Base.yaml

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: core-backplane-network-base
  namespace: argocd

spec:
  goTemplate: true

  generators:
    - merge:
        mergeKeys:
          - name

        generators:
          - list:
              elements:
                - name: core-dc1-talos-prod
                  values:
                    nodePortNetwork: 172.31.241.0/24
                    clusterId: 2
                    peers:
                      - name: core-home1-talos-prod
                        address: 10.44.5.101
                    sriovDevicePluginResourceList:
                      - resourceName: 'intel_i350_port0_vfio'
                        selectors:
                          vendors: ['8086']
                          devices: ['1520']
                          drivers: ['vfio-pci']
                          pfNames: ['eno1']
                      - resourceName: 'intel_i350_port1_vfio'
                        selectors:
                          vendors: ['8086']
                          devices: ['1520']
                          drivers: ['vfio-pci']
                          pfNames: ['eno2']
                      - resourceName: 'intel_i350_port0'
                        deviceType: 'netDevice'
                        selectors:
                          vendors: ['8086']
                          devices: ['1520']
                          pfNames: ['eno1']
                      - resourceName: 'intel_i350_port1'
                        deviceType: 'netDevice'
                        selectors:
                          vendors: ['8086']
                          devices: ['1520']
                          pfNames: ['eno2']
                      - resourceName: 'mlx4_cx3_vfio'
                        resourcePrefix: 'mellanox.com'
                        deviceType: 'netDevice'
                        selectors:
                          - vendors: ['15b3']
                            devices: ['1004']
                            drivers: ['vfio-pci']
                      - resourceName: 'mlx4_cx3_netdevice'
                        resourcePrefix: 'mellanox.com'
                        deviceType: 'netDevice'
                        selectors:
                          - vendors: ['15b3']
                            devices: ['1004']
                            drivers: ['mlx4_core']

                - name: core-home1-talos-prod
                  values:
                    nodePortNetwork: 172.31.193.0/24
                    clusterId: 1
                    peers:
                      - name: core-dc1-talos-prod
                        address: 10.44.3.141
                    sriovDevicePluginResourceList:
                      - resourceName: 'intel_x540_netdevice_port0'
                        resourcePrefix: 'intel.com'
                        deviceType: 'netDevice'
                        selectors:
                          vendors: ['8086']
                          devices: ['1515']
                          drivers: ['ixgbevf']
                          pfNames: ['eno1#0-3', 'enp34s0f0#0-3']
                      - resourceName: 'x540_port0_vlan50'
                        resourcePrefix: 'intel.com'
                        deviceType: 'netDevice'
                        selectors:
                          vendors: ['8086']
                          devices: ['1515']
                          drivers: ['ixgbevf']
                          pfNames: ['eno1#4-7', 'enp34s0f0#4-7']
                      - resourceName: 'intel_x540_netdevice_port1'
                        resourcePrefix: 'intel.com'
                        deviceType: 'netDevice'
                        selectors:
                          vendors: ['8086']
                          devices: ['1515']
                          drivers: ['ixgbevf']
                          pfNames: ['eno2', 'enp34s0f1']
                      - resourceName: 'x540_vfio_port0_gp0'
                        resourcePrefix: 'intel.com'
                        selectors:
                          vendors: ['8086']
                          devices: ['1515']
                          drivers: ['vfio-pci']
                          pfNames: ['eno1#8-10']
                      - resourceName: 'x540_vfio_port0_gp1'
                        resourcePrefix: 'intel.com'
                        selectors:
                          vendors: ['8086']
                          devices: ['1515']
                          drivers: ['vfio-pci']
                          pfNames: ['eno1#11-12']
                      - resourceName: 'x540_vfio_port0_gp3'
                        resourcePrefix: 'intel.com'
                        selectors:
                          vendors: ['8086']
                          devices: ['1515']
                          drivers: ['vfio-pci']
                          pfNames: ['eno1#13-15']
                      - resourceName: 'x540_vfio_port1gp0'
                        resourcePrefix: 'intel.com'
                        selectors:
                          vendors: ['8086']
                          devices: ['1515']
                          drivers: ['vfio-pci']
                          pfNames: ['eno2#12-13']
                      - resourceName: 'x540_vfio_port1gp1'
                        resourcePrefix: 'intel.com'
                        selectors:
                          vendors: ['8086']
                          devices: ['1515']
                          drivers: ['vfio-pci']
                          pfNames: ['eno2#14-15']
                      - resourceName: 'intel_i350_vfio'
                        selectors:
                          vendors: ['8086']
                          devices: ['1520']
                          drivers: ['vfio-pci']
                          pfNames: ['eno2']

          - clusters:
              selector:
                matchLabels:
                  mylogin.space/tenant: 'core.mylogin.space'
                  resolvemy.host/computetype: 'baremetal'
                  resolvemy.host/nodetype: 'infra'
              values:
                clusterName: '{{ .name }}'
                environment: '{{ index .metadata.labels "resolvemy.host/env" }}'
                clusterDomain: '{{ index .metadata.labels "cluster.kubernetes.io/domain" }}'
                tenant: '{{ index .metadata.labels "mylogin.space/tenant" }}'

  syncPolicy:
    preserveResourcesOnDeletion: true

  template:
    metadata:
      name: '{{ .values.clusterName }}-net-base'

      annotations:
        argocd.argoproj.io/manifest-generate-paths: .

    spec:
      project: core

      syncPolicy:
        syncOptions:
          - ServerSideApply=true

      source:
        path: Network/Base
        repoURL: https://github.com/K-FOSS/CoRE-Backplane.git
        targetRevision: HEAD
        plugin:
          name: argocd-lovely-plugin
          env:
            - name: LOVELY_HELM_MERGE
              value: |- # yaml
                {{- $parts := split ":" .server }}
                {{- $hostname := split "//" $parts._1 }}
                cilium:
                  nodePort:
                    # -- Enable the Cilium NodePort service implementation.
                    enabled: false
                    # -- Port range to use for NodePort services.
                    # range: "30000,32767"
                    addresses:
                      - {{ .values.nodePortNetwork }}
                  clustermesh:
                    config:
                      clusters:
                        {{- range $clusterId, $cluster := .values.peers }}
                        {{ $cluster.name }}:
                          enabled: true
                          address: {{ $cluster.address }}
                          port: 2379
                        {{- end }}
                  cluster:
                    # -- Name of the cluster. Only required for Cluster Mesh and mutual authentication with SPIRE.
                    # It must respect the following constraints:
                    # * It must contain at most 32 characters;
                    # * It must begin and end with a lower case alphanumeric character;
                    # * It may contain lower case alphanumeric characters and dashes between.
                    # The "default" name cannot be used if the Cluster ID is different from 0.
                    name: {{ .values.clusterName }}
                    # -- (int) Unique ID of the cluster. Must be unique across all connected
                    # clusters and in the range of 1 to 255. Only required for Cluster Mesh,
                    # may be 0 if Cluster Mesh is not used.
                    id: {{ .values.clusterId }}

                envoy-gw:
                  config:
                    envoyGateway:
                      gateway:
                        controllerName: envoy.{{ .values.tenant }}/base
                  
                  kubernetesClusterDomain: {{ .values.clusterDomain }}
                  
                cf-dns:
                  clusterDomain: {{ .values.clusterDomain }}

                  txtOwnerId: {{ .values.clusterName }}

                sriovDevicePlugin:
                  resourceList:
                    {{ nindent 4 (toYaml .values.sriovDevicePluginResourceList) }}

            - name: LOVELY_KUSTOMIZE_MERGE
              value: |-
                patches:
                  - target:
                      kind: DaemonSet
                      name: kube-multus-ds

                    patch: |
                      - op: replace
                        path: /spec/template/spec/volumes/8/hostPath/path
                        value: /var/run/netns/

                      - op: replace
                        path: /spec/template/spec/initContainers/0/image
                        value: ghcr.io/k8snetworkplumbingwg/multus-cni:stable-thick

                      - op: replace
                        path: /spec/template/spec/containers/0/image
                        value: ghcr.io/k8snetworkplumbingwg/multus-cni:stable-thick

                      - op: replace
                        path: /spec/template/spec/containers/0/resources
                        value:
                          limits:
                            cpu: 500m
                            memory: 1G
                          requests:
                            cpu: 100m
                            memory: 256Mi

                  - target:
                      kind: ConfigMap
                      name: {{ .values.clusterName }}-net-base-frr-k8s-frr-startup

                    patch: |
                      - op: replace
                        path: /data/daemons
                        value: |
                          # This file tells the frr package which daemons to start.
                          #
                          # Sample configurations for these daemons can be found in
                          # /usr/share/doc/frr/examples/.
                          #
                          # ATTENTION:
                          #
                          # When activating a daemon for the first time, a config file, even if it is
                          # empty, has to be present *and* be owned by the user and group "frr", else
                          # the daemon will not be started by /etc/init.d/frr. The permissions should
                          # be u=rw,g=r,o=.
                          # When using "vtysh" such a config file is also needed. It should be owned by
                          # group "frrvty" and set to ug=rw,o= though. Check /etc/pam.d/frr, too.
                          #
                          # The watchfrr and zebra daemons are always started.
                          #
                          bgpd=yes
                          ospfd=yes
                          ospf6d=yes
                          ripd=no
                          ripngd=no
                          isisd=yes
                          pimd=no
                          ldpd=no
                          nhrpd=yes
                          eigrpd=no
                          babeld=no
                          sharpd=no
                          pbrd=no
                          bfdd=yes
                          fabricd=no
                          vrrpd=no

                          #
                          # If this option is set the /etc/init.d/frr script automatically loads
                          # the config via "vtysh -b" when the servers are started.
                          # Check /etc/pam.d/frr if you intend to use "vtysh"!
                          #
                          vtysh_enable=yes
                          zebra_options="  -A 127.0.0.1 -s 90000000 --retain --graceful_restart 120"
                          bgpd_options="   -A 127.0.0.1 "
                          ospfd_options="  -A 127.0.0.1"
                          ospf6d_options=" -A ::1"
                          ripd_options="   -A 127.0.0.1"
                          ripngd_options=" -A ::1"
                          isisd_options="  -A 127.0.0.1"
                          pimd_options="   -A 127.0.0.1"
                          ldpd_options="   -A 127.0.0.1"
                          nhrpd_options="  -A 127.0.0.1"
                          eigrpd_options=" -A 127.0.0.1"
                          babeld_options=" -A 127.0.0.1"
                          sharpd_options=" -A 127.0.0.1"
                          pbrd_options="   -A 127.0.0.1"
                          staticd_options="-A 127.0.0.1"
                          bfdd_options="   -A 127.0.0.1"
                          fabricd_options="-A 127.0.0.1"
                          vrrpd_options="  -A 127.0.0.1"

                          # configuration profile
                          #
                          #frr_profile="traditional"
                          #frr_profile="datacenter"

                          #
                          # This is the maximum number of FD's that will be available.
                          # Upon startup this is read by the control files and ulimit
                          # is called. Uncomment and use a reasonable value for your
                          # setup if you are expecting a large number of peers in
                          # say BGP.
                          #MAX_FDS=1024

                          # The list of daemons to watch is automatically generated by the init script.
                          #watchfrr_options=""

                          # for debugging purposes, you can specify a "wrap" command to start instead
                          # of starting the daemon directly, e.g. to use valgrind on ospfd:
                          #   ospfd_wrap="/usr/bin/valgrind"
                          # or you can use "all_wrap" for all daemons, e.g. to use perf record:
                          #   all_wrap="/usr/bin/perf record --call-graph -"
                          # the normal daemon command is added to this at the end.


      destination:
        server: '{{ .server }}'
        namespace: kube-system