feat/system-team-cd #48

Open
nail.khunafin wants to merge 159 commits from feat/system-team-cd into main
Member
No description provided.
manuel.ganter left a comment

also i would restructure the controller deployment so that we structure it by controller, then target, then purpose

cd/base/controllers/<controller>/<workspace or cluster>/<purpose>

examples:
cd/base/controllers/cluster/kcp-root-controllers-cluster/provision-workspace
cd/base/controllers/cluster/kcp-root-controllers/init-workspace
cd/base/controllers/cluster/parent/deploy-app

I have no strong opinion on naming convention for <workspace or cluster>

also i would restructure the controller deployment so that we structure it by controller, then target, then purpose `cd/base/controllers/<controller>/<workspace or cluster>/<purpose>` examples: cd/base/controllers/cluster/kcp-root-controllers-cluster/provision-workspace cd/base/controllers/cluster/kcp-root-controllers/init-workspace cd/base/controllers/cluster/parent/deploy-app I have no strong opinion on naming convention for `<workspace or cluster>`
@ -0,0 +7,4 @@
files:
- values.yaml
generatorOptions:
disableNameSuffixHash: true

i would also enable the suffix generation for config maps, so that we can ensure that the job is being recreated and rerun on redeployment. And also, that the kubelet mounted the most up to date configmap.

i would also enable the suffix generation for config maps, so that we can ensure that the job is being recreated and rerun on redeployment. And also, that the kubelet mounted the most up to date configmap.
nail.khunafin marked this conversation as resolved
@ -0,0 +25,4 @@
clusters:
- name: kcp-cluster
cluster:
server: https://kcp-deploy-front-proxy.kcp-deploy.svc.cluster.local:8443/clusters/root:controllers:cluster

this should be deployed to root:controllers

this should be deployed to `root:controllers`
Author
Member

What do you mean?
Each controller belongs to the it's own kcp ws.
In this case it's root:controllers:cluster.

What do you mean? Each controller belongs to the it's own kcp ws. In this case it's **root:controllers:cluster.**

aahhh i see you create the kubeconfig used by the other jobs here. Might make sense to create a kubeconfig for each job, when the job is being applied to the parent cluster.

i mean that in these manifests there is a ExternalSecret and Certififcate that in this case points to https://kcp-deploy-front-proxy.kcp-deploy.svc.cluster.local:8443/clusters/root:controllers so that everything that is required for that apply is created during the kustomize apply. Which has the advantage, that i dont need to look for any other resource in the repo if i want to understand what is being deployed in this subfolder.

aahhh i see you create the kubeconfig used by the other jobs here. Might make sense to create a kubeconfig for each job, when the job is being applied to the parent cluster. i mean that in these manifests there is a ExternalSecret and Certififcate that in this case points to `https://kcp-deploy-front-proxy.kcp-deploy.svc.cluster.local:8443/clusters/root:controllers` so that everything that is required for that apply is created during the kustomize apply. Which has the advantage, that i dont need to look for any other resource in the repo if i want to understand what is being deployed in this subfolder.
@ -0,0 +7,4 @@
configMapGenerator:
- name: kcp-cluster-manifests
files:
- ws.yaml

i'd like to change the folder structure in a way to in a first glance what is being deployed on KCP and what on base cluster

image

configMapGenerator:
  - name: kcp-cluster-workspace
    files:
      - manifests/rbac.yaml
      - manifests/authenticated-self-review.yaml
i'd like to change the folder structure in a way to in a first glance what is being deployed on KCP and what on base cluster ![image](/attachments/1f046cc2-effc-4e82-ac3e-e302d46b0a6e) ```yaml configMapGenerator: - name: kcp-cluster-workspace files: - manifests/rbac.yaml - manifests/authenticated-self-review.yaml ```

:o that image was from the other folder, i would do it the same

:o that image was from the other folder, i would do it the same
@ -0,0 +63,4 @@
volumes:
- name: kubeconfig
secret:
secretName: kcp-cluster-kubeconfig

this kubeconfig is not well-defined (at least not defined in this folder, so it is ambiguous where its being deployed)

this kubeconfig is not well-defined (at least not defined in this folder, so it is ambiguous where its being deployed)
Image 0.1.3 CrashLoops with 'unknown flag: --initial-user-password-namespace'
because the pinned OCI chart (CHART_VERSION 0.0.13) still renders that flag,
which the 0.1.x line (ADR 0005 shared edge-connect org) removed. Revert the
image bump until chart and image are migrated to 0.1.x together.
Bootstraps root:controllers:platform with human Zitadel-OIDC admin login,
following the per-domain declarative pattern (manifest-apply-job, sync-waves):

- platform-auth: WorkspaceAuthenticationConfiguration (Zitadel JWT, per-role
  CEL mapping platform-admin -> oidc:platform-admin) + WorkspaceType, applied
  into root:controllers (wave 0)
- init-workspace: Workspace of type platform (wave 1)
- provision-workspace: platform-admin RBAC + self-review into the workspace,
  via a system:masters kubeconfig scoped to root:controllers:platform (wave 2)

Registered in controllers/kustomization.yaml so ArgoCD auto-syncs it.
Reviewed-on: #57
Reviewed-by: Bela Toth <bela.toth06@t-systems.com>
The platform-workspace-bootstrap merge (504cfb9f) left 'catalogue' listed
twice in controllers/kustomization.yaml, causing kustomize build to fail with
'may not add resource with an already registered id: ConfigMap kcp-catalogue-manifests'.
This wedged the ArgoCD kcp-provisioning-dev comparison (sync=Unknown).
This pull request has changes conflicting with the target branch.
  • apisix/base/clusterissuer.yaml
  • apisix/base/kcp-upstream.yaml
  • argocd/apisix.yaml
  • argocd/core-project.yaml
  • argocd/edge-connect-cluster-controller.yaml
  • argocd/edge-connect-provider-onboarding-controller-manager.yaml
  • argocd/edge-connect-rbac-controller.yaml
  • argocd/edge-connect-workspace-controller.yaml
  • argocd/edge-connect-zitadel-controller-manager.yaml
  • argocd/edge-connect.yaml
  • argocd/kcp-admin-kubeconfig.yaml
  • argocd/kcp.yaml
  • argocd/zitadel-actions-webhook.yaml
  • argocd/zitadel-admin-pat.yaml
  • argocd/zitadel-bootstrap.yaml
  • argocd/zitadel-config-controller.yaml
  • argocd/zitadel-database.yaml
  • argocd/zitadel.yaml
  • cd/base/init/apisix/clusterissuer.yaml
  • cd/base/init/apisix/kcp-upstream.yaml
  • cd/base/init/apisix/kustomization.yaml
  • cd/base/init/certificate.yaml
  • cd/base/init/kubeconfig.yaml
  • cd/base/init/rbac.yaml
  • cd/base/init/workspace/controllers/manifests/worksapce.yaml
  • cd/base/init/workspace/orgs/manifests/worksapce.yaml
  • cd/base/init/workspace/providers/manifests/workspace.yaml
  • cd/base/init/zitadel/cluster-secret-store.yaml
  • cd/base/init/zitadel/iam-admin-pat-externalsecret.yaml
  • cd/base/init/zitadel/rbac.yaml
  • cd/base/init/zitadel/zitadel-actions-webhook/values.yaml
  • cd/base/init/zitadel/zitadel-bootstrap/values.yaml
  • cd/base/init/zitadel/zitadel-config-controller/values.yaml
  • cd/base/root/controllers/cluster/cluster-workspace/kubeconfig/kubeconfig.yaml
  • cd/base/root/controllers/cluster/cluster-workspace/provision-workspace/manifests/authenticated-self-review.yaml
  • cd/base/root/controllers/cluster/cluster-workspace/provision-workspace/manifests/rbac.yaml
  • cd/base/root/controllers/kubeconfig.yaml
  • cd/base/root/controllers/platform/platform-workspace/kubeconfig.yaml
  • cd/base/root/controllers/provider-onboarding/provider-onboarding-controller-manager-kcp/values.yaml
  • cd/base/root/controllers/provider-onboarding/provider-onboarding-controller-manager/values.yaml
  • cd/base/root/controllers/provider-onboarding/provider-onboarding-workspace/kubeconfig/kubeconfig.yaml
  • cd/base/root/controllers/rbac/rbac-controller-kcp/values.yaml
  • cd/base/root/controllers/rbac/rbac-controller/values.yaml
  • cd/base/root/controllers/rbac/rbac-workspace/kubeconfig/kubeconfig.yaml
  • cd/base/root/controllers/ssoconfig/zitadel-ssoconfig-controller-kcp/values.yaml
  • cd/base/root/controllers/tenant/edge-connect-apiexport-tenantpolicies-kcp/values.yaml
  • cd/base/root/controllers/tenant/edge-connect-apiexport-tenants-kcp/values.yaml
  • cd/base/root/controllers/tenant/tenant-cm/values.yaml
  • cd/base/root/controllers/tenant/tenant-workspace/init-workspace/manifests/workspace.yaml
  • cd/base/root/controllers/tenant/tenant-workspace/manifests/kcp-service.yaml
  • cd/base/root/controllers/tenant/tenant-workspace/manifests/oidc-session-externalsecret.yaml
  • cd/base/root/controllers/user/zitadel-user-controller-kcp/values.yaml
  • cd/base/root/controllers/workspace/workspace-controller-kcp/values.yaml
  • cd/base/root/controllers/workspace/workspace-controller/values.yaml
  • cd/base/root/controllers/workspace/workspace-workspace/init-workspace/manifests/workspace.yaml
  • cd/base/root/orgs/tenant/edge-connect-apibinding-tenants/values.yaml
  • cd/base/root/orgs/tenant/tenant-workspace/kubeconfig/certificate.yaml
  • cd/base/root/orgs/tenant/tenant-workspace/provision-workspace/manifests/bff-registrar-rbac.yaml
  • cd/base/root/orgs/tenant/tenant-workspace/provision-workspace/manifests/workspace-controller-rbac.yaml
  • charts/iam-database/Chart.yaml
  • charts/iam-database/templates/_helpers.tpl
  • charts/iam-database/templates/database.yaml
  • charts/iam-database/values.yaml
  • charts/iam-zitadel/Chart.lock
  • charts/iam-zitadel/Chart.yaml
  • charts/iam-zitadel/templates/NOTES.txt
  • charts/iam-zitadel/templates/_helpers.tpl
  • charts/iam-zitadel/templates/eso-bootstrap-admin-password.yaml
  • charts/iam-zitadel/templates/eso-masterkey.yaml
  • charts/iam-zitadel/templates/zitadel-cleanup-hook.yaml
  • charts/iam-zitadel/values.yaml
  • cluster/apisix/base/clusterissuer.yaml
  • cluster/apisix/base/etcd.yaml
  • cluster/apisix/base/kcp-upstream.yaml
  • cluster/apisix/base/kustomization.yaml
  • cluster/apisix/base/pki.yaml
  • cluster/apisix/base/secret.yaml
  • cluster/apisix/overlays/devfw-dev/kustomization.yaml
  • cluster/apisix/overlays/local/coredns-localtest.yaml
  • cluster/apisix/overlays/local/kustomization.yaml
  • cluster/apisix/overlays/local/local-ca-copies.yaml
  • cluster/apisix/overlays/local/local-ca.yaml
  • cluster/apisix/overlays/local/signup-route.yaml
  • cluster/cluster-controller/cluster-controller-kubeconfig.yaml
  • cluster/edge-connect/bff-registrar-externalsecret.yaml
  • cluster/edge-connect/externalsecret.yaml
  • cluster/edge-connect/iam-admin-pat-externalsecret.yaml
  • cluster/edge-connect/kcp-dev-service.yaml
  • cluster/edge-connect/oidc-session-externalsecret.yaml
  • cluster/edge-connect/tenant-cm-kubeconfigs.yaml
  • cluster/kcp-admin-kubeconfig/cluster-secret-store.yaml
  • cluster/kcp-admin-kubeconfig/dev-kubeconfig-externalsecret.yaml
  • cluster/kcp-admin-kubeconfig/rbac.yaml
  • cluster/kcp/base/bff-registrar-client-cert.yaml
  • cluster/kcp/base/clusteradmin.yaml
  • cluster/kcp/base/etcd.yaml
  • cluster/kcp/base/frontend-service.yaml
  • cluster/kcp/base/pki.yaml
  • cluster/kcp/base/provider-controller-kubeconfig.yaml
  • cluster/kcp/overlays/local/kustomization.yaml
  • cluster/provider-controller/provider-controller-kubeconfig.yaml
  • cluster/provider-onboarding-controller-manager/provider-onboarding-controller-manager-kubeconfig.yaml
  • cluster/rbac-controller/rbac-controller-kubeconfig.yaml
  • cluster/workspace-controller/workspace-controller-kubeconfig.yaml
  • cluster/zitadel-admin-pat/README.md
  • cluster/zitadel-admin-pat/base/cluster-secret-store.yaml
  • cluster/zitadel-admin-pat/base/kustomization.yaml
  • cluster/zitadel-admin-pat/base/rbac.yaml
  • cluster/zitadel-admin-pat/overlays/dev/kustomization.yaml
  • cluster/zitadel-admin-pat/overlays/dev/patch-cluster-secret-store.yaml
  • cluster/zitadel-admin-pat/overlays/dev/patch-rbac.yaml
  • cluster/zitadel-config-controller/iam-zitadel-smtp-secret.yaml
  • cluster/zitadel-controller-manager/zitadel-ssoconfig-controller-kubeconfig.yaml
  • cluster/zitadel-controller-manager/zitadel-user-controller-kubeconfig.yaml
  • edge-connect-cluster-controller/manifests/cluster-controller-kubeconfig.yaml
  • edge-connect-kcp-controllers-cluster/manifests/workspace-controller-rbac.yaml
  • edge-connect-kcp-orgs/manifests/bff-registrar-rbac.yaml
  • edge-connect-kcp-orgs/manifests/workspace-controller-rbac.yaml
  • edge-connect/manifests/iam-admin-pat-externalsecret.yaml
  • edge-connect/manifests/kcp-dev-service.yaml
  • edge-connect/manifests/oidc-session-externalsecret.yaml
  • env/dev/apisix.yaml
  • env/dev/cluster-controller-kcp.yaml
  • env/dev/kcp.yaml
  • env/dev/provider-controller.yaml
  • env/dev/provider-onboarding-controller-manager.yaml
  • env/dev/rbac-controller-kcp.yaml
  • env/dev/tenant-cm-tenant-controller-apibinding.yaml
  • env/dev/tenant-cm-tenant-controller-apiexport.yaml
  • env/dev/tenant-cm-tenantpolicy-controller-apiexport.yaml
  • env/dev/workspace-controller-kcp.yaml
  • env/dev/zitadel-actions-webhook.yaml
  • env/dev/zitadel-bootstrap.yaml
  • env/dev/zitadel-config-controller.yaml
  • env/dev/zitadel-database.yaml
  • env/dev/zitadel-ssoconfig-controller-kcp.yaml
  • env/dev/zitadel-user-controller-kcp.yaml
  • env/dev/zitadel.yaml
  • env/local/apisix.yaml
  • env/local/rbac-controller-kcp.yaml
  • env/local/tenant-cm-tenant-controller-apibinding.yaml
  • env/local/tenant-cm-tenant-controller-apiexport.yaml
  • env/local/tenant-cm-tenantpolicy-controller-apiexport.yaml
  • env/local/workspace-controller-kcp.yaml
  • env/local/zitadel-actions-webhook.yaml
  • env/local/zitadel-bootstrap.yaml
  • env/local/zitadel-config-controller.yaml
  • env/local/zitadel-database.yaml
  • env/local/zitadel.yaml
  • kcp-admin-kubeconfig/manifests/dev-kubeconfig-externalsecret.yaml
  • kcp-admin-kubeconfig/manifests/rbac.yaml
  • kcp-controllers-workspaces-bootstrap/authenticated-self-review.yaml
  • kcp-controllers-workspaces/tenant.yaml
  • kcp-controllers-workspaces/workspace.yaml
  • kcp-workspaces/controllers.yaml
  • kcp-workspaces/orgs.yaml
  • kcp-workspaces/providers.yaml
  • kcp/base/clusteradmin.yaml
  • provider-controller/manifests/provider-controller-kubeconfig.yaml
  • provider-onboarding-controller-manager-values-dev.yaml
  • rbac-controller-kcp-values-dev.yaml
  • rbac-controller/manifests/rbac-controller-kubeconfig.yaml
  • tenant-cm-tenant-controller-apibinding-values-dev.yaml
  • tenant-cm-tenant-controller-apiexport-values-local.yaml
  • tenant-cm-tenantpolicy-controller-apiexport-values-local.yaml
  • workspace-controller-kcp-values-dev.yaml
  • workspace-controller/manifests/workspace-controller-kubeconfig.yaml
  • workspaces/controllers-bootstrap/authenticated-self-review.yaml
  • workspaces/controllers-cluster/provider-controller-rbac.yaml
  • workspaces/controllers-cluster/workspace-controller-rbac.yaml
  • workspaces/controllers-rbac/provider-onboarding-controller-rbac.yaml
  • workspaces/controllers-rbac/workspace-controller-rbac.yaml
  • workspaces/controllers-tenant/opa-data-controller-rbac.yaml
  • workspaces/controllers-tenant/tenant-controller-rbac.yaml
  • workspaces/controllers/cluster.yaml
  • workspaces/controllers/provider-onboarding-rbac/provider-onboarding-controller-rbac.yaml
  • workspaces/controllers/provider-onboarding.yaml
  • workspaces/controllers/rbac.yaml
  • workspaces/controllers/tenant.yaml
  • workspaces/controllers/workspace.yaml
  • workspaces/orgs/bff-registrar-rbac.yaml
  • workspaces/orgs/workspace-controller-rbac.yaml
  • workspaces/providers/providers-apibinding.yaml
  • workspaces/root/controllers.yaml
  • workspaces/root/orgs.yaml
  • workspaces/root/providers.yaml
  • zitadel-actions-webhook-values-dev.yaml
  • zitadel-admin-pat/base/cluster-secret-store.yaml
  • zitadel-admin-pat/base/kustomization.yaml
  • zitadel-admin-pat/base/rbac.yaml
  • zitadel-bootstrap-values-dev.yaml
  • zitadel-config-controller-values-dev.yaml
  • zitadel-controller-manager/manifests/zitadel-user-controller-kubeconfig.yaml
  • zitadel-ssoconfig-controller-kcp-values-dev.yaml
  • zitadel-user-controller-kcp-values-dev.yaml
View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feat/system-team-cd:feat/system-team-cd
git switch feat/system-team-cd

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff feat/system-team-cd
git switch feat/system-team-cd
git rebase main
git switch main
git merge --ff-only feat/system-team-cd
git switch feat/system-team-cd
git rebase main
git switch main
git merge --no-ff feat/system-team-cd
git switch main
git merge --squash feat/system-team-cd
git switch main
git merge --ff-only feat/system-team-cd
git switch main
git merge feat/system-team-cd
git push origin main
Sign in to join this conversation.
No reviewers
No labels
No milestone
No project
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
DevFW-CICD/poc-core-deploy!48
No description provided.