Skip to content

Commit 537eec0

Browse files
zacharyyonashzacharyyonash
authored
Merge pull request #38 from chainguard-dev/helm-argocd-example
Helm argocd example
2 parents 18a76a3 + cfc6449 commit 537eec0

5 files changed

Lines changed: 212 additions & 0 deletions

File tree

‎helm-charts/argocd/.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# removing CA example for timebeing
2+
*custom-assembly

‎helm-charts/argocd/README.md‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
# Chainguard Helm Charts Catalog
2+
3+
# Kind Setup
4+
5+
Deploy a 3 node kind cluster
6+
7+
```bash
8+
git clone git@github.com:ky-rafaels/kind-cluster.git
9+
10+
cd kind-cluster/
11+
12+
./kind-cluster-deploy 1 cluster1
13+
```
14+
15+
# Helm basics with Chainguard iamguarded charts
16+
17+
```bash
18+
# First login with chainctl, helm will use your local docker credentials to authenticate to the OCI repo
19+
chainctl auth login && chainctl auth configure-docker --pull-token --save
20+
# check if you can view the chart and its values
21+
helm show values oci://cgr.dev/ky-rafaels.example.com/iamguarded-charts/keycloak
22+
# OR
23+
helm show all oci://cgr.dev/ky-rafaels.example.com/iamguarded-charts/keycloak
24+
# Then install the chart
25+
helm upgrade --install keycloak \
26+
-n keycloak \
27+
--create-namespace \
28+
oci://cgr.dev/ky-rafaels.example.com/iamguarded-charts/keycloak
29+
```
30+
31+
# Using ArgoCD
32+
33+
```bash
34+
helm repo add argocd https://argoproj.github.io/argo-helm
35+
helm upgrade --install argocd argocd/argo-cd \
36+
--namespace argocd \
37+
--create-namespace \
38+
--values argo/argo-values.yaml
39+
```
40+
41+
## Static Pull Token Example
42+
43+
### Create pull token on kind nodes for cgr registry
44+
45+
Your pull token should already be created if you followed the steps above to deploy keycloak. Run script to add the pull token to each of the nodes
46+
47+
```bash
48+
# Create a pull token
49+
chainctl auth configure-docker --pull-token --save --ttl 8760h0m0s # 1 year expiration
50+
51+
# ---SAMPLE OUTPUT---
52+
✔ Selected folder ky-rafaels.example.com.
53+
54+
To use this pull token in another environment, run this command:
55+
56+
docker login "cgr.dev" --username "45a0c61ea6fd977f050c5fb9ac06a69eed764595/095b0c7ea9d68679" --password "eyJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJodHRwczovL2lzc3Vlci5lbmZvcmNlLmRldiIsImV4cCI6MTc0OTczODQ2NSwiaWF0IjoxNzQ5NjUyMDY2LCJpc3MiOiJodHRwczovL3B1bGx0b2tlbi5pc3N1ZXIuY2hhaW5ndWFyZC5kZXYiLCJzdWIiOiJwdWxsLXRva2VuLTAxY2MwODkwYzA5N2ZmMzk1MDUyMWY4NWFmYmEyZDUwMGM0ODQxOWEifQ.ET7ywPUkMk5wN6p0INqhNtdnOVELySqdjp-qWedVmJkLrWlZhdFodU43P4uuR-LJ3Z9mVmd9fjDWpBtZnsCFHbczkENPzOiAFP9fsJhO_2dXT3rXCPK84ddJgRLe6oDlMA3VSa0XEclfTyBcaG4RlrgkVaGhtS7gone4Egff7bKX5Y6-TUxxLiVvCA_l_YmOixUss_Mj1Qxxb81sCeh7x4FSpOGWtmU2Z7Hy6B_rGk17zXMO_GYcuyzAMxfFdQl1Ov18t7KxymQwIoS7UF1fx_5ECR8fgArLM8NikGOjzkiQZuSzeI_hl_GnUFdPTAAhmjpJEWO0isiSPWgpkUPx5scoSUm6jzfduvRgGcmjRxT_pq6MWzFJNw9gv9gVehJuW5lKzNIgMTfJXO5Roba8WCwwxiUknhZXP8DeD_kdAN2-JbkfOYg3aPVU5jFTtA6TJKlh0uQA5OGN5hG_PnyzIr0vu4VVninJTWm66RppdlffhG-1xY9lpXgD2k2TIhygFL8iEBNszq0siLVA3uTH6NZY8iGRFqziUAGnyD80aHn52tIeCBBAOyS6qfcRLzqO6dQX95uscdCOuy-5rxU9n4208m5duLXdZtVWa9gp2vg-OmxnCPVdXmPCTA6RF43gDVkxKGMfvkUkTW1nKNvIUx_ikC9tLHDuZdi8FKLeYEg"
57+
58+
Configuring identity "45a0c61ea6fd977f050c5fb9ac06a69eed764595/095b0c7ea9d68679" for pulls from cgr.dev (expires 2025-06-12T09:27:45-05:00).
59+
Overwriting existing credentials.
60+
```
61+
62+
Next you can then run script to copy token to all kind k8s nodes
63+
64+
```bash
65+
./scripts/kind-chainguard-pull-token.sh
66+
67+
# ---SAMPLE OUTPUT---
68+
Configuring identity "b25cd7fccd73dc9a14b3ec891625c5f172624a75/a67f8d22d75f8832" for pulls from cgr.dev (expires 2025-08-13T12:20:03-05:00).
69+
Moving credentials to kind cluster name='kind1' nodes ...
70+
Successfully copied 3.07kB to kind1-control-plane:/var/lib/kubelet/config.json
71+
Successfully copied 3.07kB to kind1-worker2:/var/lib/kubelet/config.json
72+
Successfully copied 3.07kB to kind1-worker:/var/lib/kubelet/config.json
73+
Done!
74+
Removing /var/folders/v_/hp44vp812712ftk9gnzyxj880000gn/T/tmp.DFw44UWmsG/*
75+
```
76+
77+
Then save credentials as env vars to be used later in configuration
78+
79+
```bash
80+
export HELMUSER=45a0c61ea6fd977f050c5fb9ac06a69eed764595/095b0c7ea9d68679
81+
82+
export HELMPASS=eyJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJodHRwczovL2lzc3Vlci5lbmZvcmNlLmRldiIsImV4cCI6MTc0OTczODQ2NSwiaWF0IjoxNzQ5NjUyMDY2LCJpc3MiOiJodHRwczovL3B1bGx0b2tlbi5pc3N1ZXIuY2hhaW5ndWFyZC5kZXYiLCJzdWIiOiJwdWxsLXRva2VuLTAxY2MwODkwYzA5N2ZmMzk1MDUyMWY4NWFmYmEyZDUwMGM0ODQxOWEifQ.ET7ywPUkMk5wN6p0INqhNtdnOVELySqdjp-qWedVmJkLrWlZhdFodU43P4uuR......
83+
```
84+
85+
### Create a secret for ArgoCD Repo Server
86+
87+
```bash
88+
cat << EOF >> cgr-helm-secret.yaml
89+
apiVersion: v1
90+
kind: Secret
91+
metadata:
92+
name: cgr-oci-repo
93+
namespace: argocd
94+
labels:
95+
argocd.argoproj.io/secret-type: repository
96+
stringData:
97+
type: helm
98+
name: cgr-oci-repo
99+
url: cgr.dev/ky-rafaels.example.com/iamguarded-charts
100+
enableOCI: "true"
101+
ForceHttpBasicAuth: "true"
102+
username: ${HELMUSER}
103+
password: ${HELMPASS}
104+
EOF
105+
106+
kubectl apply -f cgr-helm-secret.yaml
107+
```
108+
109+
You can also use the argocd tool to create your repository. First ensure you login
110+
111+
```bash
112+
# Install with brew
113+
brew install argocd
114+
115+
kubectl port-forward svc/argocd-server -n argocd 8080:8080
116+
117+
argocd login http://localhost:8080 --username admin --password $(kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d && echo)
118+
119+
argocd repo add oci://cgr.dev/ky-rafaels.example.com/iamguarded-charts \
120+
--enable-oci \
121+
--type helm \
122+
--name cgr-oci-repo \
123+
--username ${HELMUSER} \
124+
--password ${HELMPASS}
125+
```
126+
127+
### Deploy an app from a chart
128+
129+
Charts have been packaged as ArgoCD applications easing in the deployment. To deploy a chart:
130+
```bash
131+
kubectl apply -f apps/redis-cluster.yaml
132+
```
133+
134+
You can then view ArgoCD to confirm application has properly rolled out
135+
136+
![argo app sync](img/app-rollout.png)
137+
<!--
138+
# Dynamic AuthN using ArgoCD Config Plugin
139+
140+
## Create a plugin using custom-assembly
141+
142+
First, ensure that you have the packages necessary for the argocd-plugin available in your private apk repo as well as the chainguard-base image.
143+
144+
```bash
145+
cat << EOF >> argocd-plugin.yaml
146+
contents:
147+
packages:
148+
- jq
149+
- yq
150+
- helm
151+
- bash-binsh
152+
- chainctl
153+
EOF
154+
```
155+
156+
Then generate a package file and create the image we will use as our argocd plugin. We will use this plugin help the argocd repo server to authenticate with the chainguard registry to read charts.
157+
158+
```bash
159+
chainctl image repo build apply -f custom-assembly/argo-plugin-apks.yaml --parent ky-rafaels.example.com --repo custom-base
160+
``` -->

‎helm-charts/argocd/apps/redis-cluster.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
apiVersion: argoproj.io/v1alpha1
3+
kind: Application
4+
metadata:
5+
name: redis-cluster
6+
namespace: argocd
7+
spec:
8+
project: default
9+
source:
10+
repoURL: cgr.dev/ky-rafaels.example.com/iamguarded-charts
11+
chart: redis-cluster
12+
targetRevision: 12.0.1
13+
helm:
14+
passCredentials: true
15+
values: |
16+
global:
17+
org: ky-rafaels.example.com
18+
destination:
19+
name: "in-cluster"
20+
namespace: 'redis-cluster'
21+
syncPolicy:
22+
automated:
23+
prune: true
24+
syncOptions:
25+
- CreateNamespace=true
26+
- ApplyOutOfSyncOnly=true

‎helm-charts/argocd/argo/argo-values.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
global:
2+
image:
3+
repository: cgr.dev/ky-rafaels.example.com/argocd
4+
tag: 2.14.3
5+
# -- Secrets with credentials to pull images from a private registry
6+
# imagePullSecrets:
7+
# - "regcred"
8+
repoServer:
9+
image:
10+
repository: cgr.dev/ky-rafaels.example.com/argocd-repo-server
11+
tag: 2.14.3
12+
dex:
13+
image:
14+
repository: cgr.dev/ky-rafaels.example.com/dex
15+
tag: 2.42
16+
redis:
17+
image:
18+
repository: cgr.dev/ky-rafaels.example.com/redis
19+
tag: 7.2.7
20+
server:
21+
extraArgs:
22+
- --insecure
23+
crds:
24+
install: true

‎helm-charts/argocd/img/app-rollout.png‎

439 KB
Loading

0 commit comments

Comments
 (0)