order-service + + - name: OTEL_RESOURCE_ATTRIBUTES + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: DB_HOST valueFrom: secretKeyRef: diff --git a/apps/order-service/base/kustomization.yaml b/apps/order-service/base/kustomization.yaml index e81f6e6..07b93fb 100644 --- a/apps/order-service/base/kustomization.yaml +++ b/apps/order-service/base/kustomization.yaml @@ -4,4 +4,5 @@ kind: Kustomization resources: - deployment.yaml - service.yaml - - poddisruption.yaml \ No newline at end of file + - poddisruption.yaml + - networkpolicies/ \ No newline at end of file diff --git a/apps/order-service/base/networkpolicies/allow-dns.yaml b/apps/order-service/base/networkpolicies/allow-dns.yaml new file mode 100644 index 0000000..bb0229a --- /dev/null +++ b/apps/order-service/base/networkpolicies/allow-dns.yaml @@ -0,0 +1,31 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-dns + +spec: + podSelector: + matchLabels: + app: order-service + + policyTypes: + - Egress + + egress: + - to: + + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + + podSelector: + matchLabels: + k8s-app: kube-dns + + ports: + - protocol: UDP + port: 53 + + - protocol: TCP + port: 53 \ No newline at end of file diff --git a/apps/order-service/base/networkpolicies/allow-ingress.yaml b/apps/order-service/base/networkpolicies/allow-ingress.yaml new file mode 100644 index 0000000..7487894 --- /dev/null +++ b/apps/order-service/base/networkpolicies/allow-ingress.yaml @@ -0,0 +1,24 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-ingress + +spec: + podSelector: + matchLabels: + app: order-service + + policyTypes: + - Ingress + + ingress: + - from: + + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: ingress-system + + ports: + - protocol: TCP + port: 8083 \ No newline at end of file diff --git a/apps/order-service/base/networkpolicies/allow-postgres.yaml b/apps/order-service/base/networkpolicies/allow-postgres.yaml new file mode 100644 index 0000000..f318b06 --- /dev/null +++ b/apps/order-service/base/networkpolicies/allow-postgres.yaml @@ -0,0 +1,23 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-postgres + +spec: + podSelector: + matchLabels: + app: order-service + + policyTypes: + - Egress + + egress: + - to: + - podSelector: + matchLabels: + app.kubernetes.io/name: postgresql + + ports: + - protocol: TCP + port: 5432 \ No newline at end of file diff --git a/apps/order-service/base/networkpolicies/allow-prometheus.yaml b/apps/order-service/base/networkpolicies/allow-prometheus.yaml new file mode 100644 index 0000000..fb2bcf7 --- /dev/null +++ b/apps/order-service/base/networkpolicies/allow-prometheus.yaml @@ -0,0 +1,28 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-prometheus + +spec: + podSelector: + matchLabels: + app: order-service + + policyTypes: + - Ingress + + ingress: + - from: + + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: monitoring + + podSelector: + matchLabels: + app.kubernetes.io/name: prometheus + + ports: + - protocol: TCP + port: 8083 \ No newline at end of file diff --git a/apps/order-service/base/networkpolicies/allow-redis.yaml b/apps/order-service/base/networkpolicies/allow-redis.yaml new file mode 100644 index 0000000..d15cfb2 --- /dev/null +++ b/apps/order-service/base/networkpolicies/allow-redis.yaml @@ -0,0 +1,23 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-redis + +spec: + podSelector: + matchLabels: + app: order-service + + policyTypes: + - Egress + + egress: + - to: + - podSelector: + matchLabels: + app.kubernetes.io/name: redis + + ports: + - protocol: TCP + port: 6379 \ No newline at end of file diff --git a/apps/order-service/base/networkpolicies/default-deny.yaml b/apps/order-service/base/networkpolicies/default-deny.yaml new file mode 100644 index 0000000..34ec623 --- /dev/null +++ b/apps/order-service/base/networkpolicies/default-deny.yaml @@ -0,0 +1,12 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: default-deny + +spec: + podSelector: {} + + policyTypes: + - Ingress + - Egress \ No newline at end of file diff --git a/apps/order-service/base/networkpolicies/kustomization.yaml b/apps/order-service/base/networkpolicies/kustomization.yaml new file mode 100644 index 0000000..d603926 --- /dev/null +++ b/apps/order-service/base/networkpolicies/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - default-deny.yaml + - allow-ingress.yaml + - allow-dns.yaml + - allow-prometheus.yaml \ No newline at end of file diff --git a/apps/order-service/overlays/dev/kustomization.yaml b/apps/order-service/overlays/dev/kustomization.yaml index 47c5a38..589e46e 100644 --- a/apps/order-service/overlays/dev/kustomization.yaml +++ b/apps/order-service/overlays/dev/kustomization.yaml @@ -10,7 +10,7 @@ namespace: dev images: - name: 579871530627.dkr.ecr.us-east-1.amazonaws.com/ja-mics-ap/order-service newName: 579871530627.dkr.ecr.us-east-1.amazonaws.com/ja-mics-ap/order-service - newTag: 345d54e836039442ab120287b7961cd092761182 + newTag: 75c566e3063d58803f614facda8a3a6e0df6e812 replicas: - count: 1 diff --git a/apps/payment-service/base/deployment.yaml b/apps/payment-service/base/deployment.yaml index 1897ce4..386bdd6 100644 --- a/apps/payment-service/base/deployment.yaml +++ b/apps/payment-service/base/deployment.yaml @@ -3,6 +3,10 @@ kind: Deployment metadata: name: payment-service + annotations: + + instrumentation.opentelemetry.io/inject-java: "true" + spec: replicas: 2 @@ -22,6 +26,8 @@ spec: metadata: labels: app: payment-service + networkpolicy.enabled: "true" + pdb.enabled: "true" spec: terminationGracePeriodSeconds: 30 @@ -97,6 +103,14 @@ spec: - containerPort: 8084 env: + - name: OTEL_SERVICE_NAME + value: payment-service + + - name: OTEL_RESOURCE_ATTRIBUTES + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: DB_HOST valueFrom: secretKeyRef: diff --git a/apps/payment-service/base/kustomization.yaml b/apps/payment-service/base/kustomization.yaml index e81f6e6..07b93fb 100644 --- a/apps/payment-service/base/kustomization.yaml +++ b/apps/payment-service/base/kustomization.yaml @@ -4,4 +4,5 @@ kind: Kustomization resources: - deployment.yaml - service.yaml - - poddisruption.yaml \ No newline at end of file + - poddisruption.yaml + - networkpolicies/ \ No newline at end of file diff --git a/apps/payment-service/base/networkpolicies/allow-dns.yaml b/apps/payment-service/base/networkpolicies/allow-dns.yaml new file mode 100644 index 0000000..bb0229a --- /dev/null +++ b/apps/payment-service/base/networkpolicies/allow-dns.yaml @@ -0,0 +1,31 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-dns + +spec: + podSelector: + matchLabels: + app: order-service + + policyTypes: + - Egress + + egress: + - to: + + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + + podSelector: + matchLabels: + k8s-app: kube-dns + + ports: + - protocol: UDP + port: 53 + + - protocol: TCP + port: 53 \ No newline at end of file diff --git a/apps/payment-service/base/networkpolicies/allow-ingress.yaml b/apps/payment-service/base/networkpolicies/allow-ingress.yaml new file mode 100644 index 0000000..9b98e09 --- /dev/null +++ b/apps/payment-service/base/networkpolicies/allow-ingress.yaml @@ -0,0 +1,24 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-ingress + +spec: + podSelector: + matchLabels: + app: order-service + + policyTypes: + - Ingress + + ingress: + - from: + + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: ingress-system + + ports: + - protocol: TCP + port: 8084 \ No newline at end of file diff --git a/apps/payment-service/base/networkpolicies/allow-postgres.yaml b/apps/payment-service/base/networkpolicies/allow-postgres.yaml new file mode 100644 index 0000000..f318b06 --- /dev/null +++ b/apps/payment-service/base/networkpolicies/allow-postgres.yaml @@ -0,0 +1,23 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-postgres + +spec: + podSelector: + matchLabels: + app: order-service + + policyTypes: + - Egress + + egress: + - to: + - podSelector: + matchLabels: + app.kubernetes.io/name: postgresql + + ports: + - protocol: TCP + port: 5432 \ No newline at end of file diff --git a/apps/payment-service/base/networkpolicies/allow-prometheus.yaml b/apps/payment-service/base/networkpolicies/allow-prometheus.yaml new file mode 100644 index 0000000..1a1b5b7 --- /dev/null +++ b/apps/payment-service/base/networkpolicies/allow-prometheus.yaml @@ -0,0 +1,28 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-prometheus + +spec: + podSelector: + matchLabels: + app: order-service + + policyTypes: + - Ingress + + ingress: + - from: + + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: monitoring + + podSelector: + matchLabels: + app.kubernetes.io/name: prometheus + + ports: + - protocol: TCP + port: 8084 \ No newline at end of file diff --git a/apps/payment-service/base/networkpolicies/allow-redis.yaml b/apps/payment-service/base/networkpolicies/allow-redis.yaml new file mode 100644 index 0000000..d15cfb2 --- /dev/null +++ b/apps/payment-service/base/networkpolicies/allow-redis.yaml @@ -0,0 +1,23 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-redis + +spec: + podSelector: + matchLabels: + app: order-service + + policyTypes: + - Egress + + egress: + - to: + - podSelector: + matchLabels: + app.kubernetes.io/name: redis + + ports: + - protocol: TCP + port: 6379 \ No newline at end of file diff --git a/apps/payment-service/base/networkpolicies/default-deny.yaml b/apps/payment-service/base/networkpolicies/default-deny.yaml new file mode 100644 index 0000000..34ec623 --- /dev/null +++ b/apps/payment-service/base/networkpolicies/default-deny.yaml @@ -0,0 +1,12 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: default-deny + +spec: + podSelector: {} + + policyTypes: + - Ingress + - Egress \ No newline at end of file diff --git a/apps/payment-service/base/networkpolicies/kustomization.yaml b/apps/payment-service/base/networkpolicies/kustomization.yaml new file mode 100644 index 0000000..d603926 --- /dev/null +++ b/apps/payment-service/base/networkpolicies/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - default-deny.yaml + - allow-ingress.yaml + - allow-dns.yaml + - allow-prometheus.yaml \ No newline at end of file diff --git a/apps/payment-service/overlays/dev/kustomization.yaml b/apps/payment-service/overlays/dev/kustomization.yaml index f663cfa..cac6480 100644 --- a/apps/payment-service/overlays/dev/kustomization.yaml +++ b/apps/payment-service/overlays/dev/kustomization.yaml @@ -7,7 +7,7 @@ namespace: dev images: - name: 579871530627.dkr.ecr.us-east-1.amazonaws.com/ja-mics-ap/payment-service newName: 579871530627.dkr.ecr.us-east-1.amazonaws.com/ja-mics-ap/payment-service - newTag: 345d54e836039442ab120287b7961cd092761182 + newTag: 75c566e3063d58803f614facda8a3a6e0df6e812 diff --git a/apps/product-service/base/deployment.yaml b/apps/product-service/base/deployment.yaml index ae78343..04a3ff1 100644 --- a/apps/product-service/base/deployment.yaml +++ b/apps/product-service/base/deployment.yaml @@ -3,6 +3,10 @@ kind: Deployment metadata: name: product-service + annotations: + + instrumentation.opentelemetry.io/inject-java: "true" + spec: replicas: 2 @@ -22,6 +26,8 @@ spec: metadata: labels: app: product-service + networkpolicy.enabled: "true" + pdb.enabled: "true" spec: terminationGracePeriodSeconds: 30 @@ -97,6 +103,14 @@ spec: - containerPort: 8082 env: + - name: OTEL_SERVICE_NAME + value: product-service + + - name: OTEL_RESOURCE_ATTRIBUTES + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: DB_HOST valueFrom: secretKeyRef: diff --git a/apps/product-service/base/kustomization.yaml b/apps/product-service/base/kustomization.yaml index e81f6e6..07b93fb 100644 --- a/apps/product-service/base/kustomization.yaml +++ b/apps/product-service/base/kustomization.yaml @@ -4,4 +4,5 @@ kind: Kustomization resources: - deployment.yaml - service.yaml - - poddisruption.yaml \ No newline at end of file + - poddisruption.yaml + - networkpolicies/ \ No newline at end of file diff --git a/apps/product-service/base/networkpolicies/allow-dns.yaml b/apps/product-service/base/networkpolicies/allow-dns.yaml new file mode 100644 index 0000000..bb0229a --- /dev/null +++ b/apps/product-service/base/networkpolicies/allow-dns.yaml @@ -0,0 +1,31 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-dns + +spec: + podSelector: + matchLabels: + app: order-service + + policyTypes: + - Egress + + egress: + - to: + + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + + podSelector: + matchLabels: + k8s-app: kube-dns + + ports: + - protocol: UDP + port: 53 + + - protocol: TCP + port: 53 \ No newline at end of file diff --git a/apps/product-service/base/networkpolicies/allow-ingress.yaml b/apps/product-service/base/networkpolicies/allow-ingress.yaml new file mode 100644 index 0000000..6d6279f --- /dev/null +++ b/apps/product-service/base/networkpolicies/allow-ingress.yaml @@ -0,0 +1,24 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-ingress + +spec: + podSelector: + matchLabels: + app: order-service + + policyTypes: + - Ingress + + ingress: + - from: + + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: ingress-system + + ports: + - protocol: TCP + port: 8082 \ No newline at end of file diff --git a/apps/product-service/base/networkpolicies/allow-postgres.yaml b/apps/product-service/base/networkpolicies/allow-postgres.yaml new file mode 100644 index 0000000..f318b06 --- /dev/null +++ b/apps/product-service/base/networkpolicies/allow-postgres.yaml @@ -0,0 +1,23 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-postgres + +spec: + podSelector: + matchLabels: + app: order-service + + policyTypes: + - Egress + + egress: + - to: + - podSelector: + matchLabels: + app.kubernetes.io/name: postgresql + + ports: + - protocol: TCP + port: 5432 \ No newline at end of file diff --git a/apps/product-service/base/networkpolicies/allow-prometheus.yaml b/apps/product-service/base/networkpolicies/allow-prometheus.yaml new file mode 100644 index 0000000..3beb9d4 --- /dev/null +++ b/apps/product-service/base/networkpolicies/allow-prometheus.yaml @@ -0,0 +1,28 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-prometheus + +spec: + podSelector: + matchLabels: + app: order-service + + policyTypes: + - Ingress + + ingress: + - from: + + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: monitoring + + podSelector: + matchLabels: + app.kubernetes.io/name: prometheus + + ports: + - protocol: TCP + port: 8082 \ No newline at end of file diff --git a/apps/product-service/base/networkpolicies/allow-redis.yaml b/apps/product-service/base/networkpolicies/allow-redis.yaml new file mode 100644 index 0000000..d15cfb2 --- /dev/null +++ b/apps/product-service/base/networkpolicies/allow-redis.yaml @@ -0,0 +1,23 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-redis + +spec: + podSelector: + matchLabels: + app: order-service + + policyTypes: + - Egress + + egress: + - to: + - podSelector: + matchLabels: + app.kubernetes.io/name: redis + + ports: + - protocol: TCP + port: 6379 \ No newline at end of file diff --git a/apps/product-service/base/networkpolicies/default-deny.yaml b/apps/product-service/base/networkpolicies/default-deny.yaml new file mode 100644 index 0000000..34ec623 --- /dev/null +++ b/apps/product-service/base/networkpolicies/default-deny.yaml @@ -0,0 +1,12 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: default-deny + +spec: + podSelector: {} + + policyTypes: + - Ingress + - Egress \ No newline at end of file diff --git a/apps/product-service/base/networkpolicies/kustomization.yaml b/apps/product-service/base/networkpolicies/kustomization.yaml new file mode 100644 index 0000000..d603926 --- /dev/null +++ b/apps/product-service/base/networkpolicies/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - default-deny.yaml + - allow-ingress.yaml + - allow-dns.yaml + - allow-prometheus.yaml \ No newline at end of file diff --git a/apps/product-service/overlays/dev/kustomization.yaml b/apps/product-service/overlays/dev/kustomization.yaml index 40bfdbd..8dd3f3d 100644 --- a/apps/product-service/overlays/dev/kustomization.yaml +++ b/apps/product-service/overlays/dev/kustomization.yaml @@ -7,7 +7,7 @@ namespace: dev images: - name: 579871530627.dkr.ecr.us-east-1.amazonaws.com/ja-mics-ap/product-service newName: 579871530627.dkr.ecr.us-east-1.amazonaws.com/ja-mics-ap/product-service - newTag: 345d54e836039442ab120287b7961cd092761182 + newTag: 75c566e3063d58803f614facda8a3a6e0df6e812 diff --git a/apps/user-service/base/deployment.yaml b/apps/user-service/base/deployment.yaml index 1daef37..b6f4b58 100644 --- a/apps/user-service/base/deployment.yaml +++ b/apps/user-service/base/deployment.yaml @@ -3,6 +3,10 @@ kind: Deployment metadata: name: user-service + annotations: + + instrumentation.opentelemetry.io/inject-java: "true" + spec: replicas: 2 @@ -22,6 +26,8 @@ spec: metadata: labels: app: user-service + networkpolicy.enabled: "true" + pdb.enabled: "true" spec: terminationGracePeriodSeconds: 30 @@ -97,6 +103,14 @@ spec: - containerPort: 8081 env: + - name: OTEL_SERVICE_NAME + value: user-service + + - name: OTEL_RESOURCE_ATTRIBUTES + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: DB_HOST valueFrom: secretKeyRef: diff --git a/apps/user-service/base/kustomization.yaml b/apps/user-service/base/kustomization.yaml index e81f6e6..07b93fb 100644 --- a/apps/user-service/base/kustomization.yaml +++ b/apps/user-service/base/kustomization.yaml @@ -4,4 +4,5 @@ kind: Kustomization resources: - deployment.yaml - service.yaml - - poddisruption.yaml \ No newline at end of file + - poddisruption.yaml + - networkpolicies/ \ No newline at end of file diff --git a/apps/user-service/base/networkpolicies/allow-dns.yaml b/apps/user-service/base/networkpolicies/allow-dns.yaml new file mode 100644 index 0000000..bb0229a --- /dev/null +++ b/apps/user-service/base/networkpolicies/allow-dns.yaml @@ -0,0 +1,31 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-dns + +spec: + podSelector: + matchLabels: + app: order-service + + policyTypes: + - Egress + + egress: + - to: + + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + + podSelector: + matchLabels: + k8s-app: kube-dns + + ports: + - protocol: UDP + port: 53 + + - protocol: TCP + port: 53 \ No newline at end of file diff --git a/apps/user-service/base/networkpolicies/allow-ingress.yaml b/apps/user-service/base/networkpolicies/allow-ingress.yaml new file mode 100644 index 0000000..a74ea2d --- /dev/null +++ b/apps/user-service/base/networkpolicies/allow-ingress.yaml @@ -0,0 +1,24 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-ingress + +spec: + podSelector: + matchLabels: + app: order-service + + policyTypes: + - Ingress + + ingress: + - from: + + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: ingress-system + + ports: + - protocol: TCP + port: 8081 \ No newline at end of file diff --git a/apps/user-service/base/networkpolicies/allow-postgres.yaml b/apps/user-service/base/networkpolicies/allow-postgres.yaml new file mode 100644 index 0000000..f318b06 --- /dev/null +++ b/apps/user-service/base/networkpolicies/allow-postgres.yaml @@ -0,0 +1,23 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-postgres + +spec: + podSelector: + matchLabels: + app: order-service + + policyTypes: + - Egress + + egress: + - to: + - podSelector: + matchLabels: + app.kubernetes.io/name: postgresql + + ports: + - protocol: TCP + port: 5432 \ No newline at end of file diff --git a/apps/user-service/base/networkpolicies/allow-prometheus.yaml b/apps/user-service/base/networkpolicies/allow-prometheus.yaml new file mode 100644 index 0000000..b619cde --- /dev/null +++ b/apps/user-service/base/networkpolicies/allow-prometheus.yaml @@ -0,0 +1,28 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-prometheus + +spec: + podSelector: + matchLabels: + app: order-service + + policyTypes: + - Ingress + + ingress: + - from: + + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: monitoring + + podSelector: + matchLabels: + app.kubernetes.io/name: prometheus + + ports: + - protocol: TCP + port: 8081 \ No newline at end of file diff --git a/apps/user-service/base/networkpolicies/allow-redis.yaml b/apps/user-service/base/networkpolicies/allow-redis.yaml new file mode 100644 index 0000000..d15cfb2 --- /dev/null +++ b/apps/user-service/base/networkpolicies/allow-redis.yaml @@ -0,0 +1,23 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-redis + +spec: + podSelector: + matchLabels: + app: order-service + + policyTypes: + - Egress + + egress: + - to: + - podSelector: + matchLabels: + app.kubernetes.io/name: redis + + ports: + - protocol: TCP + port: 6379 \ No newline at end of file diff --git a/apps/user-service/base/networkpolicies/default-deny.yaml b/apps/user-service/base/networkpolicies/default-deny.yaml new file mode 100644 index 0000000..34ec623 --- /dev/null +++ b/apps/user-service/base/networkpolicies/default-deny.yaml @@ -0,0 +1,12 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: default-deny + +spec: + podSelector: {} + + policyTypes: + - Ingress + - Egress \ No newline at end of file diff --git a/apps/user-service/base/networkpolicies/kustomization.yaml b/apps/user-service/base/networkpolicies/kustomization.yaml new file mode 100644 index 0000000..d603926 --- /dev/null +++ b/apps/user-service/base/networkpolicies/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - default-deny.yaml + - allow-ingress.yaml + - allow-dns.yaml + - allow-prometheus.yaml \ No newline at end of file diff --git a/apps/user-service/overlays/dev/kustomization.yaml b/apps/user-service/overlays/dev/kustomization.yaml index d6ffecf..578738a 100644 --- a/apps/user-service/overlays/dev/kustomization.yaml +++ b/apps/user-service/overlays/dev/kustomization.yaml @@ -7,7 +7,7 @@ namespace: dev images: - name: 579871530627.dkr.ecr.us-east-1.amazonaws.com/ja-mics-ap/user-service newName: 579871530627.dkr.ecr.us-east-1.amazonaws.com/ja-mics-ap/user-service - newTag: 345d54e836039442ab120287b7961cd092761182 + newTag: 75c566e3063d58803f614facda8a3a6e0df6e812 diff --git a/argocd/dev/applicationset-apps.yaml b/argocd/dev/applicationset-apps.yaml index 516f6ee..5c48ad1 100644 --- a/argocd/dev/applicationset-apps.yaml +++ b/argocd/dev/applicationset-apps.yaml @@ -36,5 +36,4 @@ spec: selfHeal: true syncOptions: - - CreateNamespace=true - \ No newline at end of file + - CreateNamespace=true \ No newline at end of file diff --git a/argocd/dev/applicationset-infra.yaml b/argocd/dev/applicationset-infra.yaml index 7c553f8..3204bb9 100644 --- a/argocd/dev/applicationset-infra.yaml +++ b/argocd/dev/applicationset-infra.yaml @@ -34,5 +34,4 @@ spec: prune: true selfHeal: true syncOptions: - - CreateNamespace=true - \ No newline at end of file + - CreateNamespace=true \ No newline at end of file diff --git a/argocd/dev/applicationset-monitoring.txt b/argocd/dev/applicationset-monitoring.yaml similarity index 70% rename from argocd/dev/applicationset-monitoring.txt rename to argocd/dev/applicationset-monitoring.yaml index 6ea8e06..643c001 100644 --- a/argocd/dev/applicationset-monitoring.txt +++ b/argocd/dev/applicationset-monitoring.yaml @@ -10,8 +10,8 @@ spec: - list: elements: - name: monitoring - path: platform/monitoring/overlays/dev - namespace: monitoring + path: platform/overlays/dev + namespace: dev template: metadata: @@ -32,4 +32,4 @@ spec: syncPolicy: automated: prune: true - selfHeal: true \ No newline at end of file + selfHeal: true \ No newline at end of file diff --git a/argocd/dev/kustomization.yaml b/argocd/dev/kustomization.yaml index 2925759..e63013f 100644 --- a/argocd/dev/kustomization.yaml +++ b/argocd/dev/kustomization.yaml @@ -4,5 +4,4 @@ kind: Kustomization resources: - applicationset-apps.yaml - applicationset-infra.yaml - # - applicationset-monitoring.yaml - \ No newline at end of file + - applicationset-monitoring.yaml \ No newline at end of file diff --git a/argocd/dev/root-app.yaml b/argocd/dev/root-app.yaml index b57edb5..91670e8 100644 --- a/argocd/dev/root-app.yaml +++ b/argocd/dev/root-app.yaml @@ -20,5 +20,4 @@ spec: syncPolicy: automated: prune: true - selfHeal: true - \ No newline at end of file + selfHeal: true \ No newline at end of file diff --git a/infrastructure/overlay/dev/ingress.yaml b/infrastructure/overlay/dev/ingress.yaml index 9979c41..13ad1f8 100644 --- a/infrastructure/overlay/dev/ingress.yaml +++ b/infrastructure/overlay/dev/ingress.yaml @@ -11,11 +11,12 @@ metadata: # HTTPS configuration alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80},{"HTTPS":443}]' - alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:579871530627:certificate/eb8a2976-d497-462a-8bd1-2603b0309ec2 + alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:579871530627:certificate/220f82b0-2c72-4b01-b620-741cfbba00d9 # Redirect HTTP to HTTPS alb.ingress.kubernetes.io/ssl-redirect: '443' + external-dns.alpha.kubernetes.io/hostname: api.dev.emmanuelogah.com spec: ingressClassName: alb diff --git a/infrastructure/overlay/dev/kustomization.yaml b/infrastructure/overlay/dev/kustomization.yaml index 02644f2..b63b382 100644 --- a/infrastructure/overlay/dev/kustomization.yaml +++ b/infrastructure/overlay/dev/kustomization.yaml @@ -10,8 +10,6 @@ resources: - order-db-secret.yaml - payment-db-secret.yaml - postgres-master-secret.yaml - - product-db-secret.yaml - - user-db-secret.yaml - external-secrets-sa.yaml - redis-secret.yaml - job.yaml \ No newline at end of file diff --git a/infrastructure/overlay/dev/user-db-secret.yaml b/infrastructure/overlay/dev/user-db-secret.yaml index a4a7a4b..c8d51a9 100644 --- a/infrastructure/overlay/dev/user-db-secret.yaml +++ b/infrastructure/overlay/dev/user-db-secret.yaml @@ -15,4 +15,4 @@ spec: dataFrom: - extract: - key: /prod/user/db \ No newline at end of file + key: /dev/user/db \ No newline at end of file diff --git a/platform/ingress/base/applications/aws-load-balancer-controller.yaml b/platform/ingress/base/applications/aws-load-balancer-controller.yaml new file mode 100644 index 0000000..379a1bd --- /dev/null +++ b/platform/ingress/base/applications/aws-load-balancer-controller.yaml @@ -0,0 +1,41 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: aws-load-balancer-controller + namespace: argocd + +spec: + project: default + + source: + repoURL: https://aws.github.io/eks-charts + chart: aws-load-balancer-controller + targetRevision: 1.13.4 + + helm: + values: | + clusterName: REPLACE_ME + region: REPLACE_ME + vpcId: REPLACE_ME + + serviceAccount: + create: true + name: aws-load-balancer-controller + + replicaCount: 2 + + metrics: + serviceMonitor: + enabled: true + additionalLabels: + prometheus: kube-prometheus + + destination: + server: https://kubernetes.default.svc + namespace: kube-system + + syncPolicy: + automated: + prune: true + selfHeal: true \ No newline at end of file diff --git a/platform/ingress/base/applications/kustomization.yaml b/platform/ingress/base/applications/kustomization.yaml new file mode 100644 index 0000000..4761fb4 --- /dev/null +++ b/platform/ingress/base/applications/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - aws-load-balancer-controller.yaml \ No newline at end of file diff --git a/platform/ingress/base/cert-manager/cert-manager.yaml b/platform/ingress/base/cert-manager/cert-manager.yaml new file mode 100644 index 0000000..a71ce42 --- /dev/null +++ b/platform/ingress/base/cert-manager/cert-manager.yaml @@ -0,0 +1,28 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: cert-manager + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "-2" + +spec: + project: default + + source: + repoURL: https://charts.jetstack.io + chart: cert-manager + targetRevision: v1.18.2 + + helm: + valueFiles: + - values-common.yaml + + destination: + server: https://kubernetes.default.svc + + syncPolicy: + automated: + prune: true + selfHeal: true \ No newline at end of file diff --git a/platform/ingress/base/cert-manager/kustomization.yaml b/platform/ingress/base/cert-manager/kustomization.yaml new file mode 100644 index 0000000..9e5bf47 --- /dev/null +++ b/platform/ingress/base/cert-manager/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - cert-manager.yaml \ No newline at end of file diff --git a/platform/ingress/base/cert-manager/values-common.yaml b/platform/ingress/base/cert-manager/values-common.yaml new file mode 100644 index 0000000..00d42be --- /dev/null +++ b/platform/ingress/base/cert-manager/values-common.yaml @@ -0,0 +1,11 @@ +crds: + enabled: true + +replicaCount: 2 + +prometheus: + enabled: true + servicemonitor: + enabled: true + labels: + prometheus: kube-prometheus \ No newline at end of file diff --git a/platform/ingress/base/external-dns/external-dns.yaml b/platform/ingress/base/external-dns/external-dns.yaml new file mode 100644 index 0000000..fe7c065 --- /dev/null +++ b/platform/ingress/base/external-dns/external-dns.yaml @@ -0,0 +1,45 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: external-dns + namespace: argocd + +spec: + project: default + + source: + repoURL: https://kubernetes-sigs.github.io/external-dns + chart: external-dns + targetRevision: 1.18.0 + + helm: + values: | + provider: aws + + policy: sync + + registry: txt + + txtOwnerId: REPLACE_ME + + domainFilters: + - REPLACE_ME + + serviceAccount: + create: true + name: external-dns + + serviceMonitor: + enabled: true + additionalLabels: + prometheus: kube-prometheus + + destination: + server: https://kubernetes.default.svc + namespace: kube-system + + syncPolicy: + automated: + prune: true + selfHeal: true \ No newline at end of file diff --git a/platform/ingress/base/external-dns/kustomization.yaml b/platform/ingress/base/external-dns/kustomization.yaml new file mode 100644 index 0000000..2c0eec7 --- /dev/null +++ b/platform/ingress/base/external-dns/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - external-dns.yaml \ No newline at end of file diff --git a/platform/ingress/base/kustomization.yaml b/platform/ingress/base/kustomization.yaml index e69de29..0c3856a 100644 --- a/platform/ingress/base/kustomization.yaml +++ b/platform/ingress/base/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - applications/ + - external-dns/ + - cert-manager/ \ No newline at end of file diff --git a/platform/ingress/overlays/dev/aws-load-balancer-controller-patch.yaml b/platform/ingress/overlays/dev/aws-load-balancer-controller-patch.yaml new file mode 100644 index 0000000..e863a32 --- /dev/null +++ b/platform/ingress/overlays/dev/aws-load-balancer-controller-patch.yaml @@ -0,0 +1,29 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: aws-load-balancer-controller + namespace: argocd + +spec: + destination: + namespace: dev + + source: + helm: + values: | + clusterName: eks-dev-cluster + region: us-east-1 + vpcId: vpc-06601a547622eb138 + + serviceAccount: + create: true + name: aws-load-balancer-controller + + replicaCount: 2 + + metrics: + serviceMonitor: + enabled: true + additionalLabels: + prometheus: kube-prometheus \ No newline at end of file diff --git a/platform/ingress/overlays/dev/external-dns-patch.yaml b/platform/ingress/overlays/dev/external-dns-patch.yaml new file mode 100644 index 0000000..86f9476 --- /dev/null +++ b/platform/ingress/overlays/dev/external-dns-patch.yaml @@ -0,0 +1,33 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: external-dns + namespace: argocd + +spec: + destination: + namespace: dev + + source: + helm: + values: | + provider: aws + + policy: sync + + registry: txt + + txtOwnerId: eks-dev-cluster + + domainFilters: + - api.dev.emmanuelogah.com + + serviceAccount: + create: true + name: external-dns + + serviceMonitor: + enabled: true + additionalLabels: + prometheus: kube-prometheus \ No newline at end of file diff --git a/platform/ingress/overlays/dev/kustomization.yaml b/platform/ingress/overlays/dev/kustomization.yaml new file mode 100644 index 0000000..b0c25b6 --- /dev/null +++ b/platform/ingress/overlays/dev/kustomization.yaml @@ -0,0 +1,12 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +namespace: dev + +resources: + - ../../base + - letsencrypt.yaml + +patches: + - path: external-dns-patch.yaml + - path: aws-load-balancer-controller-patch.yaml \ No newline at end of file diff --git a/platform/ingress/overlays/dev/letsencrypt.yaml b/platform/ingress/overlays/dev/letsencrypt.yaml new file mode 100644 index 0000000..f244dd8 --- /dev/null +++ b/platform/ingress/overlays/dev/letsencrypt.yaml @@ -0,0 +1,21 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer + +metadata: + name: letsencrypt + annotations: + argocd.argoproj.io/sync-wave: "0" + +spec: + acme: + email: admin@dev.example.com + + server: https://acme-v02.api.letsencrypt.org/directory + + privateKeySecretRef: + name: letsencrypt-account-key + + solvers: + - http01: + ingress: + ingressClassName: alb \ No newline at end of file diff --git a/platform/logging/base/fluent-bit/fluent-bit.yaml b/platform/logging/base/fluent-bit/fluent-bit.yaml new file mode 100644 index 0000000..a9edff3 --- /dev/null +++ b/platform/logging/base/fluent-bit/fluent-bit.yaml @@ -0,0 +1,54 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: fluent-bit + namespace: argocd + +spec: + project: default + + source: + repoURL: https://fluent.github.io/helm-charts + chart: fluent-bit + targetRevision: 0.x + + helm: + values: | + config: + service: | + [SERVICE] + Flush 5 + Log_Level info + Parsers_File parsers.conf + + inputs: | + [INPUT] + Name tail + Path /var/log/containers/*.log + Parser docker + Tag kube.* + + filters: | + [FILTER] + Name kubernetes + Match kube.* + Merge_Log On + Keep_Log Off + + outputs: | + [OUTPUT] + Name loki + Match * + Host loki.logging.svc.cluster.local + Port 3100 + Labels job=fluent-bit + + destination: + server: https://kubernetes.default.svc + namespace: logging + + syncPolicy: + automated: + prune: true + selfHeal: true \ No newline at end of file diff --git a/platform/logging/base/fluent-bit/kustomization.yaml b/platform/logging/base/fluent-bit/kustomization.yaml new file mode 100644 index 0000000..4d8c1a5 --- /dev/null +++ b/platform/logging/base/fluent-bit/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - fluent-bit.yaml \ No newline at end of file diff --git a/platform/logging/base/kustomization.yaml b/platform/logging/base/kustomization.yaml index e69de29..6639f07 100644 --- a/platform/logging/base/kustomization.yaml +++ b/platform/logging/base/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - fluent-bit/ + - loki/ + - networkpolicy/ diff --git a/platform/logging/base/loki/kustomization.yaml b/platform/logging/base/loki/kustomization.yaml new file mode 100644 index 0000000..ace3aac --- /dev/null +++ b/platform/logging/base/loki/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - loki.yaml \ No newline at end of file diff --git a/platform/logging/base/loki/loki.yaml b/platform/logging/base/loki/loki.yaml new file mode 100644 index 0000000..daa6b80 --- /dev/null +++ b/platform/logging/base/loki/loki.yaml @@ -0,0 +1,76 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: loki + namespace: argocd + +spec: + project: default + + source: + repoURL: https://grafana.github.io/helm-charts + chart: loki + targetRevision: 6.x + + helm: + values: | + deploymentMode: SingleBinary + + singleBinary: + replicas: 1 + + loki: + auth_enabled: false + + commonConfig: + replication_factor: 1 + + schemaConfig: + configs: + - from: "2024-01-01" + store: tsdb + object_store: filesystem + schema: v13 + index: + prefix: loki_index_ + period: 24h + + storage: + type: filesystem + + limits_config: + retention_period: 30d + + compactor: + retention_enabled: true + working_directory: /var/loki/retention + + server: + http_listen_port: 3100 + + analytics: + reporting_enabled: false + + pattern_ingester: + enabled: false + + persistence: + enabled: true + storageClassName: gp3 + size: 50Gi + + monitoring: + serviceMonitor: + enabled: true + labels: + prometheus: kube-prometheus + + destination: + server: https://kubernetes.default.svc + namespace: logging + + syncPolicy: + automated: + prune: true + selfHeal: true \ No newline at end of file diff --git a/platform/logging/base/networkpolicy/allow-logging.yaml b/platform/logging/base/networkpolicy/allow-logging.yaml new file mode 100644 index 0000000..64d2065 --- /dev/null +++ b/platform/logging/base/networkpolicy/allow-logging.yaml @@ -0,0 +1,32 @@ +apiVersion: networking.k8s.io/v1 + +kind: NetworkPolicy + +metadata: + name: allow-logging + +spec: + + podSelector: + matchLabels: + app.kubernetes.io/name: loki + + policyTypes: + - Ingress + + ingress: + + - from: + + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: logging + + podSelector: + matchLabels: + app.kubernetes.io/name: fluent-bit + + ports: + + - protocol: TCP + port: 3100 \ No newline at end of file diff --git a/platform/logging/base/networkpolicy/kustomization.yaml b/platform/logging/base/networkpolicy/kustomization.yaml new file mode 100644 index 0000000..042d93c --- /dev/null +++ b/platform/logging/base/networkpolicy/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - allow-logging.yaml \ No newline at end of file diff --git a/platform/logging/overlays/dev/kustomization.yaml b/platform/logging/overlays/dev/kustomization.yaml new file mode 100644 index 0000000..c6ce0a9 --- /dev/null +++ b/platform/logging/overlays/dev/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +namespace: dev + +resources: + - ../../base \ No newline at end of file diff --git a/platform/monitoring/base/alertmanager/inhibit-rules.yaml b/platform/monitoring/base/alertmanager/inhibit-rules.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/alertmanager/receivers.yaml b/platform/monitoring/base/alertmanager/receivers.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/alertmanager/routes.yaml b/platform/monitoring/base/alertmanager/routes.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/alertmanager/templates/email.tmpl b/platform/monitoring/base/alertmanager/templates/email.tmpl deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/alertmanager/templates/slack.tmpl b/platform/monitoring/base/alertmanager/templates/slack.tmpl deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/exporters/blackbox-exporter.yaml b/platform/monitoring/base/exporters/blackbox-exporter.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/exporters/jmx-exporter.yaml b/platform/monitoring/base/exporters/jmx-exporter.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/exporters/postgres-exporter.yaml b/platform/monitoring/base/exporters/postgres-exporter.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/exporters/redis-exporter.yaml b/platform/monitoring/base/exporters/redis-exporter.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/grafana/dashboardproviders.yaml b/platform/monitoring/base/grafana/dashboardproviders.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/grafana/dashboards/jvm.json b/platform/monitoring/base/grafana/dashboards/jvm.json deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/grafana/dashboards/kubernetes.json b/platform/monitoring/base/grafana/dashboards/kubernetes.json deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/grafana/dashboards/postgres.json b/platform/monitoring/base/grafana/dashboards/postgres.json deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/grafana/datasources.yaml b/platform/monitoring/base/grafana/datasources.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/ingress/base/aws-load-balancer-controller/helm-release.yaml b/platform/monitoring/base/kube-prometheus-stack/alertmanager/README.md similarity index 100% rename from platform/ingress/base/aws-load-balancer-controller/helm-release.yaml rename to platform/monitoring/base/kube-prometheus-stack/alertmanager/README.md diff --git a/platform/monitoring/base/kube-prometheus-stack/alertmanager/external-secret.yaml b/platform/monitoring/base/kube-prometheus-stack/alertmanager/external-secret.yaml new file mode 100644 index 0000000..05d6627 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/alertmanager/external-secret.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret + +metadata: + name: alertmanager-notification-secret + +spec: + refreshInterval: 1h + + secretStoreRef: + kind: ClusterSecretStore + name: aws-secretsmanager + + target: + name: alertmanager-notification-secret + creationPolicy: Owner + + data: + - secretKey: slack-webhook + remoteRef: + key: alertmanager/notification + property: slack-webhook \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/alertmanager/kustomization.yaml b/platform/monitoring/base/kube-prometheus-stack/alertmanager/kustomization.yaml new file mode 100644 index 0000000..f176a6a --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/alertmanager/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - external-secret.yaml \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/helm-release.yaml b/platform/monitoring/base/kube-prometheus-stack/application.yaml similarity index 76% rename from platform/monitoring/base/kube-prometheus-stack/helm-release.yaml rename to platform/monitoring/base/kube-prometheus-stack/application.yaml index 4d41496..c9ac5aa 100644 --- a/platform/monitoring/base/kube-prometheus-stack/helm-release.yaml +++ b/platform/monitoring/base/kube-prometheus-stack/application.yaml @@ -1,38 +1,23 @@ apiVersion: argoproj.io/v1alpha1 - kind: Application metadata: - name: monitoring - + name: kube-prometheus-stack + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "-2" spec: - project: default source: - repoURL: https://prometheus-community.github.io/helm-charts - chart: kube-prometheus-stack - targetRevision: 72.6.0 - helm: - - valueFiles: - - - values.yaml - destination: - server: https://kubernetes.default.svc - namespace: monitoring - syncPolicy: - automated: - prune: true - selfHeal: true \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/blackbox-exporter/application.yaml b/platform/monitoring/base/kube-prometheus-stack/blackbox-exporter/application.yaml new file mode 100644 index 0000000..08f3b13 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/blackbox-exporter/application.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: blackbox-exporter + namespace: argocd + +spec: + project: default + + source: + repoURL: https://prometheus-community.github.io/helm-charts + chart: prometheus-blackbox-exporter + targetRevision: 9.0.0 + + destination: + server: https://kubernetes.default.svc + + syncPolicy: + automated: + prune: true + selfHeal: true \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/blackbox-exporter/kustomization.yaml b/platform/monitoring/base/kube-prometheus-stack/blackbox-exporter/kustomization.yaml new file mode 100644 index 0000000..dcbd3b7 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/blackbox-exporter/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - application.yaml \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/blackbox-exporter/values-common.yaml b/platform/monitoring/base/kube-prometheus-stack/blackbox-exporter/values-common.yaml new file mode 100644 index 0000000..aae8ee6 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/blackbox-exporter/values-common.yaml @@ -0,0 +1,11 @@ +serviceMonitor: + enabled: true + +config: + modules: + http_2xx: + prober: http + timeout: 5s + + http: + preferred_ip_protocol: ip4 \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/external-secret.yaml b/platform/monitoring/base/kube-prometheus-stack/external-secret.yaml new file mode 100644 index 0000000..fe22588 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/external-secret.yaml @@ -0,0 +1,25 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: grafana-admin +spec: + refreshInterval: 1h + + secretStoreRef: + kind: ClusterSecretStore + name: aws-secretsmanager + + target: + name: grafana-admin + creationPolicy: Owner + + data: + - secretKey: admin-user + remoteRef: + key: grafana/admin + property: username + + - secretKey: admin-password + remoteRef: + key: grafana/admin + property: password \ No newline at end of file diff --git a/platform/monitoring/base/grafana/dashboards/ingress-nginx.json b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/applications/ingress-nginx.json similarity index 100% rename from platform/monitoring/base/grafana/dashboards/ingress-nginx.json rename to platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/applications/ingress-nginx.json diff --git a/platform/ingress/base/aws-load-balancer-controller/value.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/applications/kafka.json similarity index 100% rename from platform/ingress/base/aws-load-balancer-controller/value.yaml rename to platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/applications/kafka.json diff --git a/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/applications/kustomization.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/applications/kustomization.yaml new file mode 100644 index 0000000..3f88f61 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/applications/kustomization.yaml @@ -0,0 +1,21 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +configMapGenerator: + +- name: grafana-dashboard-applications + + files: + - springboot.json + - nginx.json + - redis.json + - postgresql.json + - kafka.json + - ingress-nginx.json + + +generatorOptions: + disableNameSuffixHash: true + +commonLabels: + grafana_dashboard: "1" \ No newline at end of file diff --git a/platform/ingress/base/cert-manager/clusterissuers/letsencrypt-prod.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/applications/nginx.json similarity index 100% rename from platform/ingress/base/cert-manager/clusterissuers/letsencrypt-prod.yaml rename to platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/applications/nginx.json diff --git a/platform/ingress/base/cert-manager/clusterissuers/letsencrypt-staging.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/applications/postgresql.json similarity index 100% rename from platform/ingress/base/cert-manager/clusterissuers/letsencrypt-staging.yaml rename to platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/applications/postgresql.json diff --git a/platform/monitoring/base/grafana/dashboards/redis.json b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/applications/redis.json similarity index 100% rename from platform/monitoring/base/grafana/dashboards/redis.json rename to platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/applications/redis.json diff --git a/platform/monitoring/base/grafana/dashboards/springboot.json b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/applications/springboot.json similarity index 100% rename from platform/monitoring/base/grafana/dashboards/springboot.json rename to platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/applications/springboot.json diff --git a/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/dashboard-provider.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/dashboard-provider.yaml new file mode 100644 index 0000000..7de3247 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/dashboard-provider.yaml @@ -0,0 +1,39 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: grafana-dashboard-provider + labels: + grafana_dashboard: "1" + +data: + provider.yaml: | + apiVersion: 1 + + providers: + + - name: infrastructure + orgId: 1 + folder: Infrastructure + type: file + disableDeletion: false + editable: false + options: + path: /var/lib/grafana/dashboards/infrastructure + + - name: applications + orgId: 1 + folder: Applications + type: file + disableDeletion: false + editable: false + options: + path: /var/lib/grafana/dashboards/applications + + - name: sre + orgId: 1 + folder: SRE + type: file + disableDeletion: false + editable: false + options: + path: /var/lib/grafana/dashboards/sre \ No newline at end of file diff --git a/platform/ingress/base/cert-manager/helm-release.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/api-server.json similarity index 100% rename from platform/ingress/base/cert-manager/helm-release.yaml rename to platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/api-server.json diff --git a/platform/ingress/base/cert-manager/values.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/cluster-capacity.json similarity index 100% rename from platform/ingress/base/cert-manager/values.yaml rename to platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/cluster-capacity.json diff --git a/platform/ingress/base/external-dns/helm-release.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/controller-manager.json similarity index 100% rename from platform/ingress/base/external-dns/helm-release.yaml rename to platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/controller-manager.json diff --git a/platform/ingress/base/external-dns/values.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/etcd.json similarity index 100% rename from platform/ingress/base/external-dns/values.yaml rename to platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/etcd.json diff --git a/platform/ingress/base/ingress-nginx/helm-release.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/kubernetes-cluster.json similarity index 100% rename from platform/ingress/base/ingress-nginx/helm-release.yaml rename to platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/kubernetes-cluster.json diff --git a/platform/ingress/base/ingress-nginx/values.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/kubernetes-overview.json similarity index 100% rename from platform/ingress/base/ingress-nginx/values.yaml rename to platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/kubernetes-overview.json diff --git a/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/kustomization.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/kustomization.yaml new file mode 100644 index 0000000..0bb82b2 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/kustomization.yaml @@ -0,0 +1,23 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +configMapGenerator: + +- name: grafana-dashboard-infrastructure + files: + - kubernetes-cluster.json + - nodes.json + - etcd.json + - kubernetes-overview.json + - cluster-capacity.json + - namespaces.json + - pods.json + - api-server.json + - scheduler.json + - controller-manager.json + +generatorOptions: + disableNameSuffixHash: true + +commonLabels: + grafana_dashboard: "1" \ No newline at end of file diff --git a/platform/ingress/base/namespace.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/namespaces.json similarity index 100% rename from platform/ingress/base/namespace.yaml rename to platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/namespaces.json diff --git a/platform/monitoring/base/grafana/dashboards/nodes.json b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/nodes.json similarity index 100% rename from platform/monitoring/base/grafana/dashboards/nodes.json rename to platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/nodes.json diff --git a/platform/logging/base/fluent-bit/helm-release.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/pods.json similarity index 100% rename from platform/logging/base/fluent-bit/helm-release.yaml rename to platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/pods.json diff --git a/platform/logging/base/fluent-bit/values.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/scheduler.json similarity index 100% rename from platform/logging/base/fluent-bit/values.yaml rename to platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/infrastructure/scheduler.json diff --git a/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/kustomization.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/kustomization.yaml new file mode 100644 index 0000000..a70fdac --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - dashboard-provider.yaml + - infrastructure + - applications + - sre \ No newline at end of file diff --git a/platform/logging/base/log-retention/networkpolicy/allow-logging.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/sre/alerts.json similarity index 100% rename from platform/logging/base/log-retention/networkpolicy/allow-logging.yaml rename to platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/sre/alerts.json diff --git a/platform/logging/base/log-retention/retention.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/sre/api-latency.json similarity index 100% rename from platform/logging/base/log-retention/retention.yaml rename to platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/sre/api-latency.json diff --git a/platform/logging/base/loki/helm-release.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/sre/availability.json similarity index 100% rename from platform/logging/base/loki/helm-release.yaml rename to platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/sre/availability.json diff --git a/platform/logging/base/loki/values.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/sre/capacity-planning.json similarity index 100% rename from platform/logging/base/loki/values.yaml rename to platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/sre/capacity-planning.json diff --git a/platform/logging/base/namespace.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/sre/error-budget.json similarity index 100% rename from platform/logging/base/namespace.yaml rename to platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/sre/error-budget.json diff --git a/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/sre/kustomization.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/sre/kustomization.yaml new file mode 100644 index 0000000..5b60396 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/sre/kustomization.yaml @@ -0,0 +1,20 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +configMapGenerator: + +- name: grafana-dashboard-sre + + files: + - slo.json + - api-latency.json + - alerts.json + - availability.json + - error-budget.json + - capacity-planning.json + +generatorOptions: + disableNameSuffixHash: true + +commonLabels: + grafana_dashboard: "1" \ No newline at end of file diff --git a/platform/monitoring/base/alertmanager/config.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/sre/slo.json similarity index 100% rename from platform/monitoring/base/alertmanager/config.yaml rename to platform/monitoring/base/kube-prometheus-stack/grafana/dashboards/sre/slo.json diff --git a/platform/monitoring/base/kube-prometheus-stack/grafana/datasources/kustomization.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/datasources/kustomization.yaml new file mode 100644 index 0000000..d285a06 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/grafana/datasources/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - prometheus.yaml + - loki.yaml + - tempo.yaml \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/grafana/datasources/loki.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/datasources/loki.yaml new file mode 100644 index 0000000..361d8ec --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/grafana/datasources/loki.yaml @@ -0,0 +1,25 @@ +apiVersion: v1 +kind: ConfigMap + +metadata: + name: grafana-datasource-loki + + labels: + grafana_datasource: "1" + +data: + loki.yaml: | + apiVersion: 1 + + datasources: + + - name: Loki + uid: loki + + type: loki + + access: proxy + + url: http://loki.monitoring.svc.cluster.local:3100 + + editable: false \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/grafana/datasources/prometheus.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/datasources/prometheus.yaml new file mode 100644 index 0000000..f9c7bfe --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/grafana/datasources/prometheus.yaml @@ -0,0 +1,27 @@ +apiVersion: v1 +kind: ConfigMap + +metadata: + name: grafana-datasource-prometheus + + labels: + grafana_datasource: "1" + +data: + prometheus.yaml: | + apiVersion: 1 + + datasources: + + - name: Prometheus + uid: prometheus + + type: prometheus + + access: proxy + + url: http://kube-prometheus-stack-prometheus.monitoring.svc.cluster.local:9090 + + isDefault: true + + editable: false \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/grafana/datasources/tempo.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/datasources/tempo.yaml new file mode 100644 index 0000000..014c55d --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/grafana/datasources/tempo.yaml @@ -0,0 +1,26 @@ +apiVersion: v1 +kind: ConfigMap + +metadata: + name: grafana-datasource-tempo + + labels: + grafana_datasource: "1" + +data: + tempo.yaml: | + apiVersion: 1 + + datasources: + + - name: Tempo + + uid: tempo + + type: tempo + + access: proxy + + url: http://tempo.monitoring.svc.cluster.local:3200 + + editable: false \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/grafana/kustomization.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/kustomization.yaml new file mode 100644 index 0000000..4a56067 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/grafana/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - networkpolicy.yaml + - dashboards + - datasources \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/grafana/networkpolicy.yaml b/platform/monitoring/base/kube-prometheus-stack/grafana/networkpolicy.yaml new file mode 100644 index 0000000..d426e60 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/grafana/networkpolicy.yaml @@ -0,0 +1,21 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: grafana + +spec: + podSelector: + matchLabels: + app.kubernetes.io/name: grafana + + policyTypes: + - Ingress + + ingress: + - from: + - namespaceSelector: {} + + ports: + - protocol: TCP + port: 3000 \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/kustomization.yaml b/platform/monitoring/base/kube-prometheus-stack/kustomization.yaml new file mode 100644 index 0000000..91db6fd --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/kustomization.yaml @@ -0,0 +1,16 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - alertmanager/ + - blackbox-exporter/ + - grafana/ + - networkpolicies/ + - postgres-exporter/ + - prometheusrules/ + - recording-rules/ + - redis-exporter/ + - servicemonitors/ + - application.yaml + - external-secret.yaml + \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/networkpolicies/allow-node-exporter.yaml b/platform/monitoring/base/kube-prometheus-stack/networkpolicies/allow-node-exporter.yaml new file mode 100644 index 0000000..1af7450 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/networkpolicies/allow-node-exporter.yaml @@ -0,0 +1,27 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-prometheus-node-exporter + +spec: + podSelector: + matchLabels: + app.kubernetes.io/name: node-exporter + + policyTypes: + - Ingress + + ingress: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: monitoring + + podSelector: + matchLabels: + app.kubernetes.io/name: prometheus + + ports: + - protocol: TCP + port: 9100 \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/networkpolicies/allow-postgres-exporter.yaml b/platform/monitoring/base/kube-prometheus-stack/networkpolicies/allow-postgres-exporter.yaml new file mode 100644 index 0000000..7721461 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/networkpolicies/allow-postgres-exporter.yaml @@ -0,0 +1,27 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-prometheus-postgres-exporter + +spec: + podSelector: + matchLabels: + app.kubernetes.io/name: prometheus-postgres-exporter + + policyTypes: + - Ingress + + ingress: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: monitoring + + podSelector: + matchLabels: + app.kubernetes.io/name: prometheus + + ports: + - protocol: TCP + port: 9187 \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/networkpolicies/allow-redis-exporter.yaml b/platform/monitoring/base/kube-prometheus-stack/networkpolicies/allow-redis-exporter.yaml new file mode 100644 index 0000000..84573cd --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/networkpolicies/allow-redis-exporter.yaml @@ -0,0 +1,27 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + name: allow-prometheus-redis-exporter + +spec: + podSelector: + matchLabels: + app.kubernetes.io/name: redis-exporter + + policyTypes: + - Ingress + + ingress: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: monitoring + + podSelector: + matchLabels: + app.kubernetes.io/name: prometheus + + ports: + - protocol: TCP + port: 9121 \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/networkpolicies/kustomization.yaml b/platform/monitoring/base/kube-prometheus-stack/networkpolicies/kustomization.yaml new file mode 100644 index 0000000..1513ce1 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/networkpolicies/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - allow-node-exporter.yaml + - allow-postgres-exporter.yaml + - allow-redis-exporter.yaml \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/postgres-exporter/application.yaml b/platform/monitoring/base/kube-prometheus-stack/postgres-exporter/application.yaml new file mode 100644 index 0000000..4b4f6e8 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/postgres-exporter/application.yaml @@ -0,0 +1,28 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: postgres-exporter + namespace: argocd + +spec: + project: default + + source: + repoURL: https://prometheus-community.github.io/helm-charts + chart: prometheus-postgres-exporter + targetRevision: 6.8.0 + + helm: + valuesObject: + serviceMonitor: + enabled: true + + destination: + server: https://kubernetes.default.svc + + + syncPolicy: + automated: + prune: true + selfHeal: true \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/postgres-exporter/kustomization.yaml b/platform/monitoring/base/kube-prometheus-stack/postgres-exporter/kustomization.yaml new file mode 100644 index 0000000..dcbd3b7 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/postgres-exporter/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - application.yaml \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/postgres-exporter/values-common.yaml b/platform/monitoring/base/kube-prometheus-stack/postgres-exporter/values-common.yaml new file mode 100644 index 0000000..872f0f4 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/postgres-exporter/values-common.yaml @@ -0,0 +1,6 @@ +serviceMonitor: + enabled: true + +config: + datasource: + port: "5432" \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/prometheusrules/applications.yaml b/platform/monitoring/base/kube-prometheus-stack/prometheusrules/applications.yaml new file mode 100644 index 0000000..17b0f96 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/prometheusrules/applications.yaml @@ -0,0 +1,37 @@ +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule + +metadata: + name: application-alerts + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "0" + + labels: + prometheus: kube-prometheus + +spec: + groups: + + - name: application.rules + + rules: + + - alert: APIHighErrorRate + + expr: | + ( + sum(rate(http_server_requests_seconds_count{ + status=~"5.." + }[5m])) + / + sum(rate(http_server_requests_seconds_count[5m])) + ) > 0.05 + + for: 5m + + labels: + severity: critical + + annotations: + summary: API error rate above 5% \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/prometheusrules/databases.yaml b/platform/monitoring/base/kube-prometheus-stack/prometheusrules/databases.yaml new file mode 100644 index 0000000..91cf141 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/prometheusrules/databases.yaml @@ -0,0 +1,83 @@ +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule + +metadata: + name: database-alerts + + labels: + prometheus: kube-prometheus + +spec: + groups: + + - name: postgres.rules + + rules: + + - alert: PostgreSQLDown + + expr: | + pg_up == 0 + + for: 5m + + labels: + severity: critical + + annotations: + summary: PostgreSQL database is down + description: > + PostgreSQL exporter cannot connect to the database. + + + - alert: PostgreSQLTooManyConnections + + expr: | + ( + sum(pg_stat_database_numbackends) + / + sum(pg_settings_max_connections) + ) > 0.85 + + for: 10m + + labels: + severity: warning + + annotations: + summary: PostgreSQL connection usage above 85% + description: > + Database connection usage is approaching the configured limit. + + + - alert: PostgreSQLDeadlocks + + expr: | + rate(pg_stat_database_deadlocks_total[5m]) > 0 + + for: 5m + + labels: + severity: warning + + annotations: + summary: PostgreSQL deadlocks detected + description: > + PostgreSQL is reporting deadlocks. + + + - alert: PostgreSQLSlowQueries + + expr: | + rate(pg_stat_database_tup_returned[5m]) + / + rate(pg_stat_database_tup_fetched[5m]) + < 0.1 + + for: 15m + + labels: + severity: warning + + annotations: + summary: PostgreSQL query efficiency degraded \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/prometheusrules/ingress.yaml b/platform/monitoring/base/kube-prometheus-stack/prometheusrules/ingress.yaml new file mode 100644 index 0000000..c81eaba --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/prometheusrules/ingress.yaml @@ -0,0 +1,58 @@ +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule + +metadata: + name: ingress-alerts + + labels: + prometheus: kube-prometheus + +spec: + + groups: + + - name: ingress.rules + + rules: + + + - alert: ALBControllerErrors + + expr: | + rate( + aws_loadbalancer_controller_reconcile_errors_total[5m] + ) > 0 + + for: 10m + + labels: + severity: warning + + annotations: + summary: AWS Load Balancer Controller errors + description: > + ALB controller is reporting reconciliation errors. + + + - alert: HighHTTP5xxRate + + expr: | + ( + sum(rate( + http_server_requests_seconds_count{ + status=~"5.." + }[5m])) + / + sum(rate( + http_server_requests_seconds_count[5m])) + ) > 0.05 + + for: 5m + + labels: + severity: critical + + annotations: + summary: High HTTP 5xx error rate + description: > + More than 5% of HTTP requests are returning errors. \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/prometheusrules/kubernetes.yaml b/platform/monitoring/base/kube-prometheus-stack/prometheusrules/kubernetes.yaml new file mode 100644 index 0000000..3270645 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/prometheusrules/kubernetes.yaml @@ -0,0 +1,48 @@ +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule + +metadata: + name: kubernetes-alerts + + labels: + prometheus: kube-prometheus + +spec: + groups: + + - name: kubernetes.rules + + rules: + + - alert: PodCrashLooping + + expr: | + increase(kube_pod_container_status_restarts_total[15m]) > 5 + + for: 10m + + labels: + severity: warning + + annotations: + summary: Pod is restarting repeatedly + description: | + Pod {{ $labels.namespace }}/{{ $labels.pod }} + has restarted more than 5 times in 15 minutes. + + + - alert: PodNotReady + + expr: | + kube_pod_status_ready{condition="false"} == 1 + + for: 15m + + labels: + severity: warning + + annotations: + summary: Pod is not ready + description: | + Pod {{ $labels.namespace }}/{{ $labels.pod }} + has been unavailable for 15 minutes. \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/prometheusrules/kustomization.yaml b/platform/monitoring/base/kube-prometheus-stack/prometheusrules/kustomization.yaml new file mode 100644 index 0000000..480ec9f --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/prometheusrules/kustomization.yaml @@ -0,0 +1,10 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - kubernetes.yaml + - nodes.yaml + - applications.yaml + - ingress.yaml + - databases.yaml + - redis.yaml \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/prometheusrules/nodes.yaml b/platform/monitoring/base/kube-prometheus-stack/prometheusrules/nodes.yaml new file mode 100644 index 0000000..7377c57 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/prometheusrules/nodes.yaml @@ -0,0 +1,53 @@ +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule + +metadata: + name: node-alerts + + labels: + prometheus: kube-prometheus + +spec: + groups: + + - name: node.rules + + rules: + + - alert: HighCPUUsage + + expr: | + 100 - + ( + avg by(instance) + (rate(node_cpu_seconds_total{mode="idle"}[5m])) + * 100 + ) + > 85 + + for: 10m + + labels: + severity: warning + + annotations: + summary: High CPU usage + description: | + Node {{ $labels.instance }} + CPU usage is above 85%. + + + - alert: DiskSpaceLow + + expr: | + node_filesystem_avail_bytes / + node_filesystem_size_bytes + < 0.10 + + for: 15m + + labels: + severity: warning + + annotations: + summary: Disk space below 10% \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/prometheusrules/redis.yaml b/platform/monitoring/base/kube-prometheus-stack/prometheusrules/redis.yaml new file mode 100644 index 0000000..9603e76 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/prometheusrules/redis.yaml @@ -0,0 +1,84 @@ +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule + +metadata: + name: redis-alerts + + labels: + prometheus: kube-prometheus + +spec: + groups: + + - name: redis.rules + + rules: + + + - alert: RedisDown + + expr: | + redis_up == 0 + + for: 5m + + labels: + severity: critical + + annotations: + summary: Redis is unavailable + description: > + Redis exporter cannot connect to Redis. + + + - alert: RedisHighMemoryUsage + + expr: | + ( + redis_memory_used_bytes + / + redis_memory_max_bytes + ) > 0.85 + + for: 10m + + labels: + severity: warning + + annotations: + summary: Redis memory usage above 85% + description: > + Redis memory utilization is approaching the configured limit. + + + - alert: RedisRejectedConnections + + expr: | + increase(redis_rejected_connections_total[5m]) > 0 + + for: 5m + + labels: + severity: warning + + annotations: + summary: Redis is rejecting connections + description: > + Redis has rejected client connections recently. + + + - alert: RedisHighLatency + + expr: | + redis_commands_duration_seconds_total + / + redis_commands_processed_total + > 0.1 + + for: 10m + + labels: + severity: warning + + annotations: + summary: Redis command latency is high \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/recording-rules/applications.yaml b/platform/monitoring/base/kube-prometheus-stack/recording-rules/applications.yaml new file mode 100644 index 0000000..d331095 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/recording-rules/applications.yaml @@ -0,0 +1,62 @@ +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule + +metadata: + name: application-recording-rules + + labels: + prometheus: kube-prometheus + +spec: + + groups: + + - name: application.recording.rules + + interval: 30s + + rules: + + - record: app:http_requests:rate5m + + expr: | + sum by( + application + ) + ( + rate( + http_server_requests_seconds_count[5m] + ) + ) + + + - record: app:http_errors:rate5m + + expr: | + sum by( + application + ) + ( + rate( + http_server_requests_seconds_count{ + status=~"5.." + }[5m] + ) + ) + + + - record: app:http_latency:p95 + + expr: | + histogram_quantile( + 0.95, + sum by( + application, + le + ) + ( + rate( + http_server_requests_seconds_bucket[5m] + ) + ) + ) \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/recording-rules/cluster.yaml b/platform/monitoring/base/kube-prometheus-stack/recording-rules/cluster.yaml new file mode 100644 index 0000000..c26285b --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/recording-rules/cluster.yaml @@ -0,0 +1,35 @@ +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule + +metadata: + name: cluster-recording-rules + + labels: + prometheus: kube-prometheus + +spec: + groups: + - name: cluster.recording.rules + interval: 30s + + rules: + + - record: cluster:cpu_usage:ratio + + expr: | + 1 - + avg( + rate(node_cpu_seconds_total{ + mode="idle" + }[5m]) + ) + + - record: cluster:memory_usage:ratio + + expr: | + 1 - + ( + sum(node_memory_MemAvailable_bytes) + / + sum(node_memory_MemTotal_bytes) + ) \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/recording-rules/kustomization.yaml b/platform/monitoring/base/kube-prometheus-stack/recording-rules/kustomization.yaml new file mode 100644 index 0000000..ad0e211 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/recording-rules/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - cluster.yaml + - nodes.yaml + - workloads.yaml + - applications.yaml \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/recording-rules/nodes.yaml b/platform/monitoring/base/kube-prometheus-stack/recording-rules/nodes.yaml new file mode 100644 index 0000000..473cb93 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/recording-rules/nodes.yaml @@ -0,0 +1,52 @@ +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule + +metadata: + name: node-recording-rules + + labels: + prometheus: kube-prometheus + +spec: + groups: + + - name: node.recording.rules + + interval: 30s + + rules: + + - record: node:cpu_usage:ratio + + expr: | + 1 - + avg by(instance) + ( + rate( + node_cpu_seconds_total{ + mode="idle" + }[5m] + ) + ) + + + - record: node:memory_usage:ratio + + expr: | + 1 - + ( + node_memory_MemAvailable_bytes + / + node_memory_MemTotal_bytes + ) + + + - record: node:disk_usage:ratio + + expr: | + 1 - + ( + node_filesystem_avail_bytes + / + node_filesystem_size_bytes + ) \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/recording-rules/workloads.yaml b/platform/monitoring/base/kube-prometheus-stack/recording-rules/workloads.yaml new file mode 100644 index 0000000..14fe165 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/recording-rules/workloads.yaml @@ -0,0 +1,54 @@ +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule + +metadata: + name: workload-recording-rules + + labels: + prometheus: kube-prometheus + +spec: + + groups: + + - name: workload.recording.rules + + interval: 30s + + rules: + + - record: namespace:pod_cpu_usage:sum + + expr: | + sum by(namespace) + ( + rate( + container_cpu_usage_seconds_total{ + container!="", + image!="" + }[5m] + ) + ) + + + - record: namespace:memory_usage_bytes:sum + + expr: | + sum by(namespace) + ( + container_memory_working_set_bytes{ + container!="", + image!="" + } + ) + + + - record: namespace:pod_restarts:rate + + expr: | + sum by(namespace) + ( + rate( + kube_pod_container_status_restarts_total[15m] + ) + ) \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/redis-exporter/application.yaml b/platform/monitoring/base/kube-prometheus-stack/redis-exporter/application.yaml new file mode 100644 index 0000000..8f5c7c9 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/redis-exporter/application.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: redis-exporter + namespace: argocd + +spec: + project: default + + source: + repoURL: https://prometheus-community.github.io/helm-charts + chart: prometheus-redis-exporter + targetRevision: 6.8.0 + + destination: + server: https://kubernetes.default.svc + + syncPolicy: + automated: + prune: true + selfHeal: true \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/redis-exporter/kustomization.yaml b/platform/monitoring/base/kube-prometheus-stack/redis-exporter/kustomization.yaml new file mode 100644 index 0000000..dcbd3b7 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/redis-exporter/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - application.yaml \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/redis-exporter/values-common.yaml b/platform/monitoring/base/kube-prometheus-stack/redis-exporter/values-common.yaml new file mode 100644 index 0000000..5ee83e6 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/redis-exporter/values-common.yaml @@ -0,0 +1,2 @@ +serviceMonitor: + enabled: true \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/servicemonitors/aws-load-balancer-controller.yaml b/platform/monitoring/base/kube-prometheus-stack/servicemonitors/aws-load-balancer-controller.yaml new file mode 100644 index 0000000..cd39c75 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/servicemonitors/aws-load-balancer-controller.yaml @@ -0,0 +1,21 @@ +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor + +metadata: + name: aws-load-balancer-controller + + labels: + prometheus: kube-prometheus + +spec: + namespaceSelector: + matchNames: + - kube-system + + selector: + matchLabels: + app.kubernetes.io/name: aws-load-balancer-controller + + endpoints: + - port: metrics + interval: 30s \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/servicemonitors/kustomization.yaml b/platform/monitoring/base/kube-prometheus-stack/servicemonitors/kustomization.yaml new file mode 100644 index 0000000..7d91be0 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/servicemonitors/kustomization.yaml @@ -0,0 +1,10 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - order.yaml + - user.yaml + - payment.yaml + - product.yaml + - redis.yaml + - aws-load-balancer-controller.yaml \ No newline at end of file diff --git a/platform/monitoring/base/servicemonitors/order.yaml b/platform/monitoring/base/kube-prometheus-stack/servicemonitors/order.yaml similarity index 50% rename from platform/monitoring/base/servicemonitors/order.yaml rename to platform/monitoring/base/kube-prometheus-stack/servicemonitors/order.yaml index 87412d7..825b3b5 100644 --- a/platform/monitoring/base/servicemonitors/order.yaml +++ b/platform/monitoring/base/kube-prometheus-stack/servicemonitors/order.yaml @@ -1,29 +1,20 @@ apiVersion: monitoring.coreos.com/v1 - kind: ServiceMonitor metadata: - name: order-service + annotations: + argocd.argoproj.io/sync-wave: "0" -spec: + labels: + prometheus: kube-prometheus +spec: selector: - matchLabels: - app: order-service - namespaceSelector: - - matchNames: - - - order - endpoints: - - - port: http - - path: /actuator/prometheus - - interval: 15s \ No newline at end of file + - port: http + path: /actuator/prometheus + interval: 30s \ No newline at end of file diff --git a/platform/monitoring/base/servicemonitors/payment.yaml b/platform/monitoring/base/kube-prometheus-stack/servicemonitors/payment.yaml similarity index 50% rename from platform/monitoring/base/servicemonitors/payment.yaml rename to platform/monitoring/base/kube-prometheus-stack/servicemonitors/payment.yaml index bd4e3e9..74f7c14 100644 --- a/platform/monitoring/base/servicemonitors/payment.yaml +++ b/platform/monitoring/base/kube-prometheus-stack/servicemonitors/payment.yaml @@ -1,29 +1,20 @@ apiVersion: monitoring.coreos.com/v1 - kind: ServiceMonitor metadata: - name: payment-service + annotations: + argocd.argoproj.io/sync-wave: "0" + + labels: + prometheus: kube-prometheus spec: - selector: - matchLabels: - app: payment-service - namespaceSelector: - - matchNames: - - - payment - endpoints: - - - port: http - - path: /actuator/prometheus - - interval: 15s \ No newline at end of file + - port: http + path: /actuator/prometheus + interval: 30s \ No newline at end of file diff --git a/platform/monitoring/base/servicemonitors/product.yaml b/platform/monitoring/base/kube-prometheus-stack/servicemonitors/product.yaml similarity index 51% rename from platform/monitoring/base/servicemonitors/product.yaml rename to platform/monitoring/base/kube-prometheus-stack/servicemonitors/product.yaml index 74dcff8..ca8483d 100644 --- a/platform/monitoring/base/servicemonitors/product.yaml +++ b/platform/monitoring/base/kube-prometheus-stack/servicemonitors/product.yaml @@ -1,29 +1,20 @@ apiVersion: monitoring.coreos.com/v1 - kind: ServiceMonitor metadata: - name: product-service + annotations: + argocd.argoproj.io/sync-wave: "0" -spec: + labels: + prometheus: kube-prometheus +spec: selector: - matchLabels: - app: product-service - namespaceSelector: - - matchNames: - - - product - endpoints: - - - port: http - - path: /actuator/prometheus - - interval: 15s \ No newline at end of file + - port: http + path: /actuator/prometheus + interval: 30s \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/servicemonitors/redis.yaml b/platform/monitoring/base/kube-prometheus-stack/servicemonitors/redis.yaml new file mode 100644 index 0000000..364f368 --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/servicemonitors/redis.yaml @@ -0,0 +1,19 @@ +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor + +metadata: + name: redis + annotations: + argocd.argoproj.io/sync-wave: "0" + + labels: + prometheus: kube-prometheus + +spec: + selector: + matchLabels: + app: redis-exporter + + endpoints: + - port: metrics + interval: 30s \ No newline at end of file diff --git a/platform/monitoring/base/servicemonitors/user.yaml b/platform/monitoring/base/kube-prometheus-stack/servicemonitors/user.yaml similarity index 50% rename from platform/monitoring/base/servicemonitors/user.yaml rename to platform/monitoring/base/kube-prometheus-stack/servicemonitors/user.yaml index e4fe13d..c642dbe 100644 --- a/platform/monitoring/base/servicemonitors/user.yaml +++ b/platform/monitoring/base/kube-prometheus-stack/servicemonitors/user.yaml @@ -1,29 +1,20 @@ apiVersion: monitoring.coreos.com/v1 - kind: ServiceMonitor metadata: - name: user-service + annotations: + argocd.argoproj.io/sync-wave: "0" -spec: + labels: + prometheus: kube-prometheus +spec: selector: - matchLabels: - app: user-service - namespaceSelector: - - matchNames: - - - user - endpoints: - - - port: http - - path: /actuator/prometheus - - interval: 15s \ No newline at end of file + - port: http + path: /actuator/prometheus + interval: 30s \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/values-common.yaml b/platform/monitoring/base/kube-prometheus-stack/values-common.yaml new file mode 100644 index 0000000..42af4dd --- /dev/null +++ b/platform/monitoring/base/kube-prometheus-stack/values-common.yaml @@ -0,0 +1,144 @@ +grafana: + enabled: true + + admin: + existingSecret: grafana-admin + userKey: admin-user + passwordKey: admin-password + + service: + type: ClusterIP + + persistence: + enabled: true + storageClassName: gp3 + size: 20Gi + + # Disable the dashboards bundled with kube-prometheus-stack. + # Dashboards are provisioned from Git via ConfigMaps. + defaultDashboardsEnabled: false + + sidecar: + dashboards: + enabled: true + searchNamespace: ALL + + # Watch ConfigMaps with this label. + label: grafana_dashboard + + # Keep the default label value. + labelValue: "1" + + # Automatically update dashboards when ConfigMaps change. + watchMethod: WATCH + + datasources: + enabled: true + + # Watch datasource ConfigMaps. + label: grafana_datasource + labelValue: "1" + +prometheus: + prometheusSpec: + retention: 30d + retentionSize: 30GB + + serviceMonitorSelector: + matchLabels: + prometheus: kube-prometheus + + ruleSelector: + matchLabels: + prometheus: kube-prometheus + + ruleNamespaceSelector: {} + + serviceMonitorNamespaceSelector: {} + + storageSpec: + volumeClaimTemplate: + spec: + storageClassName: gp3 + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 50Gi + +alertmanager: + enabled: true + + alertmanagerSpec: + retention: 120h + + storage: + volumeClaimTemplate: + spec: + storageClassName: gp3 + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 10Gi + + secrets: + - alertmanager-notification-secret + + config: + global: + resolve_timeout: 5m + + route: + group_by: + - alertname + - namespace + + group_wait: 30s + group_interval: 5m + repeat_interval: 4h + + receiver: default-receiver + + routes: + - matchers: + - severity="critical" + receiver: slack-critical + + receivers: + - name: default-receiver + + - name: slack-critical + slack_configs: + - api_url_file: /etc/alertmanager/secrets/alertmanager-notification-secret/slack-webhook + channel: "#alerts" + send_resolved: true + title: "{{ .CommonAnnotations.summary }}" + + - name: email-alerts + email_configs: + - to: platform-team@example.com + from: alertmanager@example.com + smarthost: smtp.example.com:587 + auth_username: alertmanager@example.com + auth_password_file: /etc/alertmanager/secrets/alertmanager-email-secret/password + + inhibit_rules: + - source_matchers: + - severity="critical" + + target_matchers: + - severity="warning" + + equal: + - namespace + - alertname + +kubeStateMetrics: + enabled: true + +nodeExporter: + enabled: true + +prometheusOperator: + enabled: true \ No newline at end of file diff --git a/platform/monitoring/base/kube-prometheus-stack/values.yaml b/platform/monitoring/base/kube-prometheus-stack/values.yaml deleted file mode 100644 index ba6776b..0000000 --- a/platform/monitoring/base/kube-prometheus-stack/values.yaml +++ /dev/null @@ -1,51 +0,0 @@ -grafana: - - adminPassword: admin - - persistence: - - enabled: true - - size: 20Gi - - service: - - type: ClusterIP - -prometheus: - - prometheusSpec: - - retention: 30d - - retentionSize: 30GB - - storageSpec: - - volumeClaimTemplate: - - spec: - - storageClassName: gp3 - - accessModes: - - - ReadWriteOnce - - resources: - - requests: - - storage: 50Gi - -alertmanager: - - enabled: true - -kubeStateMetrics: - - enabled: true - -nodeExporter: - - enabled: true \ No newline at end of file diff --git a/platform/monitoring/base/kustomization.yaml b/platform/monitoring/base/kustomization.yaml index 80f1cc0..b97675d 100644 --- a/platform/monitoring/base/kustomization.yaml +++ b/platform/monitoring/base/kustomization.yaml @@ -1,31 +1,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization -namespace: monitoring - resources: - - namespace.yaml - - # ServiceMonitors - - servicemonitors/user.yaml - - servicemonitors/order.yaml - - servicemonitors/payment.yaml - - servicemonitors/product.yaml - - # Alert Rules - - prometheusrules/high-cpu.yaml - - prometheusrules/high-memory.yaml - - prometheusrules/pod-restarts.yaml - - prometheusrules/database-down.yaml - -configMapGenerator: - - name: grafana-dashboards - files: - - grafana-dashboards/kubernetes.json - - grafana-dashboards/jvm.json - - grafana-dashboards/postgres.json - - grafana-dashboards/predis.json - - grafana-dashboards/springboot.json - -generatorOptions: - disableNameSuffixHash: true \ No newline at end of file + - kube-prometheus-stack/ \ No newline at end of file diff --git a/platform/monitoring/base/networkpolicy/allow-prometheus.yaml b/platform/monitoring/base/networkpolicy/allow-prometheus.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/prometheusrules/application-latency.yaml b/platform/monitoring/base/prometheusrules/application-latency.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/prometheusrules/database-down.yaml b/platform/monitoring/base/prometheusrules/database-down.yaml deleted file mode 100644 index 3469e69..0000000 --- a/platform/monitoring/base/prometheusrules/database-down.yaml +++ /dev/null @@ -1,3 +0,0 @@ -alert: PostgresDown - -expr: pg_up == 0 \ No newline at end of file diff --git a/platform/monitoring/base/prometheusrules/deployment-unavailable.yaml b/platform/monitoring/base/prometheusrules/deployment-unavailable.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/prometheusrules/disk-pressure.yaml b/platform/monitoring/base/prometheusrules/disk-pressure.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/prometheusrules/high-cpu.yaml b/platform/monitoring/base/prometheusrules/high-cpu.yaml deleted file mode 100644 index b1667b0..0000000 --- a/platform/monitoring/base/prometheusrules/high-cpu.yaml +++ /dev/null @@ -1,29 +0,0 @@ -apiVersion: monitoring.coreos.com/v1 - -kind: PrometheusRule - -metadata: - - name: high-cpu - -spec: - - groups: - - - name: cpu - - rules: - - - alert: HighCPU - - expr: rate(container_cpu_usage_seconds_total[5m]) > 0.8 - - for: 5m - - labels: - - severity: warning - - annotations: - - summary: CPU usage is high \ No newline at end of file diff --git a/platform/monitoring/base/prometheusrules/high-memory.yaml b/platform/monitoring/base/prometheusrules/high-memory.yaml deleted file mode 100644 index 329b945..0000000 --- a/platform/monitoring/base/prometheusrules/high-memory.yaml +++ /dev/null @@ -1,52 +0,0 @@ -apiVersion: monitoring.coreos.com/v1 -kind: PrometheusRule - -metadata: - name: high-memory - namespace: monitoring - -spec: - groups: - - name: memory.rules - - rules: - - - alert: HighMemoryUsage - - expr: | - ( - container_memory_working_set_bytes{container!="",pod!=""} - / - container_spec_memory_limit_bytes{container!="",pod!=""} - ) > 0.90 - - for: 5m - - labels: - severity: warning - - annotations: - summary: "Container memory usage is high" - description: > - Container {{ $labels.container }} in pod {{ $labels.pod }} - is using more than 90% of its memory limit for over 5 minutes. - - - alert: CriticalMemoryUsage - - expr: | - ( - container_memory_working_set_bytes{container!="",pod!=""} - / - container_spec_memory_limit_bytes{container!="",pod!=""} - ) > 0.98 - - for: 2m - - labels: - severity: critical - - annotations: - summary: "Container is about to run out of memory" - description: > - Container {{ $labels.container }} in pod {{ $labels.pod }} - is consuming more than 98% of its memory limit. \ No newline at end of file diff --git a/platform/monitoring/base/prometheusrules/ingress-5xx.yaml b/platform/monitoring/base/prometheusrules/ingress-5xx.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/prometheusrules/node-not-ready.yaml b/platform/monitoring/base/prometheusrules/node-not-ready.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/prometheusrules/pod-crashloop.yaml b/platform/monitoring/base/prometheusrules/pod-crashloop.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/prometheusrules/pod-restarts.yaml b/platform/monitoring/base/prometheusrules/pod-restarts.yaml deleted file mode 100644 index 1ac8403..0000000 --- a/platform/monitoring/base/prometheusrules/pod-restarts.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: monitoring.coreos.com/v1 - -kind: PrometheusRule - -metadata: - - name: pod-restarts - -spec: - - groups: - - - name: pod - - rules: - - - alert: PodRestarting - - expr: increase(kube_pod_container_status_restarts_total[10m]) > 3 - - for: 5m \ No newline at end of file diff --git a/platform/monitoring/base/prometheusrules/postgres-connections.yaml b/platform/monitoring/base/prometheusrules/postgres-connections.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/prometheusrules/redis-down.yaml b/platform/monitoring/base/prometheusrules/redis-down.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/recording-rules/applications.yaml b/platform/monitoring/base/recording-rules/applications.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/recording-rules/cluster.yaml b/platform/monitoring/base/recording-rules/cluster.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/recording-rules/nodes.yaml b/platform/monitoring/base/recording-rules/nodes.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/recording-rules/workloads.yaml b/platform/monitoring/base/recording-rules/workloads.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/servicemonitors/ingress-nginx.yaml b/platform/monitoring/base/servicemonitors/ingress-nginx.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/servicemonitors/postgres.yaml b/platform/monitoring/base/servicemonitors/postgres.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/base/servicemonitors/redis.yaml b/platform/monitoring/base/servicemonitors/redis.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/monitoring/overlays/dev/kube-prometheus-stack-patch.yaml b/platform/monitoring/overlays/dev/kube-prometheus-stack-patch.yaml new file mode 100644 index 0000000..f035646 --- /dev/null +++ b/platform/monitoring/overlays/dev/kube-prometheus-stack-patch.yaml @@ -0,0 +1,13 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: kube-prometheus-stack + namespace: argocd + +spec: + source: + helm: + valueFiles: + - $values/platform/monitoring/base/kube-prometheus-stack/values-common.yaml + - $values/platform/monitoring/overlays/dev/values-dev.yaml \ No newline at end of file diff --git a/platform/monitoring/overlays/dev/kustomization.yaml b/platform/monitoring/overlays/dev/kustomization.yaml index 43e54ee..cc71c7a 100644 --- a/platform/monitoring/overlays/dev/kustomization.yaml +++ b/platform/monitoring/overlays/dev/kustomization.yaml @@ -1,8 +1,16 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization +namespace: dev + resources: - ../../base + - order/application.yaml + - payment/application.yaml + - product/application.yaml + - user/application.yaml + patches: - - path: values-patch.yaml \ No newline at end of file + - path: kube-prometheus-stack-patch.yaml + - path: postgres-exporter-patch.yaml \ No newline at end of file diff --git a/platform/monitoring/overlays/dev/order/application.yaml b/platform/monitoring/overlays/dev/order/application.yaml new file mode 100644 index 0000000..e50ea4b --- /dev/null +++ b/platform/monitoring/overlays/dev/order/application.yaml @@ -0,0 +1,34 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: order-postgres-exporter + namespace: argocd + +spec: + project: default + + source: + repoURL: https://prometheus-community.github.io/helm-charts + chart: prometheus-postgres-exporter + targetRevision: 6.8.0 + + helm: + valuesObject: + serviceMonitor: + enabled: true + + config: + datasource: + host: order-postgres.dev.svc.cluster.local + port: "5432" + database: orderdb + + destination: + server: https://kubernetes.default.svc + namespace: dev + + syncPolicy: + automated: + prune: true + selfHeal: true \ No newline at end of file diff --git a/platform/monitoring/overlays/dev/payment/application.yaml b/platform/monitoring/overlays/dev/payment/application.yaml new file mode 100644 index 0000000..d35c555 --- /dev/null +++ b/platform/monitoring/overlays/dev/payment/application.yaml @@ -0,0 +1,34 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: payment-postgres-exporter + namespace: argocd + +spec: + project: default + + source: + repoURL: https://prometheus-community.github.io/helm-charts + chart: prometheus-postgres-exporter + targetRevision: 6.8.0 + + helm: + valuesObject: + serviceMonitor: + enabled: true + + config: + datasource: + host: payment-postgres.dev.svc.cluster.local + port: "5432" + database: paymentdb + + destination: + server: https://kubernetes.default.svc + namespace: dev + + syncPolicy: + automated: + prune: true + selfHeal: true \ No newline at end of file diff --git a/platform/monitoring/overlays/dev/postgres-exporter-patch.yaml b/platform/monitoring/overlays/dev/postgres-exporter-patch.yaml new file mode 100644 index 0000000..12b53a3 --- /dev/null +++ b/platform/monitoring/overlays/dev/postgres-exporter-patch.yaml @@ -0,0 +1,13 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: postgres-exporter + namespace: argocd + +spec: + source: + helm: + valueFiles: + - $values/platform/monitoring/base/postgres-exporter/values-common.yaml + - $values/platform/monitoring/overlays/dev/postgres-values.yaml \ No newline at end of file diff --git a/platform/monitoring/overlays/dev/product/application.yaml b/platform/monitoring/overlays/dev/product/application.yaml new file mode 100644 index 0000000..c12d383 --- /dev/null +++ b/platform/monitoring/overlays/dev/product/application.yaml @@ -0,0 +1,34 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: product-postgres-exporter + namespace: argocd + +spec: + project: default + + source: + repoURL: https://prometheus-community.github.io/helm-charts + chart: prometheus-postgres-exporter + targetRevision: 6.8.0 + + helm: + valuesObject: + serviceMonitor: + enabled: true + + config: + datasource: + host: product-postgres.dev.svc.cluster.local + port: "5432" + database: productdb + + destination: + server: https://kubernetes.default.svc + namespace: dev + + syncPolicy: + automated: + prune: true + selfHeal: true \ No newline at end of file diff --git a/platform/monitoring/overlays/dev/user/application.yaml b/platform/monitoring/overlays/dev/user/application.yaml new file mode 100644 index 0000000..ceaf052 --- /dev/null +++ b/platform/monitoring/overlays/dev/user/application.yaml @@ -0,0 +1,34 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: user-postgres-exporter + namespace: argocd + +spec: + project: default + + source: + repoURL: https://prometheus-community.github.io/helm-charts + chart: prometheus-postgres-exporter + targetRevision: 6.8.0 + + helm: + valuesObject: + serviceMonitor: + enabled: true + + config: + datasource: + host: user-postgres.dev.svc.cluster.local + port: "5432" + database: userdb + + destination: + server: https://kubernetes.default.svc + namespace: dev + + syncPolicy: + automated: + prune: true + selfHeal: true \ No newline at end of file diff --git a/platform/monitoring/overlays/dev/values-dev.yaml b/platform/monitoring/overlays/dev/values-dev.yaml new file mode 100644 index 0000000..c891953 --- /dev/null +++ b/platform/monitoring/overlays/dev/values-dev.yaml @@ -0,0 +1,20 @@ +grafana: + persistence: + storageClassName: gp3 + size: 20Gi + +prometheus: + prometheusSpec: + retention: 30d + + storageSpec: + volumeClaimTemplate: + spec: + storageClassName: gp3 + +alertmanager: + alertmanagerSpec: + storage: + volumeClaimTemplate: + spec: + storageClassName: gp3 \ No newline at end of file diff --git a/platform/monitoring/overlays/dev/values-patch.yaml b/platform/monitoring/overlays/dev/values-patch.yaml deleted file mode 100644 index 969319b..0000000 --- a/platform/monitoring/overlays/dev/values-patch.yaml +++ /dev/null @@ -1,11 +0,0 @@ -grafana: - - persistence: - - size: 5Gi - -prometheus: - - prometheusSpec: - - retention: 5d \ No newline at end of file diff --git a/platform/networking/base/dns/coredns-patch.yaml b/platform/networking/base/dns/coredns-patch.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/networking/base/gateway-api/application.yaml b/platform/networking/base/gateway-api/application.yaml new file mode 100644 index 0000000..00422a2 --- /dev/null +++ b/platform/networking/base/gateway-api/application.yaml @@ -0,0 +1,23 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: gateway-api + namespace: argocd + +spec: + project: default + + source: + repoURL: https://github.com/kubernetes-sigs/gateway-api + targetRevision: v1.2.1 + path: config/crd/standard + + destination: + server: https://kubernetes.default.svc + namespace: default + + syncPolicy: + automated: + prune: true + selfHeal: true \ No newline at end of file diff --git a/platform/networking/base/gateway-api/kustomization.yaml b/platform/networking/base/gateway-api/kustomization.yaml new file mode 100644 index 0000000..dcbd3b7 --- /dev/null +++ b/platform/networking/base/gateway-api/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - application.yaml \ No newline at end of file diff --git a/platform/networking/base/kustomization.yaml b/platform/networking/base/kustomization.yaml index e69de29..4914a6a 100644 --- a/platform/networking/base/kustomization.yaml +++ b/platform/networking/base/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - metrics-server/ + - gateway-api/ \ No newline at end of file diff --git a/platform/networking/base/metrics-server/application.yaml b/platform/networking/base/metrics-server/application.yaml new file mode 100644 index 0000000..4e80b43 --- /dev/null +++ b/platform/networking/base/metrics-server/application.yaml @@ -0,0 +1,29 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: metrics-server + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "-2" + +spec: + project: default + + source: + repoURL: https://kubernetes-sigs.github.io/metrics-server + chart: metrics-server + targetRevision: 3.13.0 + + helm: + valueFiles: + - values-common.yaml + + destination: + server: https://kubernetes.default.svc + namespace: kube-system + + syncPolicy: + automated: + prune: true + selfHeal: true \ No newline at end of file diff --git a/platform/networking/base/metrics-server/helm-release.yaml b/platform/networking/base/metrics-server/helm-release.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/networking/base/metrics-server/kustomization.yaml b/platform/networking/base/metrics-server/kustomization.yaml new file mode 100644 index 0000000..04b2ef6 --- /dev/null +++ b/platform/networking/base/metrics-server/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - application.yaml diff --git a/platform/networking/base/metrics-server/values-common.yaml b/platform/networking/base/metrics-server/values-common.yaml new file mode 100644 index 0000000..d43e459 --- /dev/null +++ b/platform/networking/base/metrics-server/values-common.yaml @@ -0,0 +1,12 @@ +replicas: 2 + +serviceMonitor: + enabled: true + additionalLabels: + prometheus: kube-prometheus + +args: + - --cert-dir=/tmp + - --kubelet-preferred-address-types=InternalIP,Hostname + - --kubelet-use-node-status-port + - --metric-resolution=15s \ No newline at end of file diff --git a/platform/networking/base/metrics-server/values.yaml b/platform/networking/base/metrics-server/values.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/networking/base/namespace.yaml b/platform/networking/base/namespace.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/networking/overlays/dev/application-patch.yaml b/platform/networking/overlays/dev/application-patch.yaml new file mode 100644 index 0000000..5ba522f --- /dev/null +++ b/platform/networking/overlays/dev/application-patch.yaml @@ -0,0 +1,6 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: metrics-server + namespace: argocd \ No newline at end of file diff --git a/platform/networking/overlays/dev/kustomization.yaml b/platform/networking/overlays/dev/kustomization.yaml new file mode 100644 index 0000000..d64f20b --- /dev/null +++ b/platform/networking/overlays/dev/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - ../../base + +patches: + - path: application-patch.yaml \ No newline at end of file diff --git a/platform/overlays/dev/kustomization.yaml b/platform/overlays/dev/kustomization.yaml new file mode 100644 index 0000000..541da90 --- /dev/null +++ b/platform/overlays/dev/kustomization.yaml @@ -0,0 +1,11 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - ../../ingress/overlays/dev + - ../../logging/overlays/dev + - ../../monitoring/overlays/dev + - ../../networking/overlays/dev + - ../../security/overlays/dev + - ../../tracing/overlays/dev + - ../../storage/overlays/dev \ No newline at end of file diff --git a/platform/monitoring/base/namespace.yaml b/platform/overlays/dev/platform-namespace.yaml similarity index 70% rename from platform/monitoring/base/namespace.yaml rename to platform/overlays/dev/platform-namespace.yaml index f52192b..0b345a8 100644 --- a/platform/monitoring/base/namespace.yaml +++ b/platform/overlays/dev/platform-namespace.yaml @@ -2,4 +2,4 @@ apiVersion: v1 kind: Namespace metadata: - name: monitoring \ No newline at end of file + name: dev \ No newline at end of file diff --git a/platform/security/base/external-secrets/helm-release.yaml b/platform/security/base/external-secrets/helm-release.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/security/base/external-secrets/values.yaml b/platform/security/base/external-secrets/values.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/security/base/kustomization.yaml b/platform/security/base/kustomization.yaml index e69de29..a14fe03 100644 --- a/platform/security/base/kustomization.yaml +++ b/platform/security/base/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - kyverno/ + - kyverno-policies/ + - policies/ \ No newline at end of file diff --git a/platform/security/base/kyverno-policies/application.yaml b/platform/security/base/kyverno-policies/application.yaml new file mode 100644 index 0000000..6bdb258 --- /dev/null +++ b/platform/security/base/kyverno-policies/application.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: kyverno-policies + namespace: argocd + +spec: + project: default + + source: + repoURL: https://github.com/Emmy-github-webdev/Kubernetes-argocd.git + targetRevision: main + path: platform/policies/overlays/dev + + destination: + server: https://kubernetes.default.svc + + syncPolicy: + automated: + prune: true + selfHeal: true \ No newline at end of file diff --git a/platform/security/base/kyverno-policies/kustomization.yaml b/platform/security/base/kyverno-policies/kustomization.yaml new file mode 100644 index 0000000..04b2ef6 --- /dev/null +++ b/platform/security/base/kyverno-policies/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - application.yaml diff --git a/platform/security/base/kyverno/application.yaml b/platform/security/base/kyverno/application.yaml new file mode 100644 index 0000000..552448f --- /dev/null +++ b/platform/security/base/kyverno/application.yaml @@ -0,0 +1,32 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: kyverno + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "-2" + +spec: + project: default + + source: + repoURL: https://kyverno.github.io/kyverno + chart: kyverno + targetRevision: 3.3.7 + + helm: + valueFiles: + - values-common.yaml + + destination: + server: https://kubernetes.default.svc + namespace: kyverno + + syncPolicy: + automated: + prune: true + selfHeal: true + + syncOptions: + - CreateNamespace=true \ No newline at end of file diff --git a/platform/security/base/kyverno/helm-release.yaml b/platform/security/base/kyverno/helm-release.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/security/base/kyverno/kustomization.yaml b/platform/security/base/kyverno/kustomization.yaml new file mode 100644 index 0000000..04b2ef6 --- /dev/null +++ b/platform/security/base/kyverno/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - application.yaml diff --git a/platform/security/base/kyverno/values-common.yaml b/platform/security/base/kyverno/values-common.yaml new file mode 100644 index 0000000..3d293b6 --- /dev/null +++ b/platform/security/base/kyverno/values-common.yaml @@ -0,0 +1,21 @@ +replicaCount: 2 + +admissionController: + replicas: 2 + +backgroundController: + replicas: 2 + +cleanupController: + replicas: 2 + +reportsController: + replicas: 2 + +serviceMonitor: + enabled: true + additionalLabels: + prometheus: kube-prometheus + +grafana: + enabled: false \ No newline at end of file diff --git a/platform/security/base/kyverno/values.yaml b/platform/security/base/kyverno/values.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/security/base/namespace.yaml b/platform/security/base/namespace.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/security/base/policies/disallow-hostpath.yaml b/platform/security/base/policies/disallow-hostpath.yaml new file mode 100644 index 0000000..d30a41c --- /dev/null +++ b/platform/security/base/policies/disallow-hostpath.yaml @@ -0,0 +1,38 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy + +metadata: + name: disallow-hostpath + annotations: + argocd.argoproj.io/sync-wave: "0" + +spec: + validationFailureAction: Audit + + background: true + + rules: + + - name: hostpath-volumes + + match: + any: + - resources: + kinds: + - Pod + + exclude: + any: + - resources: + namespaces: + - kube-system + - kyverno + - flux-system + + validate: + message: "HostPath volumes are not allowed." + + pattern: + spec: + =(volumes): + - X(hostPath): "null" \ No newline at end of file diff --git a/platform/security/base/policies/disallow-latest-tag.yaml b/platform/security/base/policies/disallow-latest-tag.yaml index e69de29..a1d5f3f 100644 --- a/platform/security/base/policies/disallow-latest-tag.yaml +++ b/platform/security/base/policies/disallow-latest-tag.yaml @@ -0,0 +1,44 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy + +metadata: + name: disallow-latest-tag + annotations: + argocd.argoproj.io/sync-wave: "0" + +spec: + validationFailureAction: Audit + + background: true + + rules: + + - name: validate-image-tag + + match: + any: + - resources: + kinds: + - Deployment + - StatefulSet + - DaemonSet + - Job + - CronJob + + exclude: + any: + - resources: + namespaces: + - kube-system + - kyverno + - flux-system + + validate: + message: "Images must use a version tag and cannot use latest." + + pattern: + spec: + template: + spec: + containers: + - image: "!*:latest" \ No newline at end of file diff --git a/platform/security/base/policies/disallow-privileged.yaml b/platform/security/base/policies/disallow-privileged.yaml new file mode 100644 index 0000000..044ddbb --- /dev/null +++ b/platform/security/base/policies/disallow-privileged.yaml @@ -0,0 +1,39 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy + +metadata: + name: disallow-privileged + annotations: + argocd.argoproj.io/sync-wave: "0" + +spec: + validationFailureAction: Audit + + background: true + + rules: + + - name: privileged-container + + match: + any: + - resources: + kinds: + - Pod + + exclude: + any: + - resources: + namespaces: + - kube-system + - kyverno + - flux-system + + validate: + message: "Privileged containers are not allowed." + + pattern: + spec: + containers: + - securityContext: + privileged: "false" \ No newline at end of file diff --git a/platform/security/base/policies/kustomization.yaml b/platform/security/base/policies/kustomization.yaml new file mode 100644 index 0000000..89f7304 --- /dev/null +++ b/platform/security/base/policies/kustomization.yaml @@ -0,0 +1,15 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - require-probes.yaml + - require-limits.yaml + - disallow-latest-tag.yaml + - disallow-privileged.yaml + - disallow-hostpath.yaml + - require-readonly-rootfs.yaml + - require-non-root.yaml + - require-networkpolicy.yaml + - require-pdb.yaml + - require-labels.yaml + - policy-exception.yaml \ No newline at end of file diff --git a/platform/security/base/policies/policy-exception.yaml b/platform/security/base/policies/policy-exception.yaml new file mode 100644 index 0000000..7854c7a --- /dev/null +++ b/platform/security/base/policies/policy-exception.yaml @@ -0,0 +1,21 @@ +apiVersion: kyverno.io/v2 +kind: PolicyException + +metadata: + name: system-namespaces-exception + annotations: + argocd.argoproj.io/sync-wave: "0" + +spec: + exceptions: + - policyName: "*" + ruleNames: + - "*" + + match: + any: + - resources: + namespaces: + - kube-system + - kyverno + - argocd \ No newline at end of file diff --git a/platform/security/base/policies/require-labels.yaml b/platform/security/base/policies/require-labels.yaml new file mode 100644 index 0000000..bc32e32 --- /dev/null +++ b/platform/security/base/policies/require-labels.yaml @@ -0,0 +1,43 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy + +metadata: + name: require-labels + annotations: + argocd.argoproj.io/sync-wave: "0" +spec: + validationFailureAction: Audit + + background: true + + rules: + + - name: require-standard-labels + + match: + any: + - resources: + kinds: + - Deployment + - StatefulSet + - DaemonSet + + exclude: + any: + - resources: + namespaces: + - kube-system + - kyverno + - flux-system + + validate: + + message: "Resources must include standard Kubernetes labels." + + pattern: + metadata: + labels: + app.kubernetes.io/name: "?*" + app.kubernetes.io/component: "?*" + app.kubernetes.io/part-of: "?*" + app.kubernetes.io/version: "?*" \ No newline at end of file diff --git a/platform/security/base/policies/require-limits.yaml b/platform/security/base/policies/require-limits.yaml index e69de29..3d4b339 100644 --- a/platform/security/base/policies/require-limits.yaml +++ b/platform/security/base/policies/require-limits.yaml @@ -0,0 +1,62 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy + +metadata: + name: require-resource-limits + annotations: + argocd.argoproj.io/sync-wave: "0" + +spec: + validationFailureAction: Audit + + background: true + + rules: + + - name: require-container-resources + + match: + any: + - resources: + kinds: + - Deployment + - StatefulSet + - DaemonSet + - Job + - CronJob + + exclude: + any: + - resources: + namespaces: + - kube-system + - kyverno + - flux-system + + validate: + message: >- + All containers must define CPU and memory requests and limits. + + foreach: + + - list: "request.object.spec.template.spec.containers" + + pattern: + resources: + requests: + cpu: "?*" + memory: "?*" + limits: + cpu: "?*" + memory: "?*" + + - list: "request.object.spec.template.spec.initContainers" + + pattern: + resources: + requests: + cpu: "?*" + memory: "?*" + limits: + cpu: "?*" + memory: "?*" \ No newline at end of file diff --git a/platform/security/base/policies/require-networkpolicy.yaml b/platform/security/base/policies/require-networkpolicy.yaml new file mode 100644 index 0000000..b62f3ee --- /dev/null +++ b/platform/security/base/policies/require-networkpolicy.yaml @@ -0,0 +1,30 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy + +metadata: + name: require-networkpolicy + annotations: + argocd.argoproj.io/sync-wave: "0" + +spec: + validationFailureAction: Audit + + background: true + + rules: + + - name: require-networkpolicy-label + + match: + any: + - resources: + kinds: + - Deployment + + validate: + message: "Deployment must define networkpolicy.enabled=true label." + + pattern: + metadata: + labels: + networkpolicy.enabled: "true" \ No newline at end of file diff --git a/platform/security/base/policies/require-non-root.yaml b/platform/security/base/policies/require-non-root.yaml new file mode 100644 index 0000000..7d15771 --- /dev/null +++ b/platform/security/base/policies/require-non-root.yaml @@ -0,0 +1,42 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy + +metadata: + name: require-non-root + annotations: + argocd.argoproj.io/sync-wave: "0" + +spec: + validationFailureAction: Audit + + background: true + + rules: + + - name: run-as-non-root + + match: + any: + - resources: + kinds: + - Deployment + - StatefulSet + - DaemonSet + + exclude: + any: + - resources: + namespaces: + - kube-system + - kyverno + - flux-system + + validate: + message: "Containers must run as non-root." + + pattern: + spec: + template: + spec: + securityContext: + runAsNonRoot: true \ No newline at end of file diff --git a/platform/security/base/policies/require-pdb.yaml b/platform/security/base/policies/require-pdb.yaml new file mode 100644 index 0000000..9d212ab --- /dev/null +++ b/platform/security/base/policies/require-pdb.yaml @@ -0,0 +1,31 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy + +metadata: + name: require-pdb + annotations: + argocd.argoproj.io/sync-wave: "0" + +spec: + validationFailureAction: Audit + + background: true + + rules: + + - name: require-pdb-label + + match: + any: + - resources: + kinds: + - Deployment + + validate: + + message: "Deployments must define pdb.enabled=true label." + + pattern: + metadata: + labels: + pdb.enabled: "true" \ No newline at end of file diff --git a/platform/security/base/policies/require-probes.yaml b/platform/security/base/policies/require-probes.yaml index e69de29..696eae3 100644 --- a/platform/security/base/policies/require-probes.yaml +++ b/platform/security/base/policies/require-probes.yaml @@ -0,0 +1,32 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy + +metadata: + name: require-probes + annotations: + argocd.argoproj.io/sync-wave: "0" + +spec: + validationFailureAction: Audit + + background: true + + rules: + - name: check-probes + + match: + any: + - resources: + kinds: + - Deployment + + validate: + message: "Containers must define liveness and readiness probes." + + pattern: + spec: + template: + spec: + containers: + - livenessProbe: "?*" + readinessProbe: "?*" \ No newline at end of file diff --git a/platform/security/base/policies/require-readonly-rootfs.yaml b/platform/security/base/policies/require-readonly-rootfs.yaml new file mode 100644 index 0000000..fbd3327 --- /dev/null +++ b/platform/security/base/policies/require-readonly-rootfs.yaml @@ -0,0 +1,43 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy + +metadata: + name: require-readonly-rootfs + annotations: + argocd.argoproj.io/sync-wave: "0" + +spec: + validationFailureAction: Audit + + background: true + + rules: + + - name: readonly-root-filesystem + + match: + any: + - resources: + kinds: + - Deployment + - StatefulSet + - DaemonSet + + exclude: + any: + - resources: + namespaces: + - kube-system + - kyverno + - flux-system + + validate: + message: "Containers must use a read-only root filesystem." + + pattern: + spec: + template: + spec: + containers: + - securityContext: + readOnlyRootFilesystem: true \ No newline at end of file diff --git a/platform/security/base/policies/restrict-privileged.yaml b/platform/security/base/policies/restrict-privileged.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/security/base/sealed-secrets/helm-release.yaml b/platform/security/base/sealed-secrets/helm-release.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/security/base/sealed-secrets/values.yaml b/platform/security/base/sealed-secrets/values.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/security/overlays/dev/application-patch.yaml b/platform/security/overlays/dev/application-patch.yaml new file mode 100644 index 0000000..25880c1 --- /dev/null +++ b/platform/security/overlays/dev/application-patch.yaml @@ -0,0 +1,6 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: kyverno + namespace: argocd \ No newline at end of file diff --git a/platform/security/overlays/dev/kustomization.yaml b/platform/security/overlays/dev/kustomization.yaml new file mode 100644 index 0000000..306e06d --- /dev/null +++ b/platform/security/overlays/dev/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + + +resources: + - ../../base/ + +patches: + - path: application-patch.yaml \ No newline at end of file diff --git a/platform/storage/base/backup/backup-schedules.yaml b/platform/storage/base/backup/backup-schedules.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/storage/base/backup/kustomization.yaml b/platform/storage/base/backup/kustomization.yaml new file mode 100644 index 0000000..2f7ed70 --- /dev/null +++ b/platform/storage/base/backup/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + + +resources: + - schedules.yaml \ No newline at end of file diff --git a/platform/storage/base/backup/schedules.yaml b/platform/storage/base/backup/schedules.yaml new file mode 100644 index 0000000..dc5b776 --- /dev/null +++ b/platform/storage/base/backup/schedules.yaml @@ -0,0 +1,16 @@ +apiVersion: velero.io/v1 +kind: Schedule + +metadata: + name: daily-backup + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "0" + +spec: + schedule: "0 2 * * *" + + template: + ttl: 168h + includedNamespaces: + - default \ No newline at end of file diff --git a/platform/storage/base/backup/velero/helm.yaml b/platform/storage/base/backup/velero/helm.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/storage/base/backup/velero/values.yaml b/platform/storage/base/backup/velero/values.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/storage/base/ebs-csi-driver/application.yaml b/platform/storage/base/ebs-csi-driver/application.yaml new file mode 100644 index 0000000..5df89be --- /dev/null +++ b/platform/storage/base/ebs-csi-driver/application.yaml @@ -0,0 +1,27 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: ebs-csi-driver + namespace: argocd + +spec: + project: default + + source: + repoURL: https://kubernetes-sigs.github.io/aws-ebs-csi-driver + chart: aws-ebs-csi-driver + targetRevision: 2.44.0 + + helm: + valueFiles: + - values-common.yaml + + destination: + server: https://kubernetes.default.svc + namespace: kube-system + + syncPolicy: + automated: + prune: true + selfHeal: true \ No newline at end of file diff --git a/platform/storage/base/ebs-csi-driver/helm-release.yaml b/platform/storage/base/ebs-csi-driver/helm-release.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/storage/base/ebs-csi-driver/kustomization.yaml b/platform/storage/base/ebs-csi-driver/kustomization.yaml new file mode 100644 index 0000000..9f10ec9 --- /dev/null +++ b/platform/storage/base/ebs-csi-driver/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + + +resources: + - application.yaml \ No newline at end of file diff --git a/platform/storage/base/ebs-csi-driver/values-common.yaml b/platform/storage/base/ebs-csi-driver/values-common.yaml new file mode 100644 index 0000000..2091590 --- /dev/null +++ b/platform/storage/base/ebs-csi-driver/values-common.yaml @@ -0,0 +1,12 @@ +controller: + replicaCount: 2 + +storageClasses: [] + +enableVolumeScheduling: true +enableVolumeResizing: true +enableVolumeSnapshot: true + +serviceAccount: + create: true + name: ebs-csi-controller-sa \ No newline at end of file diff --git a/platform/storage/base/ebs-csi-driver/values.yaml b/platform/storage/base/ebs-csi-driver/values.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/storage/base/efs-csi-driver/application.yaml b/platform/storage/base/efs-csi-driver/application.yaml new file mode 100644 index 0000000..6d53745 --- /dev/null +++ b/platform/storage/base/efs-csi-driver/application.yaml @@ -0,0 +1,27 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: efs-csi-driver + namespace: argocd + +spec: + project: default + + source: + repoURL: https://kubernetes-sigs.github.io/aws-efs-csi-driver + chart: aws-efs-csi-driver + targetRevision: 3.2.8 + + helm: + valueFiles: + - values-common.yaml + + destination: + server: https://kubernetes.default.svc + namespace: kube-system + + syncPolicy: + automated: + prune: true + selfHeal: true \ No newline at end of file diff --git a/platform/storage/base/efs-csi-driver/helm-release.yaml b/platform/storage/base/efs-csi-driver/helm-release.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/storage/base/efs-csi-driver/kustomization.yaml b/platform/storage/base/efs-csi-driver/kustomization.yaml new file mode 100644 index 0000000..9f10ec9 --- /dev/null +++ b/platform/storage/base/efs-csi-driver/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + + +resources: + - application.yaml \ No newline at end of file diff --git a/platform/storage/base/efs-csi-driver/values-common.yaml b/platform/storage/base/efs-csi-driver/values-common.yaml new file mode 100644 index 0000000..7b25f3b --- /dev/null +++ b/platform/storage/base/efs-csi-driver/values-common.yaml @@ -0,0 +1,6 @@ +controller: + replicaCount: 2 + +serviceAccount: + create: true + name: efs-csi-controller-sa \ No newline at end of file diff --git a/platform/storage/base/efs-csi-driver/values.yaml b/platform/storage/base/efs-csi-driver/values.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/storage/base/kustomization.yaml b/platform/storage/base/kustomization.yaml index e69de29..cd001cd 100644 --- a/platform/storage/base/kustomization.yaml +++ b/platform/storage/base/kustomization.yaml @@ -0,0 +1,10 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - backup/ + - ebs-csi-driver/ + - efs-csi-driver/ + - snapshots/ + - storageclasses/ + - velero/ \ No newline at end of file diff --git a/platform/storage/base/namespace.yaml b/platform/storage/base/namespace.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/storage/base/snapshots/kustomization.yaml b/platform/storage/base/snapshots/kustomization.yaml new file mode 100644 index 0000000..8c51cca --- /dev/null +++ b/platform/storage/base/snapshots/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - volume-snapshot-class.yaml \ No newline at end of file diff --git a/platform/storage/base/snapshots/volume-snapshot-class.yaml b/platform/storage/base/snapshots/volume-snapshot-class.yaml new file mode 100644 index 0000000..205bac3 --- /dev/null +++ b/platform/storage/base/snapshots/volume-snapshot-class.yaml @@ -0,0 +1,9 @@ +apiVersion: snapshot.storage.k8s.io/v1 +kind: VolumeSnapshotClass + +metadata: + name: ebs-snapshot + +driver: ebs.csi.aws.com + +deletionPolicy: Delete \ No newline at end of file diff --git a/platform/storage/base/storageclasses/efs.yaml b/platform/storage/base/storageclasses/efs.yaml index e69de29..96a0eff 100644 --- a/platform/storage/base/storageclasses/efs.yaml +++ b/platform/storage/base/storageclasses/efs.yaml @@ -0,0 +1,15 @@ +apiVersion: storage.k8s.io/v1 +kind: StorageClass + +metadata: + name: efs + +provisioner: efs.csi.aws.com + +parameters: + provisioningMode: efs-ap + directoryPerms: "700" + +reclaimPolicy: Delete + +volumeBindingMode: Immediate \ No newline at end of file diff --git a/platform/storage/base/storageclasses/gp3.yaml b/platform/storage/base/storageclasses/gp3.yaml index e69de29..67dedde 100644 --- a/platform/storage/base/storageclasses/gp3.yaml +++ b/platform/storage/base/storageclasses/gp3.yaml @@ -0,0 +1,16 @@ +apiVersion: storage.k8s.io/v1 +kind: StorageClass + +metadata: + name: gp3 + +provisioner: ebs.csi.aws.com + +allowVolumeExpansion: true + +volumeBindingMode: WaitForFirstConsumer + +parameters: + type: gp3 + +reclaimPolicy: Delete \ No newline at end of file diff --git a/platform/storage/base/storageclasses/io2.yaml b/platform/storage/base/storageclasses/io2.yaml index e69de29..e93043b 100644 --- a/platform/storage/base/storageclasses/io2.yaml +++ b/platform/storage/base/storageclasses/io2.yaml @@ -0,0 +1,16 @@ +apiVersion: storage.k8s.io/v1 +kind: StorageClass + +metadata: + name: io2 + +provisioner: ebs.csi.aws.com + +allowVolumeExpansion: true + +volumeBindingMode: WaitForFirstConsumer + +parameters: + type: io2 + +reclaimPolicy: Delete \ No newline at end of file diff --git a/platform/storage/base/storageclasses/kustomization.yaml b/platform/storage/base/storageclasses/kustomization.yaml new file mode 100644 index 0000000..884d5ee --- /dev/null +++ b/platform/storage/base/storageclasses/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - gp3.yaml + - io2.yaml + - efs.yaml \ No newline at end of file diff --git a/platform/storage/base/velero/application.yaml b/platform/storage/base/velero/application.yaml new file mode 100644 index 0000000..e47091b --- /dev/null +++ b/platform/storage/base/velero/application.yaml @@ -0,0 +1,29 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: velero + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "-2" + +spec: + project: default + + source: + repoURL: https://vmware-tanzu.github.io/helm-charts + chart: velero + targetRevision: 11.1.1 + + helm: + valueFiles: + - values-common.yaml + + destination: + server: https://kubernetes.default.svc + namespace: velero + + syncPolicy: + automated: + prune: true + selfHeal: true \ No newline at end of file diff --git a/platform/storage/base/velero/kustomization.yaml b/platform/storage/base/velero/kustomization.yaml new file mode 100644 index 0000000..9f10ec9 --- /dev/null +++ b/platform/storage/base/velero/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + + +resources: + - application.yaml \ No newline at end of file diff --git a/platform/storage/base/velero/values-common.yaml b/platform/storage/base/velero/values-common.yaml new file mode 100644 index 0000000..95a24b5 --- /dev/null +++ b/platform/storage/base/velero/values-common.yaml @@ -0,0 +1,20 @@ +credentials: + useSecret: false + +initContainers: + - name: velero-plugin-for-aws + + image: velero/velero-plugin-for-aws:v1.11.0 + + volumeMounts: + - mountPath: /target + name: plugins + +configuration: + backupStorageLocation: [] + + volumeSnapshotLocation: [] + +snapshotsEnabled: true + +deployNodeAgent: true \ No newline at end of file diff --git a/platform/storage/base/volume-snapshots/schedules.yaml b/platform/storage/base/volume-snapshots/schedules.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/storage/base/volume-snapshots/snapshotclass.yaml b/platform/storage/base/volume-snapshots/snapshotclass.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/storage/overlays/dev/backup-schedule-patch.yaml b/platform/storage/overlays/dev/backup-schedule-patch.yaml new file mode 100644 index 0000000..7f42976 --- /dev/null +++ b/platform/storage/overlays/dev/backup-schedule-patch.yaml @@ -0,0 +1,11 @@ +apiVersion: velero.io/v1 +kind: Schedule + +metadata: + name: daily-backup + namespace: argocd + +spec: + template: + includedNamespaces: + - dev \ No newline at end of file diff --git a/platform/storage/overlays/dev/ebs-csi-driver-application-patch.yaml b/platform/storage/overlays/dev/ebs-csi-driver-application-patch.yaml new file mode 100644 index 0000000..2b4a216 --- /dev/null +++ b/platform/storage/overlays/dev/ebs-csi-driver-application-patch.yaml @@ -0,0 +1,6 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: ebs-csi-driver + namespace: argocd \ No newline at end of file diff --git a/platform/storage/overlays/dev/kustomization.yaml b/platform/storage/overlays/dev/kustomization.yaml new file mode 100644 index 0000000..1e705e3 --- /dev/null +++ b/platform/storage/overlays/dev/kustomization.yaml @@ -0,0 +1,10 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - ../../base + + +patches: + - path: ebs-csi-driver-application-patch.yaml + - path: backup-schedule-patch.yaml \ No newline at end of file diff --git a/platform/tracing/base/instrumentation/java-agent.yaml b/platform/tracing/base/instrumentation/java-agent.yaml new file mode 100644 index 0000000..93191b7 --- /dev/null +++ b/platform/tracing/base/instrumentation/java-agent.yaml @@ -0,0 +1,32 @@ +apiVersion: v1 +kind: ConfigMap + +metadata: + name: opentelemetry-java-agent-config + namespace: tracing + + +data: + + JAVA_TOOL_OPTIONS: >- + -javaagent:/otel/opentelemetry-javaagent.jar + + + OTEL_EXPORTER_OTLP_ENDPOINT: >- + http://opentelemetry-collector.tracing.svc.cluster.local:4317 + + + OTEL_EXPORTER_OTLP_PROTOCOL: grpc + + + OTEL_TRACES_EXPORTER: otlp + + + OTEL_METRICS_EXPORTER: none + + + OTEL_LOGS_EXPORTER: none + + + OTEL_RESOURCE_ATTRIBUTES: >- + service.namespace=REPLACE_ME \ No newline at end of file diff --git a/platform/tracing/base/instrumentation/kustomization.yaml b/platform/tracing/base/instrumentation/kustomization.yaml new file mode 100644 index 0000000..5064b82 --- /dev/null +++ b/platform/tracing/base/instrumentation/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - spring-boot.yaml + - java-agent.yaml \ No newline at end of file diff --git a/platform/tracing/base/instrumentation/spring-boot.yaml b/platform/tracing/base/instrumentation/spring-boot.yaml new file mode 100644 index 0000000..dfcef31 --- /dev/null +++ b/platform/tracing/base/instrumentation/spring-boot.yaml @@ -0,0 +1,34 @@ +apiVersion: opentelemetry.io/v1alpha1 +kind: Instrumentation + +metadata: + name: spring-boot-instrumentation + +spec: + exporter: + endpoint: http://opentelemetry-collector:4317 + + propagators: + - tracecontext + - baggage + - b3 + + sampler: + type: parentbased_traceidratio + argument: "1.0" + + java: + image: ghcr.io/open-telemetry/opentelemetry-operator/autoinstrumentation-java:latest + + env: + - name: OTEL_TRACES_EXPORTER + value: otlp + + - name: OTEL_METRICS_EXPORTER + value: none + + - name: OTEL_LOGS_EXPORTER + value: none + + - name: OTEL_RESOURCE_ATTRIBUTES + value: service.namespace=REPLACE_ME \ No newline at end of file diff --git a/platform/tracing/base/kustomization.yaml b/platform/tracing/base/kustomization.yaml index e69de29..8a071e3 100644 --- a/platform/tracing/base/kustomization.yaml +++ b/platform/tracing/base/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - tempo/ + - opentelemetry-collector/ + - networkpolicy/ \ No newline at end of file diff --git a/platform/tracing/base/namespace.yaml b/platform/tracing/base/namespace.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/tracing/base/networkpolicy/allow-tracing.yaml b/platform/tracing/base/networkpolicy/allow-tracing.yaml index e69de29..8adff7b 100644 --- a/platform/tracing/base/networkpolicy/allow-tracing.yaml +++ b/platform/tracing/base/networkpolicy/allow-tracing.yaml @@ -0,0 +1,39 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy + +metadata: + + name: allow-tracing + + +spec: + + podSelector: + + matchLabels: + + app.kubernetes.io/name: opentelemetry-collector + + + policyTypes: + + - Ingress + + + ingress: + + + - from: + + - namespaceSelector: {} + + ports: + + - protocol: TCP + + port: 4317 + + + - protocol: TCP + + port: 4318 \ No newline at end of file diff --git a/platform/tracing/base/networkpolicy/kustomization.yaml b/platform/tracing/base/networkpolicy/kustomization.yaml new file mode 100644 index 0000000..ac60293 --- /dev/null +++ b/platform/tracing/base/networkpolicy/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + + +resources: + - allow-tracing.yaml \ No newline at end of file diff --git a/platform/tracing/base/opentelemetry-collector/application.yaml b/platform/tracing/base/opentelemetry-collector/application.yaml new file mode 100644 index 0000000..7f64a58 --- /dev/null +++ b/platform/tracing/base/opentelemetry-collector/application.yaml @@ -0,0 +1,30 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: opentelemetry-collector + namespace: argocd + +spec: + project: default + + source: + repoURL: https://open-telemetry.github.io/opentelemetry-helm-charts + chart: opentelemetry-collector + targetRevision: 0.113.0 + + helm: + valueFiles: + - values-common.yaml + + destination: + server: https://kubernetes.default.svc + + + syncPolicy: + automated: + prune: true + selfHeal: true + + syncOptions: + - CreateNamespace=true \ No newline at end of file diff --git a/platform/tracing/base/opentelemetry-collector/kustomization.yaml b/platform/tracing/base/opentelemetry-collector/kustomization.yaml new file mode 100644 index 0000000..9f10ec9 --- /dev/null +++ b/platform/tracing/base/opentelemetry-collector/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + + +resources: + - application.yaml \ No newline at end of file diff --git a/platform/tracing/base/opentelemetry-collector/values-common.yaml b/platform/tracing/base/opentelemetry-collector/values-common.yaml new file mode 100644 index 0000000..ead4595 --- /dev/null +++ b/platform/tracing/base/opentelemetry-collector/values-common.yaml @@ -0,0 +1,58 @@ +mode: deployment + + +replicaCount: 2 + + +image: + + repository: otel/opentelemetry-collector-contrib + + +ports: + + otlp: + enabled: true + + containerPort: 4317 + + servicePort: 4317 + + protocol: TCP + + + otlp-http: + enabled: true + + containerPort: 4318 + + servicePort: 4318 + + protocol: TCP + + +config: + exporters: + + otlp/tempo: + + endpoint: tempo.tracing.svc.cluster.local:4317 + + tls: + insecure: true + + + service: + + pipelines: + + traces: + + receivers: + - otlp + + processors: + - batch + + exporters: + - otlp/tempo \ No newline at end of file diff --git a/platform/tracing/base/pentelemetry-collector/helm-release.yaml b/platform/tracing/base/pentelemetry-collector/helm-release.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/tracing/base/pentelemetry-collector/pipelines.yaml b/platform/tracing/base/pentelemetry-collector/pipelines.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/tracing/base/pentelemetry-collector/values.yaml b/platform/tracing/base/pentelemetry-collector/values.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/tracing/base/tempo/application.yaml b/platform/tracing/base/tempo/application.yaml new file mode 100644 index 0000000..3674510 --- /dev/null +++ b/platform/tracing/base/tempo/application.yaml @@ -0,0 +1,29 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application + +metadata: + name: tempo + namespace: argocd + +spec: + project: default + + source: + repoURL: https://grafana.github.io/helm-charts + chart: tempo + targetRevision: 1.18.2 + + helm: + valueFiles: + - values-common.yaml + + destination: + server: https://kubernetes.default.svc + + syncPolicy: + automated: + prune: true + selfHeal: true + + syncOptions: + - CreateNamespace=true \ No newline at end of file diff --git a/platform/tracing/base/tempo/helm-release.yaml b/platform/tracing/base/tempo/helm-release.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/tracing/base/tempo/kustomization.yaml b/platform/tracing/base/tempo/kustomization.yaml new file mode 100644 index 0000000..9f10ec9 --- /dev/null +++ b/platform/tracing/base/tempo/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + + +resources: + - application.yaml \ No newline at end of file diff --git a/platform/tracing/base/tempo/values-common.yaml b/platform/tracing/base/tempo/values-common.yaml new file mode 100644 index 0000000..d083a73 --- /dev/null +++ b/platform/tracing/base/tempo/values-common.yaml @@ -0,0 +1,43 @@ +tempo: + reportingEnabled: false + +tempoQuery: + enabled: true + + +storage: + trace: + backend: local + + local: + path: /var/tempo/traces + + +persistence: + enabled: true + + storageClassName: gp3 + + size: 20Gi + + +service: + type: ClusterIP + + +metricsGenerator: + enabled: true + + remoteWrite: + - url: http://prometheus-stack-kube-prom-prometheus.monitoring.svc.cluster.local:9090/api/v1/write + + +resources: + + requests: + cpu: 250m + memory: 512Mi + + limits: + cpu: 1000m + memory: 1Gi \ No newline at end of file diff --git a/platform/tracing/base/tempo/values.yaml b/platform/tracing/base/tempo/values.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/platform/tracing/overlays/dev/kustomization.yaml b/platform/tracing/overlays/dev/kustomization.yaml new file mode 100644 index 0000000..c6ce0a9 --- /dev/null +++ b/platform/tracing/overlays/dev/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +namespace: dev + +resources: + - ../../base \ No newline at end of file