common/clustergroup/test.yaml at 1f0988e2b849b285dbd168d5ffaa6948740cb72f · validatedpatterns/common · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
clusterGroup:
  name: hub
  isHubCluster: true
  # Note: setting this to true stores the vault unseal keys inside a cluster secret and
  # is fundamentally insecure
  insecureUnsealVaultInsideCluster: false

  namespaces:
  - open-cluster-management
  - vault
  - golang-external-secrets
  - config-demo

  indexImages:
  - name: snr
    image: quay.io/mshitrit/self-node-remediation-manager-index
    version: 0.0.104

  subscriptions:
    acm:
      name: advanced-cluster-management
      namespace: open-cluster-management
      channel: release-2.5
      csv: advanced-cluster-management.v2.5.0

  projects:
  - hub
  - config-demo

  applications:
    acm:
      name: acm
      namespace: open-cluster-management
      project: hub
      path: common/managedclusters
      ignoreDifferences:
      - group: internal.open-cluster-management.io
        kind: ManagedClusterInfo
        jsonPointers:
          - /spec/loggingCA

    vault:
      name: vault
      namespace: vault
      project: hub
      chart: vault
      repoURL: https://helm.releases.hashicorp.com
      targetRevision: v0.21.0
      overrides:
      - name: global.openshift
        value: "true"
      - name: injector.enabled
        value: "false"
      - name: ui.enabled
        value: "true"
      - name: ui.serviceType
        value: LoadBalancer
      - name: server.route.enabled
        value: "true"
      - name: server.route.host
        value: null
      - name: server.route.tls.termination
        value: edge
      - name: server.image.repository
        value: "registry.connect.redhat.com/hashicorp/vault"
      - name: server.image.tag
        value: "1.11.2-ubi"

    golang-external-secrets:
      name: golang-external-secrets
      namespace: golang-external-secrets
      project: hub
      path: common/golang-external-secrets

    config-demo:
      name: config-demo
      namespace: config-demo
      project: config-demo
      path: charts/all/config-demo

  imperative:
    # NOTE: We *must* use lists and not hashes. As hashes lose ordering once parsed by helm
    # The default schedule is every 10 minutes: imperative.schedule
    # Total timeout of all jobs is 1h: imperative.activeDeadlineSeconds
    # imagePullPolicy is set to always: imperative.imagePullPolicy
    # For additional overrides that apply to the jobs, please refer to
    # https://hybrid-cloud-patterns.io/imperative-actions/#additional-job-customizations
    jobs:
    - name: regional-ca
      # ansible playbook to be run
      playbook: ansible/playbooks/on-hub-get-regional-ca.yml
      # per playbook timeout in seconds
      timeout: 234
      # verbosity: "-v"

  managedClusterGroups:
    region-one:
      name: region-one
      hostedArgoSites:
      - perth
      - sydney
      helmOverrides:
      - name: clusterGroup.isHubCluster
        value: false