fix contour chart: was pointing at Bitnami, now official projectcontour
This commit is contained in:
Mukul Sharma
@@ -1,237 +0,0 @@
|
||||
argo-cd:
|
||||
createClusterRoles: false
|
||||
global:
|
||||
image:
|
||||
tag: "v2.13.8"
|
||||
additionalLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
podLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
nodeSelector:
|
||||
dedicated: devops
|
||||
tolerations:
|
||||
- key: "dedicated"
|
||||
operator: "Equal"
|
||||
value: "devops"
|
||||
effect: "NoSchedule"
|
||||
dex:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
metrics:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 5558
|
||||
controller:
|
||||
replicas: 2
|
||||
enableStatefulSet: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8082
|
||||
resources:
|
||||
limits:
|
||||
cpu: "6"
|
||||
memory: "12Gi"
|
||||
requests:
|
||||
cpu: "4"
|
||||
memory: "8Gi"
|
||||
env:
|
||||
- name: ARGOCD_CONTROLLER_REPLICAS
|
||||
value: '2'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
redis-ha:
|
||||
enabled: true
|
||||
repoServer:
|
||||
autoscaling:
|
||||
enabled: true
|
||||
maxReplicas: 3
|
||||
minReplicas: 2
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 60s
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8084
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_HELM_ALLOW_CONCURRENCY
|
||||
value: 'true'
|
||||
- name: GIT_DEPTH
|
||||
value: '1'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
server:
|
||||
replicas: 3
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 3
|
||||
maxReplicas: 20
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false
|
||||
annotations.nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
annotations.nginx.ingress.kubernetes.io/ssl-redirect: false
|
||||
enabled: true
|
||||
hostname: "argocd-central-ase1c-prd.meeshogcp.in"
|
||||
ingressClassName: nginx-internal
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8083
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_GRPC_KEEP_ALIVE_MIN
|
||||
value: '30s'
|
||||
applicationSet:
|
||||
replicaCount: 2
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
configs:
|
||||
cm:
|
||||
resource.customizations: |
|
||||
keda.sh/ScaledObject:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
local healthy = false
|
||||
local degraded = false
|
||||
local suspended = false
|
||||
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
for i, condition in ipairs(obj.status.conditions) do
|
||||
if condition.status == "False" and condition.type == "Ready" then
|
||||
degraded = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Ready" then
|
||||
healthy = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Paused" then
|
||||
suspended = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if degraded == true then
|
||||
hs.status = "Degraded"
|
||||
return hs
|
||||
elseif healthy == true then
|
||||
hs.status = "Healthy"
|
||||
if suspended == true then
|
||||
hs.message = "ScaledObject is paused as part of normal operations."
|
||||
else
|
||||
hs.message = "ScaledObject is active."
|
||||
end
|
||||
return hs
|
||||
end
|
||||
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Creating ScaledObject or waiting for conditions."
|
||||
return hs
|
||||
url: https://argocd-central-ase1c-prd.meeshogcp.in
|
||||
statusbadge.enabled: "true"
|
||||
timeout.reconciliation.jitter: 60s
|
||||
help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV"
|
||||
help.chatText: "Chat now!"
|
||||
dex.config: |
|
||||
logger:
|
||||
level: error
|
||||
format: json
|
||||
connectors:
|
||||
- type: github
|
||||
id: github
|
||||
name: GitHub
|
||||
loadAllGroups: true
|
||||
admin.enabled: "true"
|
||||
config:
|
||||
clientID: Ov23liADWi36cVVXu001
|
||||
clientSecret: $github-sso-secret:dex.github.clientSecret
|
||||
orgs:
|
||||
- name: Meesho
|
||||
params:
|
||||
controller.sharding.algorithm: round-robin
|
||||
controller.status.processors: '40'
|
||||
controller.operation.processors: '20'
|
||||
controller.repo.server.timeout.seconds: '60'
|
||||
rbac:
|
||||
policy.csv: |
|
||||
p, role:admins, *, *, */*, allow
|
||||
## Policy for Admin-NoDelete role
|
||||
p, role:admin-nodelete, *, get, *, allow
|
||||
p, role:admin-nodelete, *, create, *, allow
|
||||
p, role:admin-nodelete, *, update, *, allow
|
||||
p, role:admin-nodelete, applications, override, *, allow
|
||||
p, role:admin-nodelete, applications, sync, *, allow
|
||||
p, role:admin-nodelete, applications, action/*, *, allow
|
||||
p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow
|
||||
g, Meesho:devops-new, role:admin-nodelete
|
||||
## Policy for BACKEND team
|
||||
p, role:backend, applications, create, cntr-*/*, allow
|
||||
p, role:backend, applications, get, cntr-*/*, allow
|
||||
p, role:backend, applications, override, cntr-*/*, allow
|
||||
p, role:backend, applications, sync, cntr-*/*, allow
|
||||
p, role:backend, applications, update, cntr-*/*, allow
|
||||
p, role:backend, applications, delete, */*, deny
|
||||
p, role:backend, applications, delete/*/Pod/*/*, cntr-*/*, allow
|
||||
p, role:backend, applications, action/apps/Deployment/restart, cntr-*/*, allow
|
||||
p, role:backend, logs, get, cntr-*/*, allow
|
||||
p, role:backend, exec, create, cntr-*/*, allow
|
||||
p, role:backend, projects, get, cntr-*, allow
|
||||
p, role:backend, projects, sync, cntr-*, allow
|
||||
p, role:backend, repositories, update, cntr-*/*, allow
|
||||
## Teams and policy mapping
|
||||
g, Meesho:devops, role:admin
|
||||
g, Meesho:backend, role:backend
|
||||
g, ringmaster, role:admins
|
||||
@@ -1,246 +0,0 @@
|
||||
argo-cd:
|
||||
crds:
|
||||
install: false
|
||||
global:
|
||||
image:
|
||||
tag: "v3.4.3"
|
||||
additionalLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
podLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
nodeSelector:
|
||||
dedicated: devops
|
||||
tolerations:
|
||||
- key: "dedicated"
|
||||
operator: "Equal"
|
||||
value: "devops"
|
||||
effect: "NoSchedule"
|
||||
dex:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
metrics:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 5558
|
||||
controller:
|
||||
replicas: 3
|
||||
enableStatefulSet: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8082
|
||||
resources:
|
||||
limits:
|
||||
cpu: "7"
|
||||
memory: "12Gi"
|
||||
requests:
|
||||
cpu: "6"
|
||||
memory: "8Gi"
|
||||
env:
|
||||
- name: ARGOCD_K8S_CLIENT_QPS
|
||||
value: '250'
|
||||
- name: ARGOCD_CONTROLLER_REPLICAS
|
||||
value: '3'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
redis-ha:
|
||||
enabled: true
|
||||
repoServer:
|
||||
autoscaling:
|
||||
enabled: true
|
||||
maxReplicas: 25
|
||||
minReplicas: 5
|
||||
targetMemoryUtilizationPercentage: 75
|
||||
targetCPUUtilizationPercentage: 60
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 60s
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8084
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 3Gi
|
||||
env:
|
||||
- name: ARGOCD_HELM_ALLOW_CONCURRENCY
|
||||
value: 'true'
|
||||
- name: ARGOCD_EXEC_TIMEOUT
|
||||
value: '600s'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
server:
|
||||
replicas: 3
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 3
|
||||
maxReplicas: 25
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false
|
||||
annotations.nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
annotations.nginx.ingress.kubernetes.io/ssl-redirect: false
|
||||
enabled: true
|
||||
hostname: "argocd-central-prd-ase1a.meeshogcp.in"
|
||||
ingressClassName: nginx-internal
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8083
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_GRPC_KEEP_ALIVE_MIN
|
||||
value: '30s'
|
||||
applicationSet:
|
||||
replicaCount: 2
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
configs:
|
||||
cm:
|
||||
resource.customizations.health.projectcontour.io_HTTPProxy: |
|
||||
hs = {}
|
||||
hs.status = "Healthy"
|
||||
hs.message = "HTTPProxy health check ignored"
|
||||
return hs
|
||||
resource.customizations: |
|
||||
keda.sh/ScaledObject:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
local healthy = false
|
||||
local degraded = false
|
||||
local suspended = false
|
||||
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
for i, condition in ipairs(obj.status.conditions) do
|
||||
if condition.status == "False" and condition.type == "Ready" then
|
||||
degraded = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Ready" then
|
||||
healthy = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Paused" then
|
||||
suspended = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if degraded == true then
|
||||
hs.status = "Degraded"
|
||||
return hs
|
||||
elseif healthy == true then
|
||||
hs.status = "Healthy"
|
||||
if suspended == true then
|
||||
hs.message = "ScaledObject is paused as part of normal operations."
|
||||
else
|
||||
hs.message = "ScaledObject is active."
|
||||
end
|
||||
return hs
|
||||
end
|
||||
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Creating ScaledObject or waiting for conditions."
|
||||
return hs
|
||||
url: https://argocd-central-prd-ase1a.meeshogcp.in
|
||||
accounts.readonly: 'apiKey,login'
|
||||
accounts.ringmaster: 'apiKey,login'
|
||||
timeout.reconciliation: 5m
|
||||
timeout.reconciliation.jitter: 120s
|
||||
statusbadge.enabled: "true"
|
||||
help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV"
|
||||
help.chatText: "Chat now!"
|
||||
dex.config: |
|
||||
logger:
|
||||
level: error
|
||||
format: json
|
||||
connectors:
|
||||
- type: github
|
||||
id: github
|
||||
name: GitHub
|
||||
loadAllGroups: true
|
||||
admin.enabled: "true"
|
||||
config:
|
||||
clientID: Ov23lipLIbj8Q3kZ4p8g
|
||||
clientSecret: $github-sso-secret:dex.github.clientSecret
|
||||
orgs:
|
||||
- name: Meesho
|
||||
params:
|
||||
controller.sharding.algorithm: round-robin
|
||||
controller.status.processors: '60'
|
||||
controller.operation.processors: '30'
|
||||
controller.repo.server.timeout.seconds: '90'
|
||||
reposerver.parallelism.limit: '2'
|
||||
rbac:
|
||||
policy.csv: |
|
||||
p, role:admins, *, *, */*, allow
|
||||
## Policy for BACKEND team
|
||||
p, role:backend, *, get, */*, allow
|
||||
## Policy for Admin-NoDelete role
|
||||
p, role:admin-nodelete, *, get, *, allow
|
||||
p, role:admin-nodelete, *, create, *, allow
|
||||
p, role:admin-nodelete, *, update, *, allow
|
||||
p, role:admin-nodelete, applications, create, */*, allow
|
||||
p, role:admin-nodelete, applications, get, */*, allow
|
||||
p, role:admin-nodelete, applications, override, */*, allow
|
||||
p, role:admin-nodelete, applications, sync, */*, allow
|
||||
p, role:admin-nodelete, applications, update, */*, allow
|
||||
p, role:admin-nodelete, applications, update/*, */*, allow
|
||||
p, role:admin-nodelete, applications, action/*, */*, allow
|
||||
p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow
|
||||
## Policy for devops intern role
|
||||
p, role:intern, *, get, *, allow
|
||||
## Role definition for different Github teams
|
||||
g, Meesho:architects, role:admin-nodelete
|
||||
g, Meesho:devops-new, role:admin-nodelete
|
||||
g, Meesho:devops-interns, role:intern
|
||||
g, Meesho:devops, role:admins
|
||||
g, Meesho:backend, role:backend
|
||||
g, readonly, role:backend
|
||||
g, ringmaster, role:admin-nodelete
|
||||
@@ -1,233 +0,0 @@
|
||||
argo-cd:
|
||||
global:
|
||||
image:
|
||||
tag: "v2.13.8"
|
||||
additionalLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
podLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
nodeSelector:
|
||||
dedicated: devops
|
||||
tolerations:
|
||||
- key: "dedicated"
|
||||
operator: "Equal"
|
||||
value: "devops"
|
||||
effect: "NoSchedule"
|
||||
dex:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
metrics:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 5558
|
||||
controller:
|
||||
replicas: 2
|
||||
enableStatefulSet: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8082
|
||||
resources:
|
||||
limits:
|
||||
cpu: "7"
|
||||
memory: "12Gi"
|
||||
requests:
|
||||
cpu: "6"
|
||||
memory: "8Gi"
|
||||
env:
|
||||
- name: ARGOCD_CONTROLLER_REPLICAS
|
||||
value: '2'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
redis-ha:
|
||||
enabled: true
|
||||
repoServer:
|
||||
autoscaling:
|
||||
enabled: true
|
||||
maxReplicas: 25
|
||||
minReplicas: 3
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 60s
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8084
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 3Gi
|
||||
env:
|
||||
- name: ARGOCD_HELM_ALLOW_CONCURRENCY
|
||||
value: 'true'
|
||||
- name: GIT_DEPTH
|
||||
value: "1"
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
server:
|
||||
replicas: 3
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 3
|
||||
maxReplicas: 20
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false
|
||||
annotations.nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
annotations.nginx.ingress.kubernetes.io/ssl-redirect: false
|
||||
enabled: true
|
||||
hostname: "argocd-central-prd.meeshogcp.in"
|
||||
ingressClassName: nginx-internal
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8083
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_GRPC_KEEP_ALIVE_MIN
|
||||
value: '30s'
|
||||
applicationSet:
|
||||
replicaCount: 2
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
configs:
|
||||
cm:
|
||||
resource.customizations: |
|
||||
keda.sh/ScaledObject:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
local healthy = false
|
||||
local degraded = false
|
||||
local suspended = false
|
||||
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
for i, condition in ipairs(obj.status.conditions) do
|
||||
if condition.status == "False" and condition.type == "Ready" then
|
||||
degraded = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Ready" then
|
||||
healthy = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Paused" then
|
||||
suspended = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if degraded == true then
|
||||
hs.status = "Degraded"
|
||||
return hs
|
||||
elseif healthy == true then
|
||||
hs.status = "Healthy"
|
||||
if suspended == true then
|
||||
hs.message = "ScaledObject is paused as part of normal operations."
|
||||
else
|
||||
hs.message = "ScaledObject is active."
|
||||
end
|
||||
return hs
|
||||
end
|
||||
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Creating ScaledObject or waiting for conditions."
|
||||
return hs
|
||||
url: https://argocd-central-prd.meeshogcp.in
|
||||
accounts.readonly: 'apiKey,login'
|
||||
timeout.reconciliation: 3m
|
||||
timeout.reconciliation.jitter: 60s
|
||||
statusbadge.enabled: "true"
|
||||
help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV"
|
||||
help.chatText: "Chat now!"
|
||||
dex.config: |
|
||||
logger:
|
||||
level: error
|
||||
format: json
|
||||
connectors:
|
||||
- type: github
|
||||
id: github
|
||||
name: GitHub
|
||||
loadAllGroups: true
|
||||
admin.enabled: "true"
|
||||
config:
|
||||
clientID: 281775fcf1df0edda53c
|
||||
clientSecret: $github-sso-secret:dex.github.clientSecret
|
||||
orgs:
|
||||
- name: Meesho
|
||||
params:
|
||||
controller.sharding.algorithm: round-robin
|
||||
controller.status.processors: '40'
|
||||
controller.operation.processors: '20'
|
||||
controller.repo.server.timeout.seconds: '60'
|
||||
rbac:
|
||||
policy.csv: |
|
||||
p, role:admins, *, *, */*, allow
|
||||
## Policy for Admin-NoDelete role
|
||||
p, role:admin-nodelete, *, get, *, allow
|
||||
p, role:admin-nodelete, *, create, *, allow
|
||||
p, role:admin-nodelete, *, update, *, allow
|
||||
p, role:admin-nodelete, applications, create, */*, allow
|
||||
p, role:admin-nodelete, applications, get, */*, allow
|
||||
p, role:admin-nodelete, applications, override, */*, allow
|
||||
p, role:admin-nodelete, applications, sync, */*, allow
|
||||
p, role:admin-nodelete, applications, update, */*, allow
|
||||
p, role:admin-nodelete, applications, action/*, */*, allow
|
||||
p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow
|
||||
g, Meesho:architects, role:admin-nodelete
|
||||
g, Meesho:devops-new, role:admin-nodelete
|
||||
## Policy for BACKEND team
|
||||
p, role:backend, *, get, */*, allow
|
||||
## Teams and policy mapping
|
||||
p, role:intern, *, get, *, allow
|
||||
g, Meesho:devops-interns, role:intern
|
||||
g, Meesho:devops, role:admins
|
||||
g, Meesho:backend, role:backend
|
||||
g, ringmaster, role:admin-nodelete
|
||||
g, readonly, role:backend
|
||||
@@ -1,236 +0,0 @@
|
||||
argo-cd:
|
||||
createClusterRoles: false
|
||||
global:
|
||||
image:
|
||||
tag: "v2.13.8"
|
||||
additionalLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
podLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
nodeSelector:
|
||||
dedicated: devops
|
||||
tolerations:
|
||||
- key: "dedicated"
|
||||
operator: "Equal"
|
||||
value: "devops"
|
||||
effect: "NoSchedule"
|
||||
dex:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
metrics:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 5558
|
||||
controller:
|
||||
replicas: 2
|
||||
enableStatefulSet: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8082
|
||||
resources:
|
||||
limits:
|
||||
cpu: "6"
|
||||
memory: "12Gi"
|
||||
requests:
|
||||
cpu: "4"
|
||||
memory: "8Gi"
|
||||
env:
|
||||
- name: ARGOCD_CONTROLLER_REPLICAS
|
||||
value: '2'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
redis-ha:
|
||||
enabled: true
|
||||
repoServer:
|
||||
autoscaling:
|
||||
enabled: true
|
||||
maxReplicas: 3
|
||||
minReplicas: 2
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 60s
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8084
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_HELM_ALLOW_CONCURRENCY
|
||||
value: 'true'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
server:
|
||||
replicas: 3
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 3
|
||||
maxReplicas: 20
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false
|
||||
annotations.nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
annotations.nginx.ingress.kubernetes.io/ssl-redirect: false
|
||||
enabled: true
|
||||
hostname: "argocd-dataengg-ase1c-prd.meeshogcp.in"
|
||||
ingressClassName: nginx-internal
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8083
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_GRPC_KEEP_ALIVE_MIN
|
||||
value: '30s'
|
||||
applicationSet:
|
||||
replicaCount: 2
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
configs:
|
||||
cm:
|
||||
resource.customizations: |
|
||||
keda.sh/ScaledObject:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
local healthy = false
|
||||
local degraded = false
|
||||
local suspended = false
|
||||
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
for i, condition in ipairs(obj.status.conditions) do
|
||||
if condition.status == "False" and condition.type == "Ready" then
|
||||
degraded = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Ready" then
|
||||
healthy = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Paused" then
|
||||
suspended = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if degraded == true then
|
||||
hs.status = "Degraded"
|
||||
return hs
|
||||
elseif healthy == true then
|
||||
hs.status = "Healthy"
|
||||
if suspended == true then
|
||||
hs.message = "ScaledObject is paused as part of normal operations."
|
||||
else
|
||||
hs.message = "ScaledObject is active."
|
||||
end
|
||||
return hs
|
||||
end
|
||||
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Creating ScaledObject or waiting for conditions."
|
||||
return hs
|
||||
url: https://argocd-dataengg-ase1c-prd.meeshogcp.in
|
||||
statusbadge.enabled: "true"
|
||||
timeout.reconciliation.jitter: 60s
|
||||
help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV"
|
||||
help.chatText: "Chat now!"
|
||||
dex.config: |
|
||||
logger:
|
||||
level: error
|
||||
format: json
|
||||
connectors:
|
||||
- type: github
|
||||
id: github
|
||||
name: GitHub
|
||||
loadAllGroups: true
|
||||
admin.enabled: "true"
|
||||
config:
|
||||
clientID: Ov23lierFtKEWCBjHPN4
|
||||
clientSecret: $github-sso-secret:dex.github.clientSecret
|
||||
orgs:
|
||||
- name: Meesho
|
||||
params:
|
||||
controller.sharding.algorithm: round-robin
|
||||
controller.status.processors: '40'
|
||||
controller.operation.processors: '20'
|
||||
controller.repo.server.timeout.seconds: '60'
|
||||
rbac:
|
||||
policy.csv: |
|
||||
p, role:admins, *, *, */*, allow
|
||||
p, role:admins, *, *, *, allow
|
||||
## Policy for data-engineering team
|
||||
p, role:data-engineering, applications, create, */*, allow
|
||||
p, role:data-engineering, applications, get, */*, allow
|
||||
p, role:data-engineering, applications, override, */*, allow
|
||||
p, role:data-engineering, applications, sync, */*, allow
|
||||
p, role:data-engineering, applications, update, */*, allow
|
||||
p, role:data-engineering, applications, delete, */*, deny
|
||||
p, role:data-engineering, applications, action/apps/Deployment/restart, */*, allow
|
||||
p, role:data-engineering, applications, delete, deng-dpcon/*, allow
|
||||
p, role:data-engineering, applications, delete/*/Pod/*/*, deng-*/*, allow
|
||||
p, role:data-engineering, logs, get, */*, allow
|
||||
p, role:data-engineering, exec, create, */*, allow
|
||||
p, role:data-engineering, projects, get, *, allow
|
||||
p, role:data-engineering, repositories, update, */*, allow
|
||||
## Policy for Admin-NoDelete role
|
||||
p, role:admin-nodelete, *, get, *, allow
|
||||
p, role:admin-nodelete, *, create, *, allow
|
||||
p, role:admin-nodelete, *, update, *, allow
|
||||
p, role:admin-nodelete, applications, override, *, allow
|
||||
p, role:admin-nodelete, applications, sync, *, allow
|
||||
p, role:admin-nodelete, applications, action/*, *, allow
|
||||
p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow
|
||||
g, Meesho:devops-new, role:admin-nodelete
|
||||
## Role definition for different Github teams
|
||||
g, Meesho:devops, role:admins
|
||||
g, Meesho:data-engineering, role:data-engineering
|
||||
g, ringmaster, role:data-engineering
|
||||
@@ -1,277 +0,0 @@
|
||||
argo-cd:
|
||||
crds:
|
||||
install: false
|
||||
global:
|
||||
image:
|
||||
tag: "v3.4.3"
|
||||
additionalLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
podLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
nodeSelector:
|
||||
dedicated: devops
|
||||
tolerations:
|
||||
- key: "dedicated"
|
||||
operator: "Equal"
|
||||
value: "devops"
|
||||
effect: "NoSchedule"
|
||||
dex:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 5558
|
||||
metrics:
|
||||
enabled: true
|
||||
controller:
|
||||
replicas: 3
|
||||
enableStatefulSet: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8082
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: "7"
|
||||
memory: "12Gi"
|
||||
requests:
|
||||
cpu: "6"
|
||||
memory: "8Gi"
|
||||
env:
|
||||
- name: ARGOCD_K8S_CLIENT_QPS
|
||||
value: '250'
|
||||
- name: ARGOCD_CONTROLLER_REPLICAS
|
||||
value: '3'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
redis-ha:
|
||||
enabled: true
|
||||
repoServer:
|
||||
autoscaling:
|
||||
enabled: true
|
||||
maxReplicas: 25
|
||||
minReplicas: 4
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 60s
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8084
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_HELM_ALLOW_CONCURRENCY
|
||||
value: 'true'
|
||||
- name: GIT_DEPTH
|
||||
value: '1'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
server:
|
||||
replicas: 3
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 3
|
||||
maxReplicas: 15
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false
|
||||
annotations.nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
annotations.nginx.ingress.kubernetes.io/ssl-redirect: false
|
||||
enabled: true
|
||||
hostname: "argocd-dataengg-prd.meeshogcp.in"
|
||||
ingressClassName: nginx-internal
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8083
|
||||
env:
|
||||
- name: ARGOCD_GRPC_KEEP_ALIVE_MIN
|
||||
value: '30s'
|
||||
applicationSet:
|
||||
replicaCount: 2
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: false
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
configs:
|
||||
cm:
|
||||
resource.customizations: |
|
||||
projectcontour.io/HTTPProxy:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
if obj.status ~= nil and obj.status.currentStatus ~= nil then
|
||||
if obj.status.currentStatus == "orphaned" then
|
||||
hs.status = "Healthy"
|
||||
hs.message = "HTTPProxy orphaned — ignored"
|
||||
return hs
|
||||
end
|
||||
if obj.status.currentStatus == "valid" then
|
||||
hs.status = "Healthy"
|
||||
hs.message = "HTTPProxy is valid"
|
||||
return hs
|
||||
end
|
||||
if obj.status.currentStatus == "invalid" then
|
||||
hs.status = "Degraded"
|
||||
hs.message = obj.status.description or "HTTPProxy is invalid"
|
||||
return hs
|
||||
end
|
||||
end
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Waiting for HTTPProxy status"
|
||||
return hs
|
||||
|
||||
keda.sh/ScaledObject:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
local healthy = false
|
||||
local degraded = false
|
||||
local suspended = false
|
||||
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
for i, condition in ipairs(obj.status.conditions) do
|
||||
if condition.status == "False" and condition.type == "Ready" then
|
||||
degraded = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Ready" then
|
||||
healthy = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Paused" then
|
||||
suspended = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if degraded == true then
|
||||
hs.status = "Degraded"
|
||||
return hs
|
||||
elseif healthy == true then
|
||||
hs.status = "Healthy"
|
||||
if suspended == true then
|
||||
hs.message = "ScaledObject is paused as part of normal operations."
|
||||
else
|
||||
hs.message = "ScaledObject is active."
|
||||
end
|
||||
return hs
|
||||
end
|
||||
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Creating ScaledObject or waiting for conditions."
|
||||
return hs
|
||||
accounts.ringmaster: 'apiKey,login'
|
||||
accounts.readonly: 'apiKey,login'
|
||||
timeout.reconciliation: 5m
|
||||
timeout.reconciliation.jitter: 60s
|
||||
url: https://argocd-dataengg-prd.meeshogcp.in
|
||||
statusbadge.enabled: "true"
|
||||
help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV"
|
||||
help.chatText: "Chat now!"
|
||||
dex.config: |
|
||||
logger:
|
||||
level: debug
|
||||
format: json
|
||||
connectors:
|
||||
- type: github
|
||||
id: github
|
||||
name: GitHub
|
||||
loadAllGroups: true
|
||||
admin.enabled: "true"
|
||||
config:
|
||||
clientID: Ov23liQLyrDoLpsP742D
|
||||
clientSecret: $github-sso-secret:dex.github.clientSecret
|
||||
orgs:
|
||||
- name: Meesho
|
||||
params:
|
||||
controller.sharding.algorithm: round-robin
|
||||
controller.status.processors: '60'
|
||||
controller.operation.processors: '30'
|
||||
controller.repo.server.timeout.seconds: '90'
|
||||
rbac:
|
||||
policy.csv: |
|
||||
p, role:admins, *, *, */*, allow
|
||||
p, role:admins, *, *, *, allow
|
||||
## Policy for data-engineering team
|
||||
p, role:data-engineering, *, get, */*, allow
|
||||
p, role:data-engineering, applications, sync, */*, allow
|
||||
p, role:data-engineering, applications, delete, */*, deny
|
||||
p, role:data-engineering, applications, delete/*/Pod/*/*, deng-*/*, allow
|
||||
## Policy for Admin-NoDelete role
|
||||
p, role:admin-nodelete, *, get, *, allow
|
||||
p, role:admin-nodelete, *, create, *, allow
|
||||
p, role:admin-nodelete, *, update, *, allow
|
||||
p, role:admin-nodelete, applications, create, */*, allow
|
||||
p, role:admin-nodelete, applications, get, */*, allow
|
||||
p, role:admin-nodelete, applications, override, */*, allow
|
||||
p, role:admin-nodelete, applications, sync, */*, allow
|
||||
p, role:admin-nodelete, applications, update, */*, allow
|
||||
p, role:admin-nodelete, applications, update/*, */*, allow
|
||||
p, role:admin-nodelete, applications, action/*, */*, allow
|
||||
p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow
|
||||
## Policy for devops intern role
|
||||
p, role:intern, *, get, *, allow
|
||||
p, role:backend, *, get, */*, allow
|
||||
## Full access to oss-* apps
|
||||
p, role:data-engineering, applications, *, */oss-*, allow
|
||||
## Role definition for different Github teams
|
||||
g, Meesho:architects, role:admin-nodelete
|
||||
g, Meesho:devops-new, role:admin-nodelete
|
||||
g, Meesho:devops-interns, role:intern
|
||||
g, Meesho:devops, role:admins
|
||||
g, Meesho:data-engineering, role:data-engineering
|
||||
g, ringmaster, role:admin-nodelete
|
||||
g, readonly, role:backend
|
||||
@@ -1,248 +0,0 @@
|
||||
argo-cd:
|
||||
global:
|
||||
image:
|
||||
tag: "v2.13.8"
|
||||
additionalLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
podLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
nodeSelector:
|
||||
dedicated: devops
|
||||
tolerations:
|
||||
- key: "dedicated"
|
||||
operator: "Equal"
|
||||
value: "devops"
|
||||
effect: "NoSchedule"
|
||||
dex:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 5558
|
||||
metrics:
|
||||
enabled: true
|
||||
controller:
|
||||
replicas: 3
|
||||
enableStatefulSet: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8082
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: "7"
|
||||
memory: "12Gi"
|
||||
requests:
|
||||
cpu: "6"
|
||||
memory: "8Gi"
|
||||
env:
|
||||
- name: ARGOCD_K8S_CLIENT_QPS
|
||||
value: '250'
|
||||
- name: ARGOCD_CONTROLLER_REPLICAS
|
||||
value: '3'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
redis-ha:
|
||||
enabled: true
|
||||
repoServer:
|
||||
autoscaling:
|
||||
enabled: true
|
||||
maxReplicas: 25
|
||||
minReplicas: 4
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 60s
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8084
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_HELM_ALLOW_CONCURRENCY
|
||||
value: 'true'
|
||||
- name: GIT_DEPTH
|
||||
value: '1'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
server:
|
||||
replicas: 3
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 3
|
||||
maxReplicas: 15
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false
|
||||
annotations.nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
annotations.nginx.ingress.kubernetes.io/ssl-redirect: false
|
||||
enabled: true
|
||||
hostname: "argocd-deng-prd-oss.meeshogcp.in"
|
||||
ingressClassName: nginx-internal
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8083
|
||||
env:
|
||||
- name: ARGOCD_GRPC_KEEP_ALIVE_MIN
|
||||
value: '30s'
|
||||
applicationSet:
|
||||
replicaCount: 2
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: false
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
configs:
|
||||
cm:
|
||||
resource.customizations: |
|
||||
keda.sh/ScaledObject:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
local healthy = false
|
||||
local degraded = false
|
||||
local suspended = false
|
||||
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
for i, condition in ipairs(obj.status.conditions) do
|
||||
if condition.status == "False" and condition.type == "Ready" then
|
||||
degraded = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Ready" then
|
||||
healthy = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Paused" then
|
||||
suspended = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if degraded == true then
|
||||
hs.status = "Degraded"
|
||||
return hs
|
||||
elseif healthy == true then
|
||||
hs.status = "Healthy"
|
||||
if suspended == true then
|
||||
hs.message = "ScaledObject is paused as part of normal operations."
|
||||
else
|
||||
hs.message = "ScaledObject is active."
|
||||
end
|
||||
return hs
|
||||
end
|
||||
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Creating ScaledObject or waiting for conditions."
|
||||
return hs
|
||||
accounts.ringmaster: 'apiKey,login'
|
||||
accounts.readonly: 'apiKey,login'
|
||||
timeout.reconciliation: 5m
|
||||
timeout.reconciliation.jitter: 60s
|
||||
url: https://argocd-deng-prd-oss.meeshogcp.in
|
||||
statusbadge.enabled: "true"
|
||||
help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV"
|
||||
help.chatText: "Chat now!"
|
||||
dex.config: |
|
||||
logger:
|
||||
level: debug
|
||||
format: json
|
||||
connectors:
|
||||
- type: github
|
||||
id: github
|
||||
name: GitHub
|
||||
loadAllGroups: true
|
||||
admin.enabled: "true"
|
||||
config:
|
||||
clientID: 7a1c7f48988bda76acc8
|
||||
clientSecret: $github-sso-secret:dex.github.clientSecret
|
||||
orgs:
|
||||
- name: Meesho
|
||||
params:
|
||||
controller.sharding.algorithm: round-robin
|
||||
controller.status.processors: '60'
|
||||
controller.operation.processors: '30'
|
||||
controller.repo.server.timeout.seconds: '90'
|
||||
rbac:
|
||||
policy.csv: |
|
||||
p, role:admins, *, *, */*, allow
|
||||
p, role:admins, *, *, *, allow
|
||||
## Policy for data-engineering team
|
||||
p, role:data-engineering, *, get, */*, allow
|
||||
p, role:data-engineering, applications, sync, */*, allow
|
||||
p, role:data-engineering, applications, delete, */*, deny
|
||||
p, role:data-engineering, applications, delete/*/Pod/*/*, deng-*/*, allow
|
||||
## Policy for Admin-NoDelete role
|
||||
p, role:admin-nodelete, *, get, *, allow
|
||||
p, role:admin-nodelete, *, create, *, allow
|
||||
p, role:admin-nodelete, *, update, *, allow
|
||||
p, role:admin-nodelete, applications, create, */*, allow
|
||||
p, role:admin-nodelete, applications, get, */*, allow
|
||||
p, role:admin-nodelete, applications, override, */*, allow
|
||||
p, role:admin-nodelete, applications, sync, */*, allow
|
||||
p, role:admin-nodelete, applications, update, */*, allow
|
||||
p, role:admin-nodelete, applications, action/*, */*, allow
|
||||
p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow
|
||||
## Policy for devops intern role
|
||||
p, role:intern, *, get, *, allow
|
||||
p, role:backend, *, get, */*, allow
|
||||
## Role definition for different Github teams
|
||||
g, Meesho:architects, role:admin-nodelete
|
||||
g, Meesho:devops-new, role:admin-nodelete
|
||||
g, Meesho:devops-interns, role:intern
|
||||
g, Meesho:devops, role:admins
|
||||
g, Meesho:data-engineering, role:data-engineering
|
||||
g, ringmaster, role:admin-nodelete
|
||||
g, readonly, role:backend
|
||||
@@ -1,235 +0,0 @@
|
||||
argo-cd:
|
||||
createClusterRoles: false
|
||||
global:
|
||||
image:
|
||||
tag: "v2.13.8"
|
||||
additionalLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
podLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
nodeSelector:
|
||||
dedicated: devops
|
||||
tolerations:
|
||||
- key: "dedicated"
|
||||
operator: "Equal"
|
||||
value: "devops"
|
||||
effect: "NoSchedule"
|
||||
dex:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
metrics:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 5558
|
||||
controller:
|
||||
replicas: 2
|
||||
enableStatefulSet: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8082
|
||||
resources:
|
||||
limits:
|
||||
cpu: "6"
|
||||
memory: "12Gi"
|
||||
requests:
|
||||
cpu: "4"
|
||||
memory: "8Gi"
|
||||
env:
|
||||
- name: ARGOCD_CONTROLLER_REPLICAS
|
||||
value: '2'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
redis-ha:
|
||||
enabled: true
|
||||
repoServer:
|
||||
autoscaling:
|
||||
enabled: true
|
||||
maxReplicas: 3
|
||||
minReplicas: 2
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 60s
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8084
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_HELM_ALLOW_CONCURRENCY
|
||||
value: 'true'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
server:
|
||||
replicas: 3
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 3
|
||||
maxReplicas: 20
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false
|
||||
annotations.nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
annotations.nginx.ingress.kubernetes.io/ssl-redirect: false
|
||||
enabled: true
|
||||
hostname: "argocd-datascience-ase1c-prd.meeshogcp.in"
|
||||
ingressClassName: nginx-internal
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8083
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_GRPC_KEEP_ALIVE_MIN
|
||||
value: '30s'
|
||||
applicationSet:
|
||||
replicaCount: 2
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
configs:
|
||||
cm:
|
||||
resource.customizations: |
|
||||
keda.sh/ScaledObject:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
local healthy = false
|
||||
local degraded = false
|
||||
local suspended = false
|
||||
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
for i, condition in ipairs(obj.status.conditions) do
|
||||
if condition.status == "False" and condition.type == "Ready" then
|
||||
degraded = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Ready" then
|
||||
healthy = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Paused" then
|
||||
suspended = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if degraded == true then
|
||||
hs.status = "Degraded"
|
||||
return hs
|
||||
elseif healthy == true then
|
||||
hs.status = "Healthy"
|
||||
if suspended == true then
|
||||
hs.message = "ScaledObject is paused as part of normal operations."
|
||||
else
|
||||
hs.message = "ScaledObject is active."
|
||||
end
|
||||
return hs
|
||||
end
|
||||
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Creating ScaledObject or waiting for conditions."
|
||||
return hs
|
||||
url: https://argocd-datascience-ase1c-prd.meeshogcp.in
|
||||
statusbadge.enabled: "true"
|
||||
timeout.reconciliation.jitter: 60s
|
||||
help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV"
|
||||
help.chatText: "Chat now!"
|
||||
dex.config: |
|
||||
logger:
|
||||
level: error
|
||||
format: json
|
||||
connectors:
|
||||
- type: github
|
||||
id: github
|
||||
name: GitHub
|
||||
loadAllGroups: true
|
||||
admin.enabled: "true"
|
||||
config:
|
||||
clientID: Ov23liLZcNrymBZNdJWe
|
||||
clientSecret: $github-sso-secret:dex.github.clientSecret
|
||||
orgs:
|
||||
- name: Meesho
|
||||
params:
|
||||
controller.sharding.algorithm: round-robin
|
||||
controller.status.processors: '40'
|
||||
controller.operation.processors: '20'
|
||||
controller.repo.server.timeout.seconds: '60'
|
||||
rbac:
|
||||
policy.csv: |
|
||||
p, role:admins, *, *, */*, allow
|
||||
## Policy for Admin-NoDelete role
|
||||
p, role:admin-nodelete, *, get, *, allow
|
||||
p, role:admin-nodelete, *, create, *, allow
|
||||
p, role:admin-nodelete, *, update, *, allow
|
||||
p, role:admin-nodelete, applications, override, *, allow
|
||||
p, role:admin-nodelete, applications, sync, *, allow
|
||||
p, role:admin-nodelete, applications, action/*, *, allow
|
||||
p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow
|
||||
g, Meesho:devops-new, role:admin-nodelete
|
||||
## Policy for BACKEND team
|
||||
p, role:backend, applications, create, dsci-*/*, allow
|
||||
p, role:backend, applications, get, dsci-*/*, allow
|
||||
p, role:backend, applications, override, dsci-*/*, allow
|
||||
p, role:backend, applications, sync, dsci-*/*, allow
|
||||
p, role:backend, applications, update, dsci-*/*, allow
|
||||
p, role:backend, applications, delete, */*, deny
|
||||
p, role:backend, applications, delete/*/Pod/*/*, dsci-*/*, allow
|
||||
p, role:backend, applications, action/apps/Deployment/restart, dsci-*/*, allow
|
||||
p, role:backend, logs, get, dsci-*/*, allow
|
||||
p, role:backend, exec, create, dsci-*/*, allow
|
||||
p, role:backend, projects, get, dsci-*, allow
|
||||
p, role:backend, projects, sync, dsci-*, allow
|
||||
p, role:backend, repositories, update, dsci-*/*, allow
|
||||
## Teams and policy mapping
|
||||
g, Meesho:devops, role:admin
|
||||
g, Meesho:backend, role:backend
|
||||
g, ringmaster, role:admins
|
||||
@@ -1,291 +0,0 @@
|
||||
argo-cd:
|
||||
crds:
|
||||
install: false
|
||||
global:
|
||||
image:
|
||||
tag: "v3.4.3"
|
||||
additionalLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
podLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
nodeSelector:
|
||||
dedicated: devops
|
||||
tolerations:
|
||||
- key: "dedicated"
|
||||
operator: "Equal"
|
||||
value: "devops"
|
||||
effect: "NoSchedule"
|
||||
dex:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
metrics:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 5558
|
||||
controller:
|
||||
replicas: 3
|
||||
enableStatefulSet: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8082
|
||||
resources:
|
||||
limits:
|
||||
cpu: "7"
|
||||
memory: "12Gi"
|
||||
requests:
|
||||
cpu: "6"
|
||||
memory: "8Gi"
|
||||
env:
|
||||
- name: ARGOCD_K8S_CLIENT_QPS
|
||||
value: '250'
|
||||
- name: ARGOCD_CONTROLLER_REPLICAS
|
||||
value: '3'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
redis-ha:
|
||||
enabled: true
|
||||
repoServer:
|
||||
autoscaling:
|
||||
enabled: true
|
||||
maxReplicas: 30
|
||||
minReplicas: 7
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 60s
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8084
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_HELM_ALLOW_CONCURRENCY
|
||||
value: 'true'
|
||||
- name: ARGOCD_EXEC_TIMEOUT
|
||||
value: '600s'
|
||||
- name: GIT_DEPTH
|
||||
value: '1'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
server:
|
||||
replicas: 3
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 3
|
||||
maxReplicas: 25
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false
|
||||
annotations.nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
annotations.nginx.ingress.kubernetes.io/ssl-redirect: false
|
||||
enabled: true
|
||||
hostname: "argocd-datascience-prd-ase1a.meeshogcp.in"
|
||||
ingressClassName: nginx-internal
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8083
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_GRPC_KEEP_ALIVE_MIN
|
||||
value: '30s'
|
||||
applicationSet:
|
||||
replicaCount: 4
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
configs:
|
||||
cm:
|
||||
resource.customizations: |
|
||||
projectcontour.io/HTTPProxy:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
if obj.status ~= nil and obj.status.currentStatus ~= nil then
|
||||
if obj.status.currentStatus == "orphaned" then
|
||||
hs.status = "Healthy"
|
||||
hs.message = "HTTPProxy orphaned — ignored"
|
||||
return hs
|
||||
end
|
||||
if obj.status.currentStatus == "valid" then
|
||||
hs.status = "Healthy"
|
||||
hs.message = "HTTPProxy is valid"
|
||||
return hs
|
||||
end
|
||||
if obj.status.currentStatus == "invalid" then
|
||||
hs.status = "Degraded"
|
||||
hs.message = obj.status.description or "HTTPProxy is invalid"
|
||||
return hs
|
||||
end
|
||||
end
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Waiting for HTTPProxy status"
|
||||
return hs
|
||||
|
||||
keda.sh/ScaledObject:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
local healthy = false
|
||||
local degraded = false
|
||||
local suspended = false
|
||||
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
for i, condition in ipairs(obj.status.conditions) do
|
||||
if condition.status == "False" and condition.type == "Ready" then
|
||||
degraded = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Ready" then
|
||||
healthy = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Paused" then
|
||||
suspended = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if degraded == true then
|
||||
hs.status = "Degraded"
|
||||
return hs
|
||||
elseif healthy == true then
|
||||
hs.status = "Healthy"
|
||||
if suspended == true then
|
||||
hs.message = "ScaledObject is paused as part of normal operations."
|
||||
else
|
||||
hs.message = "ScaledObject is active."
|
||||
end
|
||||
return hs
|
||||
end
|
||||
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Creating ScaledObject or waiting for conditions."
|
||||
return hs
|
||||
url: https://argocd-datascience-prd-ase1a.meeshogcp.in
|
||||
accounts.bharatml: apiKey,login
|
||||
accounts.readonly: 'apiKey,login'
|
||||
accounts.ringmaster: 'apiKey,login'
|
||||
timeout.reconciliation: 5m
|
||||
timeout.reconciliation.jitter: 120s
|
||||
statusbadge.enabled: "true"
|
||||
help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV"
|
||||
help.chatText: "Chat now!"
|
||||
dex.config: |
|
||||
logger:
|
||||
level: error
|
||||
format: json
|
||||
connectors:
|
||||
- type: github
|
||||
id: github
|
||||
name: GitHub
|
||||
loadAllGroups: true
|
||||
admin.enabled: "true"
|
||||
config:
|
||||
clientID: Ov23lixf317DQe17LLC5
|
||||
clientSecret: $github-sso-secret:dex.github.clientSecret
|
||||
orgs:
|
||||
- name: Meesho
|
||||
params:
|
||||
controller.sharding.algorithm: round-robin
|
||||
controller.status.processors: '60'
|
||||
controller.operation.processors: '30'
|
||||
controller.repo.server.timeout.seconds: '90'
|
||||
reposerver.parallelism.limit: '2'
|
||||
rbac:
|
||||
policy.csv: |
|
||||
p, role:admins, *, *, */*, allow
|
||||
p, role:admins, *, *, *, allow
|
||||
## Policy for data-science team
|
||||
p, role:datascience, *, get, */*, allow
|
||||
p, role:datascience, applications, delete, */*, deny
|
||||
p, role:datascience, applications, sync, dsci-*/*, allow
|
||||
p, role:datascience, applications, update, dsci-ml/prd-online-feature-store-api-mp*, allow
|
||||
p, role:datascience, applications, update, dsci-ml/prd-online-feature-store-api-v3*, allow
|
||||
p, role:backend, applications, action/apps/Deployment/restart, dsci-*/prd-predator-*, allow
|
||||
p, role:backend, applications, action/apps/Deployment/restart, dsci-*/prd-model-inference-*, allow
|
||||
p, role:datascience, applications, delete/*/Deployment/*/*, dsci-*/prd-model-inference-*, allow
|
||||
p, role:backend, *, get, */*, allow
|
||||
p, role:data-engineering, applications, *, dsci-ds/prd-ds-airflow*, allow
|
||||
## Policy for bharatml team
|
||||
p, role:bharatml-role, applications, get, dsci-*/prd-predator-*, allow
|
||||
p, role:bharatml-role, applications, get, dsci-*/prd-model-inference-*, allow
|
||||
p, role:bharatml-role, applications, action/apps/Deployment/restart, dsci-*/prd-predator-*, allow
|
||||
p, role:bharatml-role, applications, action/apps/Deployment/restart, dsci-*/prd-model-inference-*, allow
|
||||
p, role:bharatml-role, applications, delete/*/Pod/*/*, dsci-*/prd-predator-*, allow
|
||||
p, role:bharatml-role, applications, delete/*/Pod/*/*, dsci-*/prd-model-inference-*, allow
|
||||
p, role:bharatml-role, applications, update/keda.sh/ScaledObject/*/*, dsci-*/prd-predator-*, allow
|
||||
p, role:bharatml-role, applications, update/keda.sh/ScaledObject/*/*, dsci-*/prd-model-inference-*, allow
|
||||
## Policy for Admin-NoDelete role
|
||||
p, role:admin-nodelete, *, get, *, allow
|
||||
p, role:admin-nodelete, *, create, *, allow
|
||||
p, role:admin-nodelete, *, update, *, allow
|
||||
p, role:admin-nodelete, applications, create, */*, allow
|
||||
p, role:admin-nodelete, applications, get, */*, allow
|
||||
p, role:admin-nodelete, applications, override, */*, allow
|
||||
p, role:admin-nodelete, applications, sync, */*, allow
|
||||
p, role:admin-nodelete, applications, update, */*, allow
|
||||
p, role:admin-nodelete, applications, update/*, */*, allow
|
||||
p, role:admin-nodelete, applications, action/*, */*, allow
|
||||
p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow
|
||||
## Policy for devops intern role
|
||||
p, role:intern, *, get, *, allow
|
||||
p, role:backend-ro, *, get, */*, allow
|
||||
## Role definition for different Github teams
|
||||
g, Meesho:architects, role:admin-nodelete
|
||||
g, Meesho:devops-new, role:admin-nodelete
|
||||
g, Meesho:devops-interns, role:intern
|
||||
g, Meesho:devops, role:admins
|
||||
g, Meesho:datascience, role:datascience
|
||||
g, Meesho:backend, role:backend
|
||||
g, Meesho:data-engineering, role:data-engineering
|
||||
g, ringmaster, role:admin-nodelete
|
||||
g, bharatml, role:bharatml-role
|
||||
g, readonly, role:backend-ro
|
||||
@@ -1,256 +0,0 @@
|
||||
argo-cd:
|
||||
global:
|
||||
image:
|
||||
tag: "v2.13.8"
|
||||
additionalLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
podLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
nodeSelector:
|
||||
dedicated: devops
|
||||
tolerations:
|
||||
- key: "dedicated"
|
||||
operator: "Equal"
|
||||
value: "devops"
|
||||
effect: "NoSchedule"
|
||||
dex:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
metrics:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 5558
|
||||
controller:
|
||||
replicas: 3
|
||||
enableStatefulSet: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8082
|
||||
resources:
|
||||
limits:
|
||||
cpu: "7"
|
||||
memory: "12Gi"
|
||||
requests:
|
||||
cpu: "6"
|
||||
memory: "8Gi"
|
||||
env:
|
||||
- name: ARGOCD_CONTROLLER_REPLICAS
|
||||
value: '3'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
redis-ha:
|
||||
enabled: true
|
||||
repoServer:
|
||||
autoscaling:
|
||||
enabled: true
|
||||
maxReplicas: 25
|
||||
minReplicas: 3
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 60s
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8084
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_HELM_ALLOW_CONCURRENCY
|
||||
value: 'true'
|
||||
- name: GIT_DEPTH
|
||||
value: '1'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
server:
|
||||
replicas: 3
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 3
|
||||
maxReplicas: 15
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false
|
||||
annotations.nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
annotations.nginx.ingress.kubernetes.io/ssl-redirect: false
|
||||
enabled: true
|
||||
hostname: "argocd-datascience-prd.meeshogcp.in"
|
||||
ingressClassName: nginx-internal
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8083
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_GRPC_KEEP_ALIVE_MIN
|
||||
value: '30s'
|
||||
applicationSet:
|
||||
replicaCount: 2
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
configs:
|
||||
cm:
|
||||
resource.customizations: |
|
||||
keda.sh/ScaledObject:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
local healthy = false
|
||||
local degraded = false
|
||||
local suspended = false
|
||||
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
for i, condition in ipairs(obj.status.conditions) do
|
||||
if condition.status == "False" and condition.type == "Ready" then
|
||||
degraded = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Ready" then
|
||||
healthy = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Paused" then
|
||||
suspended = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if degraded == true then
|
||||
hs.status = "Degraded"
|
||||
return hs
|
||||
elseif healthy == true then
|
||||
hs.status = "Healthy"
|
||||
if suspended == true then
|
||||
hs.message = "ScaledObject is paused as part of normal operations."
|
||||
else
|
||||
hs.message = "ScaledObject is active."
|
||||
end
|
||||
return hs
|
||||
end
|
||||
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Creating ScaledObject or waiting for conditions."
|
||||
return hs
|
||||
accounts.ringmaster: 'apiKey,login'
|
||||
accounts.readonly: 'apiKey,login'
|
||||
timeout.reconciliation: 4m
|
||||
timeout.reconciliation.jitter: 60s
|
||||
url: https://argocd-datascience-prd.meeshogcp.in
|
||||
statusbadge.enabled: "true"
|
||||
help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV"
|
||||
help.chatText: "Chat now!"
|
||||
dex.config: |
|
||||
logger:
|
||||
level: error
|
||||
format: json
|
||||
connectors:
|
||||
- type: github
|
||||
id: github
|
||||
name: GitHub
|
||||
loadAllGroups: true
|
||||
admin.enabled: "true"
|
||||
config:
|
||||
clientID: 37e058fb1915c193747e
|
||||
clientSecret: $github-sso-secret:dex.github.clientSecret
|
||||
orgs:
|
||||
- name: Meesho
|
||||
params:
|
||||
controller.sharding.algorithm: round-robin
|
||||
controller.status.processors: '50'
|
||||
controller.operation.processors: '25'
|
||||
controller.repo.server.timeout.seconds: '90'
|
||||
rbac:
|
||||
policy.csv: |
|
||||
p, role:admins, *, *, */*, allow
|
||||
p, role:admins, *, *, *, allow
|
||||
## Policy for data-science team
|
||||
p, role:datascience, *, get, */*, allow
|
||||
p, role:datascience, applications, delete, */*, deny
|
||||
p, role:datascience, applications, sync, dsci-*/*, allow
|
||||
p, role:datascience, applications, update, dsci-ml/prd-online-feature-store-api-mp*, allow
|
||||
p, role:datascience, applications, update, dsci-ml/prd-online-feature-store-api-v3*, allow
|
||||
p, role:backend, applications, action/apps/Deployment/restart, dsci-*/prd-predator-*, allow
|
||||
p, role:backend, applications, action/apps/Deployment/restart, dsci-*/prd-model-inference-*, allow
|
||||
p, role:datascience, applications, delete/*/Deployment/*/*, dsci-*/prd-model-inference-*, allow
|
||||
p, role:backend, *, get, */*, allow
|
||||
p, role:data-engineering, applications, *, dsci-ds/prd-ds-airflow*, allow
|
||||
## Policy for bharatml team
|
||||
p, role:bharatml-role, applications, get, dsci-*/prd-predator-*, allow
|
||||
p, role:bharatml-role, applications, get, dsci-*/prd-model-inference-*, allow
|
||||
p, role:bharatml-role, applications, action/apps/Deployment/restart, dsci-*/prd-predator-*, allow
|
||||
p, role:bharatml-role, applications, action/apps/Deployment/restart, dsci-*/prd-model-inference-*, allow
|
||||
p, role:bharatml-role, applications, delete/*/Pod/*/*, dsci-*/prd-predator-*, allow
|
||||
p, role:bharatml-role, applications, delete/*/Pod/*/*, dsci-*/prd-model-inference-*, allow
|
||||
p, role:bharatml-role, applications, update/keda.sh/ScaledObject/*/*, dsci-*/prd-predator-*, allow
|
||||
p, role:bharatml-role, applications, update/keda.sh/ScaledObject/*/*, dsci-*/prd-model-inference-*, allow
|
||||
## Policy for Admin-NoDelete role
|
||||
p, role:admin-nodelete, *, get, *, allow
|
||||
p, role:admin-nodelete, *, create, *, allow
|
||||
p, role:admin-nodelete, *, update, *, allow
|
||||
p, role:admin-nodelete, applications, create, */*, allow
|
||||
p, role:admin-nodelete, applications, get, */*, allow
|
||||
p, role:admin-nodelete, applications, override, */*, allow
|
||||
p, role:admin-nodelete, applications, sync, */*, allow
|
||||
p, role:admin-nodelete, applications, update, */*, allow
|
||||
p, role:admin-nodelete, applications, action/*, */*, allow
|
||||
p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow
|
||||
## Policy for devops intern role
|
||||
p, role:intern, *, get, *, allow
|
||||
p, role:backend-ro, *, get, */*, allow
|
||||
## Role definition for different Github teams
|
||||
g, Meesho:architects, role:admin-nodelete
|
||||
g, Meesho:devops-new, role:admin-nodelete
|
||||
g, Meesho:devops-interns, role:intern
|
||||
g, Meesho:devops, role:admins
|
||||
g, Meesho:datascience, role:datascience
|
||||
g, Meesho:backend, role:backend
|
||||
g, Meesho:data-engineering, role:data-engineering
|
||||
g, ringmaster, role:admin-nodelete
|
||||
g, bharatml, role:bharatml-role
|
||||
g, readonly, role:backend-ro
|
||||
@@ -1,250 +0,0 @@
|
||||
argo-cd:
|
||||
createClusterRoles: false
|
||||
global:
|
||||
image:
|
||||
tag: "v2.13.8"
|
||||
additionalLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
podLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
nodeSelector:
|
||||
dedicated: devops
|
||||
tolerations:
|
||||
- key: "dedicated"
|
||||
operator: "Equal"
|
||||
value: "devops"
|
||||
effect: "NoSchedule"
|
||||
dex:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
metrics:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 5558
|
||||
controller:
|
||||
replicas: 2
|
||||
enableStatefulSet: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8082
|
||||
resources:
|
||||
limits:
|
||||
cpu: "6"
|
||||
memory: "12Gi"
|
||||
requests:
|
||||
cpu: "4"
|
||||
memory: "8Gi"
|
||||
env:
|
||||
- name: ARGOCD_CONTROLLER_REPLICAS
|
||||
value: '2'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
redis-ha:
|
||||
enabled: true
|
||||
repoServer:
|
||||
autoscaling:
|
||||
enabled: true
|
||||
maxReplicas: 3
|
||||
minReplicas: 2
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 60s
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8084
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_HELM_ALLOW_CONCURRENCY
|
||||
value: 'true'
|
||||
- name: GIT_DEPTH
|
||||
value: '1'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
server:
|
||||
replicas: 3
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 3
|
||||
maxReplicas: 20
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false
|
||||
annotations.nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
annotations.nginx.ingress.kubernetes.io/ssl-redirect: false
|
||||
enabled: true
|
||||
hostname: "argocd-demand-ase1c-prd.meeshogcp.in"
|
||||
ingressClassName: nginx-internal
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8083
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_GRPC_KEEP_ALIVE_MIN
|
||||
value: '30s'
|
||||
applicationSet:
|
||||
replicaCount: 2
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
configs:
|
||||
cm:
|
||||
resource.customizations: |
|
||||
keda.sh/ScaledObject:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
local healthy = false
|
||||
local degraded = false
|
||||
local suspended = false
|
||||
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
for i, condition in ipairs(obj.status.conditions) do
|
||||
if condition.status == "False" and condition.type == "Ready" then
|
||||
degraded = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Ready" then
|
||||
healthy = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Paused" then
|
||||
suspended = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if degraded == true then
|
||||
hs.status = "Degraded"
|
||||
return hs
|
||||
elseif healthy == true then
|
||||
hs.status = "Healthy"
|
||||
if suspended == true then
|
||||
hs.message = "ScaledObject is paused as part of normal operations."
|
||||
else
|
||||
hs.message = "ScaledObject is active."
|
||||
end
|
||||
return hs
|
||||
end
|
||||
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Creating ScaledObject or waiting for conditions."
|
||||
return hs
|
||||
url: https://argocd-demand-ase1c-prd.meeshogcp.in
|
||||
statusbadge.enabled: "true"
|
||||
timeout.reconciliation.jitter: 60s
|
||||
help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV"
|
||||
help.chatText: "Chat now!"
|
||||
dex.config: |
|
||||
logger:
|
||||
level: error
|
||||
format: json
|
||||
connectors:
|
||||
- type: github
|
||||
id: github
|
||||
name: GitHub
|
||||
loadAllGroups: true
|
||||
admin.enabled: "true"
|
||||
config:
|
||||
clientID: Ov23lieojxIuQFqAqT2N
|
||||
clientSecret: $github-sso-secret:dex.github.clientSecret
|
||||
orgs:
|
||||
- name: Meesho
|
||||
params:
|
||||
controller.sharding.algorithm: round-robin
|
||||
controller.status.processors: '40'
|
||||
controller.operation.processors: '20'
|
||||
controller.repo.server.timeout.seconds: '60'
|
||||
rbac:
|
||||
policy.csv: |
|
||||
## Policy for live-commerce team
|
||||
p, role:live-commerce, applications, create, dmnd-*/*, allow
|
||||
p, role:live-commerce, applications, get, dmnd-*/*, allow
|
||||
p, role:live-commerce, applications, override, dmnd-*/*, allow
|
||||
p, role:live-commerce, applications, sync, dmnd-*/*, allow
|
||||
p, role:live-commerce, applications, update, dmnd-*/*, allow
|
||||
p, role:live-commerce, logs, get, dmnd-*/*, allow
|
||||
p, role:live-commerce, exec, create, dmnd-*/*, allow
|
||||
p, role:live-commerce, projects, get, dmnd-*, allow
|
||||
p, role:live-commerce, projects, sync, dmnd-*, allow
|
||||
p, role:live-commerce, applications, action/apps/Deployment/restart, dmnd-*/*, allow
|
||||
p, role:live-commerce, repositories, update, dmnd-*/*, allow
|
||||
p, role:admins, *, *, */*, allow
|
||||
## Policy for BACKEND team
|
||||
p, role:backend, applications, create, dmnd-*/*, allow
|
||||
p, role:backend, applications, get, dmnd-*/*, allow
|
||||
p, role:backend, applications, override, dmnd-*/*, allow
|
||||
p, role:backend, applications, sync, dmnd-*/*, allow
|
||||
p, role:backend, applications, update, dmnd-*/*, allow
|
||||
p, role:backend, applications, delete, */*, deny
|
||||
p, role:backend, applications, delete/*/Pod/*/*, dmnd-*/*, allow
|
||||
p, role:backend, logs, get, dmnd-*/*, allow
|
||||
p, role:backend, exec, create, dmnd-*/*, allow
|
||||
p, role:backend, projects, get, dmnd-*, allow
|
||||
p, role:backend, projects, sync, dmnd-*, allow
|
||||
p, role:backend, applications, action/apps/Deployment/restart, dmnd-*/*, allow
|
||||
p, role:backend, repositories, update, dmnd-*/*, allow
|
||||
## Policy for Admin-NoDelete role
|
||||
p, role:admin-nodelete, *, get, *, allow
|
||||
p, role:admin-nodelete, *, create, *, allow
|
||||
p, role:admin-nodelete, *, update, *, allow
|
||||
p, role:admin-nodelete, applications, override, *, allow
|
||||
p, role:admin-nodelete, applications, sync, *, allow
|
||||
p, role:admin-nodelete, applications, action/*, *, allow
|
||||
p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow
|
||||
g, Meesho:devops-new, role:admin-nodelete
|
||||
## Teams and policy mapping
|
||||
g, Meesho:devops, role:admin
|
||||
g, Meesho:backend, role:backend
|
||||
g, Meesho:live-commerce, role:live-commerce
|
||||
g, ringmaster, role:backend
|
||||
@@ -1,270 +0,0 @@
|
||||
argo-cd:
|
||||
crds:
|
||||
install: false
|
||||
global:
|
||||
image:
|
||||
tag: "v3.4.3"
|
||||
additionalLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
podLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
nodeSelector:
|
||||
dedicated: devops
|
||||
tolerations:
|
||||
- key: "dedicated"
|
||||
operator: "Equal"
|
||||
value: "devops"
|
||||
effect: "NoSchedule"
|
||||
dex:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
metrics:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 5558
|
||||
controller:
|
||||
replicas: 3
|
||||
enableStatefulSet: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8082
|
||||
resources:
|
||||
limits:
|
||||
cpu: "7"
|
||||
memory: "12Gi"
|
||||
requests:
|
||||
cpu: "6"
|
||||
memory: "8Gi"
|
||||
env:
|
||||
- name: ARGOCD_K8S_CLIENT_QPS
|
||||
value: '250'
|
||||
- name: ARGOCD_CONTROLLER_REPLICAS
|
||||
value: '3'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
redis-ha:
|
||||
enabled: true
|
||||
repoServer:
|
||||
autoscaling:
|
||||
enabled: true
|
||||
maxReplicas: 25
|
||||
minReplicas: 7
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 60s
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8084
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 3Gi
|
||||
env:
|
||||
- name: ARGOCD_HELM_ALLOW_CONCURRENCY
|
||||
value: 'true'
|
||||
- name: ARGOCD_EXEC_TIMEOUT
|
||||
value: '600s'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
server:
|
||||
replicas: 3
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 3
|
||||
maxReplicas: 25
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false
|
||||
annotations.nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
annotations.nginx.ingress.kubernetes.io/ssl-redirect: false
|
||||
enabled: true
|
||||
hostname: "argocd-demand-prd.meeshogcp.in"
|
||||
ingressClassName: nginx-internal
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8083
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_GRPC_KEEP_ALIVE_MIN
|
||||
value: '30s'
|
||||
applicationSet:
|
||||
replicaCount: 2
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
configs:
|
||||
cm:
|
||||
resource.customizations: |
|
||||
projectcontour.io/HTTPProxy:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
if obj.status ~= nil and obj.status.currentStatus ~= nil then
|
||||
if obj.status.currentStatus == "orphaned" then
|
||||
hs.status = "Healthy"
|
||||
hs.message = "HTTPProxy orphaned — ignored"
|
||||
return hs
|
||||
end
|
||||
if obj.status.currentStatus == "valid" then
|
||||
hs.status = "Healthy"
|
||||
hs.message = "HTTPProxy is valid"
|
||||
return hs
|
||||
end
|
||||
if obj.status.currentStatus == "invalid" then
|
||||
hs.status = "Degraded"
|
||||
hs.message = obj.status.description or "HTTPProxy is invalid"
|
||||
return hs
|
||||
end
|
||||
end
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Waiting for HTTPProxy status"
|
||||
return hs
|
||||
|
||||
keda.sh/ScaledObject:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
local healthy = false
|
||||
local degraded = false
|
||||
local suspended = false
|
||||
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
for i, condition in ipairs(obj.status.conditions) do
|
||||
if condition.status == "False" and condition.type == "Ready" then
|
||||
degraded = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Ready" then
|
||||
healthy = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Paused" then
|
||||
suspended = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if degraded == true then
|
||||
hs.status = "Degraded"
|
||||
return hs
|
||||
elseif healthy == true then
|
||||
hs.status = "Healthy"
|
||||
if suspended == true then
|
||||
hs.message = "ScaledObject is paused as part of normal operations."
|
||||
else
|
||||
hs.message = "ScaledObject is active."
|
||||
end
|
||||
return hs
|
||||
end
|
||||
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Creating ScaledObject or waiting for conditions."
|
||||
return hs
|
||||
url: https://argocd-demand-prd.meeshogcp.in
|
||||
accounts.readonly: 'apiKey,login'
|
||||
accounts.ringmaster: 'apiKey,login'
|
||||
timeout.reconciliation: 5m
|
||||
timeout.reconciliation.jitter: 120s
|
||||
statusbadge.enabled: "true"
|
||||
help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV"
|
||||
help.chatText: "Chat now!"
|
||||
dex.config: |
|
||||
logger:
|
||||
level: error
|
||||
format: json
|
||||
connectors:
|
||||
- type: github
|
||||
id: github
|
||||
name: GitHub
|
||||
loadAllGroups: true
|
||||
admin.enabled: "true"
|
||||
config:
|
||||
clientID: Ov23liYgmJQahK7jRnMt
|
||||
clientSecret: $github-sso-secret:dex.github.clientSecret
|
||||
orgs:
|
||||
- name: Meesho
|
||||
params:
|
||||
controller.sharding.algorithm: round-robin
|
||||
controller.status.processors: '60'
|
||||
controller.operation.processors: '30'
|
||||
controller.repo.server.timeout.seconds: '90'
|
||||
reposerver.parallelism.limit: '2'
|
||||
rbac:
|
||||
policy.csv: |
|
||||
p, role:admins, *, *, */*, allow
|
||||
## Policy for BACKEND team
|
||||
p, role:backend, *, get, */*, allow
|
||||
## Policy for DEMAND team
|
||||
p, role:demand, *, get, */*, allow
|
||||
p, role:demand, applications, *, dmnd-pfeed/prd-flink*, allow
|
||||
## Policy for Admin-NoDelete role
|
||||
p, role:admin-nodelete, *, get, *, allow
|
||||
p, role:admin-nodelete, *, create, *, allow
|
||||
p, role:admin-nodelete, *, update, *, allow
|
||||
p, role:admin-nodelete, applications, create, */*, allow
|
||||
p, role:admin-nodelete, applications, get, */*, allow
|
||||
p, role:admin-nodelete, applications, override, */*, allow
|
||||
p, role:admin-nodelete, applications, sync, */*, allow
|
||||
p, role:admin-nodelete, applications, update, */*, allow
|
||||
p, role:admin-nodelete, applications, update/*, */*, allow
|
||||
p, role:admin-nodelete, applications, action/*, */*, allow
|
||||
p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow
|
||||
## Policy for devops intern role
|
||||
p, role:intern, *, get, *, allow
|
||||
## Role definition for different Github teams
|
||||
g, Meesho:architects, role:admin-nodelete
|
||||
g, Meesho:demand, role:demand
|
||||
g, Meesho:devops-new, role:admin-nodelete
|
||||
g, Meesho:devops-interns, role:intern
|
||||
g, Meesho:devops, role:admins
|
||||
g, Meesho:backend, role:backend
|
||||
g, ringmaster, role:admin-nodelete
|
||||
g, temp-mcp, role:backend
|
||||
g, readonly, role:backend
|
||||
@@ -1,236 +0,0 @@
|
||||
argo-cd:
|
||||
global:
|
||||
image:
|
||||
tag: "v2.13.8"
|
||||
additionalLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
podLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
nodeSelector:
|
||||
dedicated: devops
|
||||
tolerations:
|
||||
- key: "dedicated"
|
||||
operator: "Equal"
|
||||
value: "devops"
|
||||
effect: "NoSchedule"
|
||||
dex:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
metrics:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 5558
|
||||
controller:
|
||||
replicas: 3
|
||||
enableStatefulSet: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8082
|
||||
resources:
|
||||
limits:
|
||||
cpu: "7"
|
||||
memory: "12Gi"
|
||||
requests:
|
||||
cpu: "6"
|
||||
memory: "8Gi"
|
||||
env:
|
||||
- name: ARGOCD_K8S_CLIENT_QPS
|
||||
value: '200'
|
||||
- name: ARGOCD_CONTROLLER_REPLICAS
|
||||
value: '3'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
redis-ha:
|
||||
enabled: true
|
||||
repoServer:
|
||||
autoscaling:
|
||||
enabled: true
|
||||
maxReplicas: 25
|
||||
minReplicas: 7
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 60s
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8084
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 3Gi
|
||||
env:
|
||||
- name: ARGOCD_HELM_ALLOW_CONCURRENCY
|
||||
value: 'true'
|
||||
- name: GIT_DEPTH
|
||||
value: '1'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
server:
|
||||
replicas: 3
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 3
|
||||
maxReplicas: 25
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false
|
||||
annotations.nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
annotations.nginx.ingress.kubernetes.io/ssl-redirect: false
|
||||
enabled: true
|
||||
hostname: "argocd-demand-prd-old.meeshogcp.in"
|
||||
ingressClassName: nginx-internal
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8083
|
||||
resources:
|
||||
limits:
|
||||
cpu: "4"
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_GRPC_KEEP_ALIVE_MIN
|
||||
value: '30s'
|
||||
applicationSet:
|
||||
replicaCount: 2
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
configs:
|
||||
cm:
|
||||
resource.customizations: |
|
||||
keda.sh/ScaledObject:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
local healthy = false
|
||||
local degraded = false
|
||||
local suspended = false
|
||||
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
for i, condition in ipairs(obj.status.conditions) do
|
||||
if condition.status == "False" and condition.type == "Ready" then
|
||||
degraded = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Ready" then
|
||||
healthy = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Paused" then
|
||||
suspended = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if degraded == true then
|
||||
hs.status = "Degraded"
|
||||
return hs
|
||||
elseif healthy == true then
|
||||
hs.status = "Healthy"
|
||||
if suspended == true then
|
||||
hs.message = "ScaledObject is paused as part of normal operations."
|
||||
else
|
||||
hs.message = "ScaledObject is active."
|
||||
end
|
||||
return hs
|
||||
end
|
||||
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Creating ScaledObject or waiting for conditions."
|
||||
return hs
|
||||
url: https://argocd-demand-prd-old.meeshogcp.in
|
||||
accounts.readonly: 'apiKey,login'
|
||||
timeout.reconciliation: 5m
|
||||
timeout.reconciliation.jitter: 60s
|
||||
statusbadge.enabled: "true"
|
||||
help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV"
|
||||
help.chatText: "Chat now!"
|
||||
dex.config: |
|
||||
logger:
|
||||
level: error
|
||||
format: json
|
||||
connectors:
|
||||
- type: github
|
||||
id: github
|
||||
name: GitHub
|
||||
loadAllGroups: true
|
||||
admin.enabled: "true"
|
||||
config:
|
||||
clientID: f4f365409b0e82cf0874
|
||||
clientSecret: $github-sso-secret:dex.github.clientSecret
|
||||
orgs:
|
||||
- name: Meesho
|
||||
params:
|
||||
controller.sharding.algorithm: round-robin
|
||||
controller.status.processors: '60'
|
||||
controller.operation.processors: '30'
|
||||
controller.repo.server.timeout.seconds: '90'
|
||||
rbac:
|
||||
policy.csv: |
|
||||
p, role:admins, *, *, */*, allow
|
||||
## Policy for BACKEND team
|
||||
p, role:backend, *, get, */*, allow
|
||||
## Policy for Admin-NoDelete role
|
||||
p, role:admin-nodelete, *, get, *, allow
|
||||
p, role:admin-nodelete, *, create, *, allow
|
||||
p, role:admin-nodelete, *, update, *, allow
|
||||
p, role:admin-nodelete, applications, create, */*, allow
|
||||
p, role:admin-nodelete, applications, get, */*, allow
|
||||
p, role:admin-nodelete, applications, override, */*, allow
|
||||
p, role:admin-nodelete, applications, sync, */*, allow
|
||||
p, role:admin-nodelete, applications, update, */*, allow
|
||||
p, role:admin-nodelete, applications, action/*, */*, allow
|
||||
p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow
|
||||
## Policy for devops intern role
|
||||
p, role:intern, *, get, *, allow
|
||||
## Role definition for different Github teams
|
||||
g, Meesho:architects, role:admin-nodelete
|
||||
g, Meesho:devops-new, role:admin-nodelete
|
||||
g, Meesho:devops-interns, role:intern
|
||||
g, Meesho:devops, role:admins
|
||||
g, Meesho:backend, role:backend
|
||||
g, ringmaster, role:admin-nodelete
|
||||
g, readonly, role:backend
|
||||
@@ -1,274 +0,0 @@
|
||||
argo-cd:
|
||||
crds:
|
||||
install: false
|
||||
global:
|
||||
image:
|
||||
tag: "v3.4.3"
|
||||
additionalLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
podLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
nodeSelector:
|
||||
dedicated: devops
|
||||
tolerations:
|
||||
- key: "dedicated"
|
||||
operator: "Equal"
|
||||
value: "devops"
|
||||
effect: "NoSchedule"
|
||||
dex:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
metrics:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 5558
|
||||
controller:
|
||||
replicas: 3
|
||||
enableStatefulSet: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8082
|
||||
resources:
|
||||
limits:
|
||||
cpu: "7"
|
||||
memory: "12Gi"
|
||||
requests:
|
||||
cpu: "6"
|
||||
memory: "8Gi"
|
||||
env:
|
||||
- name: ARGOCD_CONTROLLER_REPLICAS
|
||||
value: '3'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
redis-ha:
|
||||
enabled: true
|
||||
repoServer:
|
||||
autoscaling:
|
||||
enabled: true
|
||||
maxReplicas: 25
|
||||
minReplicas: 3
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 60s
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8084
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_HELM_ALLOW_CONCURRENCY
|
||||
value: 'true'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
server:
|
||||
replicas: 3
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 3
|
||||
maxReplicas: 15
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false
|
||||
annotations.nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
annotations.nginx.ingress.kubernetes.io/ssl-redirect: false
|
||||
enabled: true
|
||||
hostname: "argocd-dsgpu-prd-ase1a.meeshogcp.in"
|
||||
ingressClassName: nginx-internal
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8083
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_GRPC_KEEP_ALIVE_MIN
|
||||
value: '30s'
|
||||
applicationSet:
|
||||
replicaCount: 2
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
configs:
|
||||
cm:
|
||||
resource.customizations: |
|
||||
projectcontour.io/HTTPProxy:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
if obj.status ~= nil and obj.status.currentStatus ~= nil then
|
||||
if obj.status.currentStatus == "orphaned" then
|
||||
hs.status = "Healthy"
|
||||
hs.message = "HTTPProxy orphaned — ignored"
|
||||
return hs
|
||||
end
|
||||
if obj.status.currentStatus == "valid" then
|
||||
hs.status = "Healthy"
|
||||
hs.message = "HTTPProxy is valid"
|
||||
return hs
|
||||
end
|
||||
if obj.status.currentStatus == "invalid" then
|
||||
hs.status = "Degraded"
|
||||
hs.message = obj.status.description or "HTTPProxy is invalid"
|
||||
return hs
|
||||
end
|
||||
end
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Waiting for HTTPProxy status"
|
||||
return hs
|
||||
|
||||
keda.sh/ScaledObject:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
local healthy = false
|
||||
local degraded = false
|
||||
local suspended = false
|
||||
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
for i, condition in ipairs(obj.status.conditions) do
|
||||
if condition.status == "False" and condition.type == "Ready" then
|
||||
degraded = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Ready" then
|
||||
healthy = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Paused" then
|
||||
suspended = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if degraded == true then
|
||||
hs.status = "Degraded"
|
||||
return hs
|
||||
elseif healthy == true then
|
||||
hs.status = "Healthy"
|
||||
if suspended == true then
|
||||
hs.message = "ScaledObject is paused as part of normal operations."
|
||||
else
|
||||
hs.message = "ScaledObject is active."
|
||||
end
|
||||
return hs
|
||||
end
|
||||
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Creating ScaledObject or waiting for conditions."
|
||||
return hs
|
||||
accounts.ringmaster: 'apiKey,login'
|
||||
accounts.readonly: 'apiKey,login'
|
||||
accounts.bharatml: 'apiKey,login'
|
||||
timeout.reconciliation: 5m
|
||||
timeout.reconciliation.jitter: 60s
|
||||
url: https://argocd-dsgpu-prd-ase1a.meeshogcp.in
|
||||
statusbadge.enabled: "true"
|
||||
help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV"
|
||||
help.chatText: "Chat now!"
|
||||
dex.config: |
|
||||
logger:
|
||||
level: error
|
||||
format: json
|
||||
connectors:
|
||||
- type: github
|
||||
id: github
|
||||
name: GitHub
|
||||
loadAllGroups: true
|
||||
admin.enabled: "true"
|
||||
config:
|
||||
clientID: Ov23liYxSaqWZ67OmPn5
|
||||
clientSecret: $github-sso-secret:dex.github.clientSecret
|
||||
orgs:
|
||||
- name: Meesho
|
||||
params:
|
||||
controller.sharding.algorithm: round-robin
|
||||
controller.status.processors: '50'
|
||||
controller.operation.processors: '25'
|
||||
controller.repo.server.timeout.seconds: '90'
|
||||
rbac:
|
||||
policy.csv: |
|
||||
p, role:admins, *, *, */*, allow
|
||||
p, role:admins, *, *, *, allow
|
||||
## Policy for data-science team
|
||||
p, role:datascience, *, get, */*, allow
|
||||
p, role:datascience, applications, delete, */*, deny
|
||||
p, role:datascience, applications, sync, dsgpu-*/*, allow
|
||||
p, role:datascience, applications, update, dsgpu-ml/prd-online-feature-store-api-mp*, allow
|
||||
p, role:datascience, applications, action/apps/Deployment/restart, dsgpu-*/prd-predator-*, allow
|
||||
p, role:datascience, applications, action/apps/Deployment/restart, dsgpu-*/prd-model-inference-*, allow
|
||||
p, role:backend, *, get, */*, allow
|
||||
## Policy for Admin-NoDelete role
|
||||
p, role:admin-nodelete, *, get, *, allow
|
||||
p, role:admin-nodelete, *, create, *, allow
|
||||
p, role:admin-nodelete, *, update, *, allow
|
||||
p, role:admin-nodelete, applications, create, */*, allow
|
||||
p, role:admin-nodelete, applications, get, */*, allow
|
||||
p, role:admin-nodelete, applications, override, */*, allow
|
||||
p, role:admin-nodelete, applications, sync, */*, allow
|
||||
p, role:admin-nodelete, applications, update, */*, allow
|
||||
p, role:admin-nodelete, applications, update/*, */*, allow
|
||||
p, role:admin-nodelete, applications, action/*, */*, allow
|
||||
p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow
|
||||
## Policy for devops intern role
|
||||
p, role:intern, *, get, *, allow
|
||||
## Policy for bharatml-team
|
||||
p, role:bharatml-role, applications, get, */*,allow
|
||||
p, role:bharatml-role, applications, sync, */*, allow
|
||||
p, role:bharatml-role, applications, action/apps/Deployment/restart,dsgpu-ml/prd-predator-*, allow
|
||||
p, role:bharatml-role, applications, action/apps/Deployment/restart,dsgpu-ml/prd-model-inference-*, allow
|
||||
## Role definition for different Github teams
|
||||
g, Meesho:architects, role:admin-nodelete
|
||||
g, Meesho:devops-new, role:admin-nodelete
|
||||
g, Meesho:devops-interns, role:intern
|
||||
g, Meesho:devops, role:admins
|
||||
g, Meesho:datascience, role:datascience
|
||||
g, Meesho:backend, role:backend
|
||||
g, Meesho:bharatmlstack, role:admins
|
||||
g, ringmaster, role:admin-nodelete
|
||||
g, bharatml, role:bharatml-role
|
||||
g, readonly, role:backend
|
||||
@@ -1,248 +0,0 @@
|
||||
argo-cd:
|
||||
global:
|
||||
image:
|
||||
tag: "v2.13.8"
|
||||
additionalLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
podLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
nodeSelector:
|
||||
dedicated: devops
|
||||
tolerations:
|
||||
- key: "dedicated"
|
||||
operator: "Equal"
|
||||
value: "devops"
|
||||
effect: "NoSchedule"
|
||||
dex:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
metrics:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 5558
|
||||
controller:
|
||||
replicas: 3
|
||||
enableStatefulSet: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8082
|
||||
resources:
|
||||
limits:
|
||||
cpu: "7"
|
||||
memory: "12Gi"
|
||||
requests:
|
||||
cpu: "6"
|
||||
memory: "8Gi"
|
||||
env:
|
||||
- name: ARGOCD_CONTROLLER_REPLICAS
|
||||
value: '3'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
redis-ha:
|
||||
enabled: true
|
||||
repoServer:
|
||||
autoscaling:
|
||||
enabled: true
|
||||
maxReplicas: 25
|
||||
minReplicas: 3
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 60s
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8084
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_HELM_ALLOW_CONCURRENCY
|
||||
value: 'true'
|
||||
- name: GIT_DEPTH
|
||||
value: '1'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
server:
|
||||
replicas: 3
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 3
|
||||
maxReplicas: 15
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false
|
||||
annotations.nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
annotations.nginx.ingress.kubernetes.io/ssl-redirect: false
|
||||
enabled: true
|
||||
hostname: "argocd-dsgpu-prd.meeshogcp.in"
|
||||
ingressClassName: nginx-internal
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8083
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_GRPC_KEEP_ALIVE_MIN
|
||||
value: '30s'
|
||||
applicationSet:
|
||||
replicaCount: 2
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
configs:
|
||||
cm:
|
||||
resource.customizations: |
|
||||
keda.sh/ScaledObject:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
local healthy = false
|
||||
local degraded = false
|
||||
local suspended = false
|
||||
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
for i, condition in ipairs(obj.status.conditions) do
|
||||
if condition.status == "False" and condition.type == "Ready" then
|
||||
degraded = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Ready" then
|
||||
healthy = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Paused" then
|
||||
suspended = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if degraded == true then
|
||||
hs.status = "Degraded"
|
||||
return hs
|
||||
elseif healthy == true then
|
||||
hs.status = "Healthy"
|
||||
if suspended == true then
|
||||
hs.message = "ScaledObject is paused as part of normal operations."
|
||||
else
|
||||
hs.message = "ScaledObject is active."
|
||||
end
|
||||
return hs
|
||||
end
|
||||
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Creating ScaledObject or waiting for conditions."
|
||||
return hs
|
||||
accounts.ringmaster: 'apiKey,login'
|
||||
accounts.readonly: 'apiKey,login'
|
||||
timeout.reconciliation: 4m
|
||||
timeout.reconciliation.jitter: 60s
|
||||
url: https://argocd-dsgpu-prd.meeshogcp.in
|
||||
statusbadge.enabled: "true"
|
||||
help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV"
|
||||
help.chatText: "Chat now!"
|
||||
dex.config: |
|
||||
logger:
|
||||
level: error
|
||||
format: json
|
||||
connectors:
|
||||
- type: github
|
||||
id: github
|
||||
name: GitHub
|
||||
loadAllGroups: true
|
||||
admin.enabled: "true"
|
||||
config:
|
||||
clientID: Ov23limmj4OwBgquaEZl
|
||||
clientSecret: $github-sso-secret:dex.github.clientSecret
|
||||
orgs:
|
||||
- name: Meesho
|
||||
params:
|
||||
controller.sharding.algorithm: round-robin
|
||||
controller.status.processors: '50'
|
||||
controller.operation.processors: '25'
|
||||
controller.repo.server.timeout.seconds: '90'
|
||||
rbac:
|
||||
policy.csv: |
|
||||
p, role:admins, *, *, */*, allow
|
||||
p, role:admins, *, *, *, allow
|
||||
## Policy for data-science team
|
||||
p, role:datascience, *, get, */*, allow
|
||||
p, role:datascience, applications, delete, */*, deny
|
||||
p, role:datascience, applications, sync, dsgpu-*/*, allow
|
||||
p, role:datascience, applications, update, dsgpu-ml/prd-online-feature-store-api-mp*, allow
|
||||
p, role:datascience, applications, action/apps/Deployment/restart, dsgpu-*/prd-predator-*, allow
|
||||
p, role:datascience, applications, action/apps/Deployment/restart, dsgpu-*/prd-model-inference-*, allow
|
||||
p, role:backend, *, get, */*, allow
|
||||
## Policy for Admin-NoDelete role
|
||||
p, role:admin-nodelete, *, get, *, allow
|
||||
p, role:admin-nodelete, *, create, *, allow
|
||||
p, role:admin-nodelete, *, update, *, allow
|
||||
p, role:admin-nodelete, applications, create, */*, allow
|
||||
p, role:admin-nodelete, applications, get, */*, allow
|
||||
p, role:admin-nodelete, applications, override, */*, allow
|
||||
p, role:admin-nodelete, applications, sync, */*, allow
|
||||
p, role:admin-nodelete, applications, update, */*, allow
|
||||
p, role:admin-nodelete, applications, action/*, */*, allow
|
||||
p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow
|
||||
## Policy for devops intern role
|
||||
p, role:intern, *, get, *, allow
|
||||
## Policy for bharatml-team
|
||||
p, role:bharatml-role, applications, get, */*,allow
|
||||
p, role:bharatml-role, applications, sync, */*, allow
|
||||
p, role:bharatml-role, applications, action/apps/Deployment/restart,dsgpu-ml/prd-predator-*, allow
|
||||
p, role:bharatml-role, applications, action/apps/Deployment/restart,dsgpu-ml/prd-model-inference-*, allow
|
||||
## Role definition for different Github teams
|
||||
g, Meesho:architects, role:admin-nodelete
|
||||
g, Meesho:devops-new, role:admin-nodelete
|
||||
g, Meesho:devops-interns, role:intern
|
||||
g, Meesho:devops, role:admins
|
||||
g, Meesho:datascience, role:datascience
|
||||
g, Meesho:backend, role:backend
|
||||
g, Meesho:bharatmlstack, role:admins
|
||||
g, ringmaster, role:admin-nodelete
|
||||
g, bharatml, role:bharatml-role
|
||||
g, readonly, role:backend
|
||||
@@ -1,259 +0,0 @@
|
||||
argo-cd:
|
||||
crds:
|
||||
install: false
|
||||
global:
|
||||
image:
|
||||
tag: "v3.4.3"
|
||||
additionalLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
podLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
nodeSelector:
|
||||
dedicated: devops
|
||||
tolerations:
|
||||
- key: "dedicated"
|
||||
operator: "Equal"
|
||||
value: "devops"
|
||||
effect: "NoSchedule"
|
||||
dex:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
metrics:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 5558
|
||||
controller:
|
||||
replicas: 2
|
||||
enableStatefulSet: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8082
|
||||
resources:
|
||||
limits:
|
||||
cpu: 4
|
||||
memory: 6Gi
|
||||
requests:
|
||||
cpu: 2
|
||||
memory: 4Gi
|
||||
env:
|
||||
- name: ARGOCD_CONTROLLER_REPLICAS
|
||||
value: '2'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
redis-ha:
|
||||
enabled: true
|
||||
repoServer:
|
||||
autoscaling:
|
||||
enabled: true
|
||||
maxReplicas: 20
|
||||
minReplicas: 2
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 60s
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8084
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_HELM_ALLOW_CONCURRENCY
|
||||
value: 'true'
|
||||
- name: GIT_DEPTH
|
||||
value: '1'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
server:
|
||||
replicas: 3
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 3
|
||||
maxReplicas: 10
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false
|
||||
annotations.nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
annotations.nginx.ingress.kubernetes.io/ssl-redirect: false
|
||||
enabled: true
|
||||
hostname: "argocd-farmiso-prd.meeshogcp.in"
|
||||
ingressClassName: nginx-internal
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8083
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_GRPC_KEEP_ALIVE_MIN
|
||||
value: '30s'
|
||||
applicationSet:
|
||||
replicas: 2
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
configs:
|
||||
cm:
|
||||
resource.customizations: |
|
||||
projectcontour.io/HTTPProxy:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
if obj.status ~= nil and obj.status.currentStatus ~= nil then
|
||||
if obj.status.currentStatus == "orphaned" then
|
||||
hs.status = "Healthy"
|
||||
hs.message = "HTTPProxy orphaned — ignored"
|
||||
return hs
|
||||
end
|
||||
if obj.status.currentStatus == "valid" then
|
||||
hs.status = "Healthy"
|
||||
hs.message = "HTTPProxy is valid"
|
||||
return hs
|
||||
end
|
||||
if obj.status.currentStatus == "invalid" then
|
||||
hs.status = "Degraded"
|
||||
hs.message = obj.status.description or "HTTPProxy is invalid"
|
||||
return hs
|
||||
end
|
||||
end
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Waiting for HTTPProxy status"
|
||||
return hs
|
||||
|
||||
keda.sh/ScaledObject:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
local healthy = false
|
||||
local degraded = false
|
||||
local suspended = false
|
||||
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
for i, condition in ipairs(obj.status.conditions) do
|
||||
if condition.status == "False" and condition.type == "Ready" then
|
||||
degraded = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Ready" then
|
||||
healthy = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Paused" then
|
||||
suspended = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if degraded == true then
|
||||
hs.status = "Degraded"
|
||||
return hs
|
||||
elseif healthy == true then
|
||||
hs.status = "Healthy"
|
||||
if suspended == true then
|
||||
hs.message = "ScaledObject is paused as part of normal operations."
|
||||
else
|
||||
hs.message = "ScaledObject is active."
|
||||
end
|
||||
return hs
|
||||
end
|
||||
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Creating ScaledObject or waiting for conditions."
|
||||
return hs
|
||||
url: https://argocd-farmiso-prd.meeshogcp.in
|
||||
accounts.readonly: 'apiKey,login'
|
||||
accounts.ringmaster: 'apiKey,login'
|
||||
timeout.reconciliation.jitter: 60s
|
||||
statusbadge.enabled: "true"
|
||||
help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV"
|
||||
help.chatText: "Chat now!"
|
||||
dex.config: |
|
||||
logger:
|
||||
level: error
|
||||
format: json
|
||||
connectors:
|
||||
- type: github
|
||||
id: github
|
||||
name: GitHub
|
||||
loadAllGroups: true
|
||||
admin.enabled: "true"
|
||||
config:
|
||||
clientID: Ov23liXnf0kYudQvP6dv
|
||||
clientSecret: $github-sso-secret:dex.github.clientSecret
|
||||
orgs:
|
||||
- name: Meesho
|
||||
params:
|
||||
controller.sharding.algorithm: round-robin
|
||||
controller.status.processors: '40'
|
||||
controller.operation.processors: '20'
|
||||
rbac:
|
||||
policy.csv: |
|
||||
p, role:admins, *, *, */*, allow
|
||||
## Policy for BACKEND team
|
||||
p, role:backend, *, get, */*, allow
|
||||
## Policy for Admin-NoDelete role
|
||||
p, role:admin-nodelete, *, get, *, allow
|
||||
p, role:admin-nodelete, *, create, *, allow
|
||||
p, role:admin-nodelete, *, update, *, allow
|
||||
p, role:admin-nodelete, applications, create, */*, allow
|
||||
p, role:admin-nodelete, applications, get, */*, allow
|
||||
p, role:admin-nodelete, applications, override, */*, allow
|
||||
p, role:admin-nodelete, applications, sync, */*, allow
|
||||
p, role:admin-nodelete, applications, update, */*, allow
|
||||
p, role:admin-nodelete, applications, update/*, */*, allow
|
||||
p, role:admin-nodelete, applications, action/*, */*, allow
|
||||
p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow
|
||||
## Policy for devops intern role
|
||||
p, role:intern, *, get, *, allow
|
||||
## Policy for superstore role
|
||||
p, role:superstore, *, get, */*, allow
|
||||
## Role definition for different Github teams
|
||||
g, Meesho:architects, role:admin-nodelete
|
||||
g, Meesho:devops-new, role:admin-nodelete
|
||||
g, Meesho:devops-interns, role:intern
|
||||
g, Meesho:devops, role:admins
|
||||
g, Meesho:superstore, role:superstore
|
||||
g, Meesho:backend, role:backend
|
||||
g, ringmaster, role:admin-nodelete
|
||||
g, readonly, role:backend
|
||||
@@ -1,236 +0,0 @@
|
||||
argo-cd:
|
||||
global:
|
||||
image:
|
||||
tag: "v2.13.8"
|
||||
additionalLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
podLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
nodeSelector:
|
||||
dedicated: devops
|
||||
tolerations:
|
||||
- key: "dedicated"
|
||||
operator: "Equal"
|
||||
value: "devops"
|
||||
effect: "NoSchedule"
|
||||
dex:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
metrics:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 5558
|
||||
controller:
|
||||
replicas: 2
|
||||
enableStatefulSet: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8082
|
||||
resources:
|
||||
limits:
|
||||
cpu: 4
|
||||
memory: 6Gi
|
||||
requests:
|
||||
cpu: 2
|
||||
memory: 4Gi
|
||||
env:
|
||||
- name: ARGOCD_CONTROLLER_REPLICAS
|
||||
value: '2'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
redis-ha:
|
||||
enabled: true
|
||||
repoServer:
|
||||
autoscaling:
|
||||
enabled: true
|
||||
maxReplicas: 20
|
||||
minReplicas: 2
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 60s
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8084
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_HELM_ALLOW_CONCURRENCY
|
||||
value: 'true'
|
||||
- name: GIT_DEPTH
|
||||
value: '1'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
server:
|
||||
replicas: 3
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 3
|
||||
maxReplicas: 10
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false
|
||||
annotations.nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
annotations.nginx.ingress.kubernetes.io/ssl-redirect: false
|
||||
enabled: true
|
||||
hostname: "argocd-farmiso-prd.meeshogcp.in"
|
||||
ingressClassName: nginx-internal
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8083
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_GRPC_KEEP_ALIVE_MIN
|
||||
value: '30s'
|
||||
applicationSet:
|
||||
replicaCount: 2
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
configs:
|
||||
# credentialTemplates:
|
||||
# https-creds:
|
||||
# url: https://github.com/Meesho/
|
||||
# password: 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
|
||||
# username: svc-devops-meesho
|
||||
cm:
|
||||
resource.customizations: |
|
||||
keda.sh/ScaledObject:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
local healthy = false
|
||||
local degraded = false
|
||||
local suspended = false
|
||||
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
for i, condition in ipairs(obj.status.conditions) do
|
||||
if condition.status == "False" and condition.type == "Ready" then
|
||||
degraded = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Ready" then
|
||||
healthy = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Paused" then
|
||||
suspended = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if degraded == true then
|
||||
hs.status = "Degraded"
|
||||
return hs
|
||||
elseif healthy == true then
|
||||
hs.status = "Healthy"
|
||||
if suspended == true then
|
||||
hs.message = "ScaledObject is paused as part of normal operations."
|
||||
else
|
||||
hs.message = "ScaledObject is active."
|
||||
end
|
||||
return hs
|
||||
end
|
||||
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Creating ScaledObject or waiting for conditions."
|
||||
return hs
|
||||
url: https://argocd-farmiso-prd.meeshogcp.in
|
||||
accounts.readonly: 'apiKey,login'
|
||||
timeout.reconciliation.jitter: 60s
|
||||
statusbadge.enabled: "true"
|
||||
help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV"
|
||||
help.chatText: "Chat now!"
|
||||
dex.config: |
|
||||
logger:
|
||||
level: error
|
||||
format: json
|
||||
connectors:
|
||||
- type: github
|
||||
id: github
|
||||
name: GitHub
|
||||
loadAllGroups: true
|
||||
admin.enabled: "true"
|
||||
config:
|
||||
clientID: ac06a559c8ea634683ca
|
||||
clientSecret: $github-sso-secret:dex.github.clientSecret
|
||||
orgs:
|
||||
- name: Meesho
|
||||
params:
|
||||
controller.sharding.algorithm: round-robin
|
||||
controller.status.processors: '40'
|
||||
controller.operation.processors: '20'
|
||||
rbac:
|
||||
policy.csv: |
|
||||
p, role:admins, *, *, */*, allow
|
||||
## Policy for BACKEND team
|
||||
p, role:backend, *, get, */*, allow
|
||||
## Policy for Admin-NoDelete role
|
||||
p, role:admin-nodelete, *, get, *, allow
|
||||
p, role:admin-nodelete, *, create, *, allow
|
||||
p, role:admin-nodelete, *, update, *, allow
|
||||
p, role:admin-nodelete, applications, create, */*, allow
|
||||
p, role:admin-nodelete, applications, get, */*, allow
|
||||
p, role:admin-nodelete, applications, override, */*, allow
|
||||
p, role:admin-nodelete, applications, sync, */*, allow
|
||||
p, role:admin-nodelete, applications, update, */*, allow
|
||||
p, role:admin-nodelete, applications, action/*, */*, allow
|
||||
p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow
|
||||
## Policy for devops intern role
|
||||
p, role:intern, *, get, *, allow
|
||||
## Policy for superstore role
|
||||
p, role:superstore, *, get, */*, allow
|
||||
## Role definition for different Github teams
|
||||
g, Meesho:architects, role:admin-nodelete
|
||||
g, Meesho:devops-new, role:admin-nodelete
|
||||
g, Meesho:devops-interns, role:intern
|
||||
g, Meesho:devops, role:admins
|
||||
g, Meesho:superstore, role:superstore
|
||||
g, Meesho:backend, role:backend
|
||||
g, ringmaster, role:admin-nodelete
|
||||
g, readonly, role:backend
|
||||
@@ -1,236 +0,0 @@
|
||||
argo-cd:
|
||||
global:
|
||||
image:
|
||||
tag: "v2.13.8"
|
||||
additionalLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
podLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
nodeSelector:
|
||||
dedicated: devops
|
||||
tolerations:
|
||||
- key: "dedicated"
|
||||
operator: "Equal"
|
||||
value: "devops"
|
||||
effect: "NoSchedule"
|
||||
dex:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
metrics:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 5558
|
||||
controller:
|
||||
replicas: 2
|
||||
enableStatefulSet: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8082
|
||||
resources:
|
||||
limits:
|
||||
cpu: "7"
|
||||
memory: "12Gi"
|
||||
requests:
|
||||
cpu: "6"
|
||||
memory: "8Gi"
|
||||
env:
|
||||
- name: ARGOCD_CONTROLLER_REPLICAS
|
||||
value: '2'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
redis-ha:
|
||||
enabled: true
|
||||
repoServer:
|
||||
autoscaling:
|
||||
enabled: true
|
||||
maxReplicas: 25
|
||||
minReplicas: 3
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 60s
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8084
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_HELM_ALLOW_CONCURRENCY
|
||||
value: 'true'
|
||||
- name: GIT_DEPTH
|
||||
value: '1'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
server:
|
||||
replicas: 3
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 3
|
||||
maxReplicas: 15
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false
|
||||
annotations.nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
annotations.nginx.ingress.kubernetes.io/ssl-redirect: false
|
||||
enabled: true
|
||||
hostname: "argocd-ml-platform-prd.meeshogcp.in"
|
||||
ingressClassName: nginx-internal
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8083
|
||||
resources:
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 2048Mi
|
||||
requests:
|
||||
cpu: 500m
|
||||
memory: 1024Mi
|
||||
env:
|
||||
- name: ARGOCD_GRPC_KEEP_ALIVE_MIN
|
||||
value: '30s'
|
||||
applicationSet:
|
||||
replicaCount: 2
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
configs:
|
||||
cm:
|
||||
resource.customizations: |
|
||||
keda.sh/ScaledObject:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
local healthy = false
|
||||
local degraded = false
|
||||
local suspended = false
|
||||
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
for i, condition in ipairs(obj.status.conditions) do
|
||||
if condition.status == "False" and condition.type == "Ready" then
|
||||
degraded = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Ready" then
|
||||
healthy = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Paused" then
|
||||
suspended = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if degraded == true then
|
||||
hs.status = "Degraded"
|
||||
return hs
|
||||
elseif healthy == true then
|
||||
hs.status = "Healthy"
|
||||
if suspended == true then
|
||||
hs.message = "ScaledObject is paused as part of normal operations."
|
||||
else
|
||||
hs.message = "ScaledObject is active."
|
||||
end
|
||||
return hs
|
||||
end
|
||||
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Creating ScaledObject or waiting for conditions."
|
||||
return hs
|
||||
accounts.ringmaster: 'apiKey,login'
|
||||
url: https://argocd-ml-platform-prd.meeshogcp.in
|
||||
timeout.reconciliation.jitter: 60s
|
||||
statusbadge.enabled: "true"
|
||||
help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV"
|
||||
help.chatText: "Chat now!"
|
||||
dex.config: |
|
||||
logger:
|
||||
level: error
|
||||
format: json
|
||||
connectors:
|
||||
- type: github
|
||||
id: github
|
||||
name: GitHub
|
||||
loadAllGroups: true
|
||||
admin.enabled: "true"
|
||||
config:
|
||||
clientID: Ov23litpytF7pcdkCNXV
|
||||
clientSecret: $github-sso-secret:dex.github.clientSecret
|
||||
orgs:
|
||||
- name: Meesho
|
||||
params:
|
||||
controller.sharding.algorithm: round-robin
|
||||
controller.status.processors: '40'
|
||||
controller.operation.processors: '20'
|
||||
rbac:
|
||||
policy.csv: |
|
||||
p, role:admins, *, *, */*, allow
|
||||
## Policy for ml-platform team
|
||||
p, role:backend, applications, create, */*, allow
|
||||
p, role:backend, applications, get, */*, allow
|
||||
p, role:backend, applications, override, */*, allow
|
||||
p, role:backend, applications, sync, */*, allow
|
||||
p, role:backend, applications, update, */*, allow
|
||||
p, role:backend, applications, delete, */*, deny
|
||||
p, role:backend, applications, delete/*/Pod/*/*, mlp-*/*, allow
|
||||
p, role:backend, applications, delete/*/Deployment/*/*, mlp-*/int-*, allow
|
||||
p, role:backend, applications, action/apps/Deployment/restart, */*, allow
|
||||
p, role:backend, applications, delete/*/Deployment/*/*, mlp-*/int-model-inference-*, allow
|
||||
p, role:backend, applications, delete/*/Deployment/*/*, mlp-*/prd-model-inference-*, allow
|
||||
p, role:backend, logs, get, */*, allow
|
||||
p, role:backend, exec, create, */*, allow
|
||||
p, role:backend, projects, get, *, allow
|
||||
p, role:backend, repositories, update, */*, allow
|
||||
## Policy for Admin-NoDelete role
|
||||
p, role:admin-nodelete, *, get, *, allow
|
||||
p, role:admin-nodelete, *, create, *, allow
|
||||
p, role:admin-nodelete, *, update, *, allow
|
||||
p, role:admin-nodelete, applications, override, *, allow
|
||||
p, role:admin-nodelete, applications, sync, *, allow
|
||||
p, role:admin-nodelete, applications, action/*, *, allow
|
||||
p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow
|
||||
g, Meesho:devops-new, role:admin-nodelete
|
||||
## Role definition for different Github teams
|
||||
g, Meesho:devops, role:admins
|
||||
g, Meesho:backend, role:backend
|
||||
g, ringmaster, role:backend
|
||||
@@ -1,299 +0,0 @@
|
||||
argo-cd:
|
||||
global:
|
||||
image:
|
||||
tag: "v2.13.8"
|
||||
additionalLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
podLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
nodeSelector:
|
||||
dedicated: devops
|
||||
tolerations:
|
||||
- key: "dedicated"
|
||||
operator: "Equal"
|
||||
value: "devops"
|
||||
effect: "NoSchedule"
|
||||
dex:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
metrics:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 5558
|
||||
controller:
|
||||
replicas: 4
|
||||
enableStatefulSet: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8082
|
||||
resources:
|
||||
limits:
|
||||
cpu: "7"
|
||||
memory: "12Gi"
|
||||
requests:
|
||||
cpu: "6"
|
||||
memory: "8Gi"
|
||||
env:
|
||||
- name: ARGOCD_CONTROLLER_REPLICAS
|
||||
value: '4'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
redis-ha:
|
||||
enabled: true
|
||||
redis:
|
||||
startupProbe:
|
||||
initialDelaySeconds: 300
|
||||
customConfig: |
|
||||
repl-backlog-size 50mb
|
||||
dir "/data"
|
||||
port 6379
|
||||
rename-command FLUSHDB ""
|
||||
rename-command FLUSHALL ""
|
||||
maxmemory 0
|
||||
maxmemory-policy volatile-lru
|
||||
min-replicas-max-lag 5
|
||||
min-replicas-to-write 1
|
||||
rdbchecksum yes
|
||||
rdbcompression yes
|
||||
repl-diskless-sync yes
|
||||
save ""
|
||||
requirepass replace-default-auth
|
||||
masterauth replace-default-auth
|
||||
# 1. Increase the timeout (Default is 60s, which is often too low for large RDBs)
|
||||
repl-timeout 300
|
||||
|
||||
# 2. Expand the replication buffer
|
||||
# Syntax: client-output-buffer-limit replica <hard-limit> <soft-limit> <soft-seconds>
|
||||
# This example gives it 512mb hard limit
|
||||
client-output-buffer-limit replica 2000mb 1000mb 300
|
||||
|
||||
# 3. Increase the backlog size in memory
|
||||
repoServer:
|
||||
autoscaling:
|
||||
enabled: true
|
||||
maxReplicas: 25
|
||||
minReplicas: 3
|
||||
targetMemoryUtilizationPercentage: 75
|
||||
targetCPUUtilizationPercentage: 60
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 60s
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8084
|
||||
resources:
|
||||
limits:
|
||||
cpu: "3"
|
||||
memory: 5Gi
|
||||
requests:
|
||||
cpu: "2"
|
||||
memory: 4Gi
|
||||
env:
|
||||
- name: ARGOCD_HELM_ALLOW_CONCURRENCY
|
||||
value: 'true'
|
||||
- name: GIT_DEPTH
|
||||
value: '1'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
server:
|
||||
replicas: 3
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 3
|
||||
maxReplicas: 25
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false
|
||||
annotations.nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
annotations.nginx.ingress.kubernetes.io/ssl-redirect: false
|
||||
enabled: true
|
||||
hostname: "argocd-shared-int.meeshogcp.in"
|
||||
ingressClassName: nginx-internal
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8083
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_GRPC_KEEP_ALIVE_MIN
|
||||
value: '30s'
|
||||
applicationSet:
|
||||
replicaCount: 2
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
configs:
|
||||
cm:
|
||||
resource.customizations: |
|
||||
keda.sh/ScaledObject:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
local healthy = false
|
||||
local degraded = false
|
||||
local suspended = false
|
||||
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
for i, condition in ipairs(obj.status.conditions) do
|
||||
if condition.status == "False" and condition.type == "Ready" then
|
||||
degraded = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Ready" then
|
||||
healthy = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Paused" then
|
||||
suspended = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if degraded == true then
|
||||
hs.status = "Degraded"
|
||||
return hs
|
||||
elseif healthy == true then
|
||||
hs.status = "Healthy"
|
||||
if suspended == true then
|
||||
hs.message = "ScaledObject is paused as part of normal operations."
|
||||
else
|
||||
hs.message = "ScaledObject is active."
|
||||
end
|
||||
return hs
|
||||
end
|
||||
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Creating ScaledObject or waiting for conditions."
|
||||
return hs
|
||||
url: https://argocd-shared-int.meeshogcp.in
|
||||
accounts.readonly: 'apiKey,login'
|
||||
timeout.reconciliation: 5m
|
||||
timeout.reconciliation.jitter: 60s
|
||||
statusbadge.enabled: "true"
|
||||
help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV"
|
||||
help.chatText: "Chat now!"
|
||||
dex.config: |
|
||||
logger:
|
||||
level: error
|
||||
format: json
|
||||
connectors:
|
||||
- type: github
|
||||
id: github
|
||||
name: GitHub
|
||||
loadAllGroups: true
|
||||
admin.enabled: "true"
|
||||
config:
|
||||
clientID: Ov23liJzfjWj4b5h6O7v
|
||||
clientSecret: $github-sso-secret:dex.github.clientSecret
|
||||
orgs:
|
||||
- name: Meesho
|
||||
params:
|
||||
controller.sharding.algorithm: round-robin
|
||||
controller.status.processors: '60'
|
||||
controller.operation.processors: '30'
|
||||
controller.repo.server.timeout.seconds: '90'
|
||||
rbac:
|
||||
policy.csv: |
|
||||
p, role:admins, *, *, */*, allow
|
||||
p, role:intern, *, get, *, allow
|
||||
p, role:backend-ro, *, get, */*, allow
|
||||
## Policy for BACKEND team
|
||||
p, role:backend, applications, create, */*, allow
|
||||
p, role:backend, applications, get, */*, allow
|
||||
p, role:backend, applications, override, */*, allow
|
||||
p, role:backend, applications, sync, */*, allow
|
||||
p, role:backend, applications, update, */*, allow
|
||||
p, role:backend, applications, delete, */*, deny
|
||||
p, role:backend, applications, delete/*/Pod/*/*, */*, allow
|
||||
p, role:backend, logs, get, */*, allow
|
||||
p, role:backend, exec, create, */*, allow
|
||||
p, role:backend, projects, get, *, allow
|
||||
p, role:backend, projects, sync, *, allow
|
||||
p, role:backend, applications, action/apps/Deployment/restart, */*, allow
|
||||
## Policy for data-engineering team
|
||||
p, role:data-engineering, applications, create, */*, allow
|
||||
p, role:data-engineering, applications, get, */*, allow
|
||||
p, role:data-engineering, applications, override, */*, allow
|
||||
p, role:data-engineering, applications, sync, */*, allow
|
||||
p, role:data-engineering, applications, update, */*, allow
|
||||
p, role:data-engineering, applications, delete, */*, deny
|
||||
p, role:data-engineering, applications, action/apps/Deployment/restart, */*, allow
|
||||
p, role:data-engineering, applications, delete, deng-dpcon/*, allow
|
||||
p, role:data-engineering, applications, delete/*/Pod/*/*, deng-*/*, allow
|
||||
p, role:data-engineering, logs, get, */*, allow
|
||||
p, role:data-engineering, exec, create, */*, allow
|
||||
p, role:data-engineering, projects, get, *, allow
|
||||
p, role:data-engineering, repositories, update, */*, allow
|
||||
## Policy for bharatml team
|
||||
p, role:bharatml-role, applications, get, dsci-*/int-predator-*, allow
|
||||
p, role:bharatml-role, applications, get, dsci-*/int-model-inference-*, allow
|
||||
p, role:bharatml-role, applications, action/apps/Deployment/restart, dsci-*/int-predator-*, allow
|
||||
p, role:bharatml-role, applications, action/apps/Deployment/restart, dsci-*/int-model-inference-*, allow
|
||||
p, role:bharatml-role, applications, delete/*/Pod/*/*, dsci-*/int-predator-*, allow
|
||||
p, role:bharatml-role, applications, delete/*/Pod/*/*, dsci-*/int-model-inference-*, allow
|
||||
p, role:bharatml-role, applications, update/keda.sh/ScaledObject/*/*, dsci-*/int-predator-*, allow
|
||||
p, role:bharatml-role, applications, update/keda.sh/ScaledObject/*/*, dsci-*/int-model-inference-*, allow
|
||||
p, role:bharatml-role, applications, sync, dsci-*/int-predator-*, allow
|
||||
p, role:bharatml-role, applications, sync, dsci-*/int-model-inference-*, allow
|
||||
p, role:bharatml-role, applications, sync, dsci-*/int-horizon*, allow
|
||||
|
||||
## Policy for Admin-NoDelete role
|
||||
p, role:admin-nodelete, *, get, *, allow
|
||||
p, role:admin-nodelete, *, create, *, allow
|
||||
p, role:admin-nodelete, *, update, *, allow
|
||||
p, role:admin-nodelete, applications, override, *, allow
|
||||
p, role:admin-nodelete, applications, sync, *, allow
|
||||
p, role:admin-nodelete, applications, action/*, *, allow
|
||||
p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow
|
||||
g, Meesho:devops-new, role:admin-nodelete
|
||||
## Teams and policy mapping
|
||||
g, Meesho:devops, role:admin
|
||||
g, Meesho:backend, role:backend
|
||||
g, Meesho:live-commerce, role:live-commerce
|
||||
g, Meesho:devops-interns, role:intern
|
||||
g, ringmaster, role:backend
|
||||
g, bharatml, role:bharatml-role
|
||||
g, Meesho:data-engineering, role:data-engineering
|
||||
g, readonly, role:backend-ro
|
||||
@@ -1,236 +0,0 @@
|
||||
argo-cd:
|
||||
createClusterRoles: false
|
||||
global:
|
||||
image:
|
||||
tag: "v2.13.8"
|
||||
additionalLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
podLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
nodeSelector:
|
||||
dedicated: devops
|
||||
tolerations:
|
||||
- key: "dedicated"
|
||||
operator: "Equal"
|
||||
value: "devops"
|
||||
effect: "NoSchedule"
|
||||
dex:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
metrics:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 5558
|
||||
controller:
|
||||
replicas: 2
|
||||
enableStatefulSet: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8082
|
||||
resources:
|
||||
limits:
|
||||
cpu: "6"
|
||||
memory: "12Gi"
|
||||
requests:
|
||||
cpu: "4"
|
||||
memory: "8Gi"
|
||||
env:
|
||||
- name: ARGOCD_CONTROLLER_REPLICAS
|
||||
value: '2'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
redis-ha:
|
||||
enabled: true
|
||||
repoServer:
|
||||
autoscaling:
|
||||
enabled: true
|
||||
maxReplicas: 3
|
||||
minReplicas: 2
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 60s
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8084
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_HELM_ALLOW_CONCURRENCY
|
||||
value: 'true'
|
||||
- name: GIT_DEPTH
|
||||
value: '1'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
server:
|
||||
replicas: 3
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 3
|
||||
maxReplicas: 20
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false
|
||||
annotations.nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
annotations.nginx.ingress.kubernetes.io/ssl-redirect: false
|
||||
enabled: true
|
||||
hostname: "argocd-supply-ase1c-prd.meeshogcp.in"
|
||||
ingressClassName: nginx-internal
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8083
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_GRPC_KEEP_ALIVE_MIN
|
||||
value: '30s'
|
||||
applicationSet:
|
||||
replicaCount: 2
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
configs:
|
||||
cm:
|
||||
resource.customizations: |
|
||||
keda.sh/ScaledObject:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
local healthy = false
|
||||
local degraded = false
|
||||
local suspended = false
|
||||
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
for i, condition in ipairs(obj.status.conditions) do
|
||||
if condition.status == "False" and condition.type == "Ready" then
|
||||
degraded = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Ready" then
|
||||
healthy = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Paused" then
|
||||
suspended = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if degraded == true then
|
||||
hs.status = "Degraded"
|
||||
return hs
|
||||
elseif healthy == true then
|
||||
hs.status = "Healthy"
|
||||
if suspended == true then
|
||||
hs.message = "ScaledObject is paused as part of normal operations."
|
||||
else
|
||||
hs.message = "ScaledObject is active."
|
||||
end
|
||||
return hs
|
||||
end
|
||||
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Creating ScaledObject or waiting for conditions."
|
||||
return hs
|
||||
url: https://argocd-supply-ase1c-prd.meeshogcp.in
|
||||
statusbadge.enabled: "true"
|
||||
timeout.reconciliation.jitter: 60s
|
||||
help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV"
|
||||
help.chatText: "Chat now!"
|
||||
dex.config: |
|
||||
logger:
|
||||
level: error
|
||||
format: json
|
||||
connectors:
|
||||
- type: github
|
||||
id: github
|
||||
name: GitHub
|
||||
loadAllGroups: true
|
||||
admin.enabled: "true"
|
||||
config:
|
||||
clientID: Ov23lihQK0dRN3aUfBaO
|
||||
clientSecret: $github-sso-secret:dex.github.clientSecret
|
||||
orgs:
|
||||
- name: Meesho
|
||||
params:
|
||||
controller.sharding.algorithm: round-robin
|
||||
controller.status.processors: '40'
|
||||
controller.operation.processors: '20'
|
||||
controller.repo.server.timeout.seconds: '60'
|
||||
rbac:
|
||||
policy.csv: |
|
||||
p, role:admins, *, *, */*, allow
|
||||
## Policy for Admin-NoDelete role
|
||||
p, role:admin-nodelete, *, get, *, allow
|
||||
p, role:admin-nodelete, *, create, *, allow
|
||||
p, role:admin-nodelete, *, update, *, allow
|
||||
p, role:admin-nodelete, applications, override, *, allow
|
||||
p, role:admin-nodelete, applications, sync, *, allow
|
||||
p, role:admin-nodelete, applications, action/*, *, allow
|
||||
p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow
|
||||
g, Meesho:devops-new, role:admin-nodelete
|
||||
p, role:backend, applications, create, supl-*/*, allow
|
||||
p, role:backend, applications, get, supl-*/*, allow
|
||||
p, role:backend, applications, override, supl-*/*, allow
|
||||
p, role:backend, applications, sync, supl-*/*, allow
|
||||
p, role:backend, applications, update, supl-*/*, allow
|
||||
p, role:backend, applications, delete, */*, deny
|
||||
p, role:backend, applications, delete/*/Pod/*/*, supl-*/*, allow
|
||||
p, role:backend, applications, action/apps/Deployment/restart, supl-*/*, allow
|
||||
p, role:backend, logs, get, supl-*/*, allow
|
||||
p, role:backend, exec, create, supl-*/*, allow
|
||||
p, role:backend, projects, get, supl-*, allow
|
||||
p, role:backend, projects, sync, supl-*, allow
|
||||
p, role:backend, repositories, update, supl-*/*, allow
|
||||
## Teams and policy mapping
|
||||
g, Meesho:devops, role:admin
|
||||
g, Meesho:backend, role:backend
|
||||
g, ringmaster, role:backend
|
||||
@@ -1,268 +0,0 @@
|
||||
argo-cd:
|
||||
crds:
|
||||
install: false
|
||||
global:
|
||||
image:
|
||||
tag: "v3.4.3"
|
||||
additionalLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
podLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
nodeSelector:
|
||||
dedicated: devops
|
||||
tolerations:
|
||||
- key: "dedicated"
|
||||
operator: "Equal"
|
||||
value: "devops"
|
||||
effect: "NoSchedule"
|
||||
dex:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
metrics:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 5558
|
||||
controller:
|
||||
replicas: 3
|
||||
enableStatefulSet: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8082
|
||||
resources:
|
||||
limits:
|
||||
cpu: "7"
|
||||
memory: "12Gi"
|
||||
requests:
|
||||
cpu: "6"
|
||||
memory: "8Gi"
|
||||
env:
|
||||
- name: ARGOCD_K8S_CLIENT_QPS
|
||||
value: '250'
|
||||
- name: ARGOCD_CONTROLLER_REPLICAS
|
||||
value: '3'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
redis-ha:
|
||||
enabled: true
|
||||
repoServer:
|
||||
autoscaling:
|
||||
enabled: true
|
||||
maxReplicas: 30
|
||||
minReplicas: 7
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 60s
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8084
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_HELM_ALLOW_CONCURRENCY
|
||||
value: 'true'
|
||||
- name: ARGOCD_EXEC_TIMEOUT
|
||||
value: '600s'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
server:
|
||||
replicas: 3
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 3
|
||||
maxReplicas: 25
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false
|
||||
annotations.nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
annotations.nginx.ingress.kubernetes.io/ssl-redirect: false
|
||||
enabled: true
|
||||
hostname: "argocd-supply-prd.meeshogcp.in"
|
||||
ingressClassName: nginx-internal
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8083
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_GRPC_KEEP_ALIVE_MIN
|
||||
value: '30s'
|
||||
applicationSet:
|
||||
replicaCount: 4
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
configs:
|
||||
cm:
|
||||
resource.customizations: |
|
||||
projectcontour.io/HTTPProxy:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
if obj.status ~= nil and obj.status.currentStatus ~= nil then
|
||||
if obj.status.currentStatus == "orphaned" then
|
||||
hs.status = "Healthy"
|
||||
hs.message = "HTTPProxy orphaned — ignored"
|
||||
return hs
|
||||
end
|
||||
if obj.status.currentStatus == "valid" then
|
||||
hs.status = "Healthy"
|
||||
hs.message = "HTTPProxy is valid"
|
||||
return hs
|
||||
end
|
||||
if obj.status.currentStatus == "invalid" then
|
||||
hs.status = "Degraded"
|
||||
hs.message = obj.status.description or "HTTPProxy is invalid"
|
||||
return hs
|
||||
end
|
||||
end
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Waiting for HTTPProxy status"
|
||||
return hs
|
||||
|
||||
keda.sh/ScaledObject:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
local healthy = false
|
||||
local degraded = false
|
||||
local suspended = false
|
||||
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
for i, condition in ipairs(obj.status.conditions) do
|
||||
if condition.status == "False" and condition.type == "Ready" then
|
||||
degraded = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Ready" then
|
||||
healthy = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Paused" then
|
||||
suspended = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if degraded == true then
|
||||
hs.status = "Degraded"
|
||||
return hs
|
||||
elseif healthy == true then
|
||||
hs.status = "Healthy"
|
||||
if suspended == true then
|
||||
hs.message = "ScaledObject is paused as part of normal operations."
|
||||
else
|
||||
hs.message = "ScaledObject is active."
|
||||
end
|
||||
return hs
|
||||
end
|
||||
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Creating ScaledObject or waiting for conditions."
|
||||
return hs
|
||||
url: https://argocd-supply-prd.meeshogcp.in
|
||||
accounts.readonly: 'apiKey,login'
|
||||
accounts.ringmaster: 'apiKey,login'
|
||||
timeout.reconciliation: 5m
|
||||
timeout.reconciliation.jitter: 120s
|
||||
statusbadge.enabled: "true"
|
||||
help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV"
|
||||
help.chatText: "Chat now!"
|
||||
dex.config: |
|
||||
logger:
|
||||
level: error
|
||||
format: json
|
||||
connectors:
|
||||
- type: github
|
||||
id: github
|
||||
name: GitHub
|
||||
loadAllGroups: true
|
||||
admin.enabled: "true"
|
||||
config:
|
||||
clientID: Ov23liqt5cdcBtj3Hys7
|
||||
clientSecret: $github-sso-secret:dex.github.clientSecret
|
||||
orgs:
|
||||
- name: Meesho
|
||||
params:
|
||||
controller.sharding.algorithm: round-robin
|
||||
controller.status.processors: '60'
|
||||
controller.operation.processors: '30'
|
||||
controller.repo.server.timeout.seconds: '90'
|
||||
reposerver.parallelism.limit: '2'
|
||||
rbac:
|
||||
policy.csv: |
|
||||
p, role:admins, *, *, */*, allow
|
||||
## Policy for data-engineering team (specific app)
|
||||
p, role:data-engineering, applications, *, */prd-trino-atomberg, allow
|
||||
## Policy for Admin-NoDelete role
|
||||
p, role:admin-nodelete, *, get, *, allow
|
||||
p, role:admin-nodelete, *, create, *, allow
|
||||
p, role:admin-nodelete, *, update, *, allow
|
||||
p, role:admin-nodelete, applications, create, */*, allow
|
||||
p, role:admin-nodelete, applications, get, */*, allow
|
||||
p, role:admin-nodelete, applications, override, */*, allow
|
||||
p, role:admin-nodelete, applications, sync, */*, allow
|
||||
p, role:admin-nodelete, applications, update, */*, allow
|
||||
p, role:admin-nodelete, applications, update/*, */*, allow
|
||||
p, role:admin-nodelete, applications, action/*, */*, allow
|
||||
p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow
|
||||
## Policy for devops intern role
|
||||
p, role:intern, *, get, *, allow
|
||||
## Policy for backend role
|
||||
p, role:backend, *, get, */*, allow
|
||||
## Teams and policy mapping
|
||||
g, Meesho:architects, role:admin-nodelete
|
||||
g, Meesho:devops-new, role:admin-nodelete
|
||||
g, Meesho:devops-interns, role:intern
|
||||
g, Meesho:devops, role:admins
|
||||
g, Meesho:backend, role:backend
|
||||
g, ringmaster, role:admin-nodelete
|
||||
g, readonly, role:backend
|
||||
g, Meesho:data-engineering, role:data-engineering
|
||||
@@ -1,236 +0,0 @@
|
||||
argo-cd:
|
||||
global:
|
||||
image:
|
||||
tag: "v2.13.8"
|
||||
additionalLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
podLabels:
|
||||
bu: infra
|
||||
team: devops
|
||||
nodeSelector:
|
||||
dedicated: devops
|
||||
tolerations:
|
||||
- key: "dedicated"
|
||||
operator: "Equal"
|
||||
value: "devops"
|
||||
effect: "NoSchedule"
|
||||
dex:
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
metrics:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 5558
|
||||
controller:
|
||||
replicas: 3
|
||||
enableStatefulSet: true
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8082
|
||||
resources:
|
||||
limits:
|
||||
cpu: "7"
|
||||
memory: "12Gi"
|
||||
requests:
|
||||
cpu: "6"
|
||||
memory: "8Gi"
|
||||
env:
|
||||
- name: ARGOCD_K8S_CLIENT_QPS
|
||||
value: '250'
|
||||
- name: ARGOCD_CONTROLLER_REPLICAS
|
||||
value: '3'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
redis-ha:
|
||||
enabled: true
|
||||
repoServer:
|
||||
autoscaling:
|
||||
enabled: true
|
||||
maxReplicas: 30
|
||||
minReplicas: 7
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 60s
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8084
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 3Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_HELM_ALLOW_CONCURRENCY
|
||||
value: 'true'
|
||||
- name: GIT_DEPTH
|
||||
value: '1'
|
||||
- name: ARGOCD_RECONCILIATION_JITTER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: timeout.reconciliation.jitter
|
||||
name: argocd-cm
|
||||
optional: true
|
||||
server:
|
||||
replicas: 3
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 3
|
||||
maxReplicas: 25
|
||||
targetMemoryUtilizationPercentage: 60
|
||||
targetCPUUtilizationPercentage: 60
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false
|
||||
annotations.nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
annotations.nginx.ingress.kubernetes.io/ssl-redirect: false
|
||||
enabled: true
|
||||
hostname: "argocd-supply-prd-old.meeshogcp.in"
|
||||
ingressClassName: nginx-internal
|
||||
podAnnotations:
|
||||
prometheus.io/scrape: true
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: 8083
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
env:
|
||||
- name: ARGOCD_GRPC_KEEP_ALIVE_MIN
|
||||
value: '30s'
|
||||
applicationSet:
|
||||
replicaCount: 4
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
configs:
|
||||
cm:
|
||||
resource.customizations: |
|
||||
keda.sh/ScaledObject:
|
||||
health.lua: |
|
||||
local hs = {}
|
||||
local healthy = false
|
||||
local degraded = false
|
||||
local suspended = false
|
||||
|
||||
if obj.status ~= nil then
|
||||
if obj.status.conditions ~= nil then
|
||||
for i, condition in ipairs(obj.status.conditions) do
|
||||
if condition.status == "False" and condition.type == "Ready" then
|
||||
degraded = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Ready" then
|
||||
healthy = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
if condition.status == "True" and condition.type == "Paused" then
|
||||
suspended = true
|
||||
hs.message = condition.message
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if degraded == true then
|
||||
hs.status = "Degraded"
|
||||
return hs
|
||||
elseif healthy == true then
|
||||
hs.status = "Healthy"
|
||||
if suspended == true then
|
||||
hs.message = "ScaledObject is paused as part of normal operations."
|
||||
else
|
||||
hs.message = "ScaledObject is active."
|
||||
end
|
||||
return hs
|
||||
end
|
||||
|
||||
hs.status = "Progressing"
|
||||
hs.message = "Creating ScaledObject or waiting for conditions."
|
||||
return hs
|
||||
url: https://argocd-supply-prd-old.meeshogcp.in
|
||||
accounts.readonly: 'apiKey,login'
|
||||
timeout.reconciliation: 5m
|
||||
timeout.reconciliation.jitter: 60s
|
||||
statusbadge.enabled: "true"
|
||||
help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV"
|
||||
help.chatText: "Chat now!"
|
||||
dex.config: |
|
||||
logger:
|
||||
level: error
|
||||
format: json
|
||||
connectors:
|
||||
- type: github
|
||||
id: github
|
||||
name: GitHub
|
||||
loadAllGroups: true
|
||||
admin.enabled: "true"
|
||||
config:
|
||||
clientID: d8f840837f2eecfd7bc8
|
||||
clientSecret: $github-sso-secret:dex.github.clientSecret
|
||||
orgs:
|
||||
- name: Meesho
|
||||
params:
|
||||
controller.sharding.algorithm: round-robin
|
||||
controller.status.processors: '60'
|
||||
controller.operation.processors: '30'
|
||||
controller.repo.server.timeout.seconds: '90'
|
||||
rbac:
|
||||
policy.csv: |
|
||||
p, role:admins, *, *, */*, allow
|
||||
## Policy for Admin-NoDelete role
|
||||
p, role:admin-nodelete, *, get, *, allow
|
||||
p, role:admin-nodelete, *, create, *, allow
|
||||
p, role:admin-nodelete, *, update, *, allow
|
||||
p, role:admin-nodelete, applications, create, */*, allow
|
||||
p, role:admin-nodelete, applications, get, */*, allow
|
||||
p, role:admin-nodelete, applications, override, */*, allow
|
||||
p, role:admin-nodelete, applications, sync, */*, allow
|
||||
p, role:admin-nodelete, applications, update, */*, allow
|
||||
p, role:admin-nodelete, applications, action/*, */*, allow
|
||||
p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow
|
||||
## Policy for devops intern role
|
||||
p, role:intern, *, get, *, allow
|
||||
## Policy for backend role
|
||||
p, role:backend, *, get, */*, allow
|
||||
## Teams and policy mapping
|
||||
g, Meesho:architects, role:admin-nodelete
|
||||
g, Meesho:devops-new, role:admin-nodelete
|
||||
g, Meesho:devops-interns, role:intern
|
||||
g, Meesho:devops, role:admins
|
||||
g, Meesho:backend, role:backend
|
||||
g, ringmaster, role:admin-nodelete
|
||||
g, readonly, role:backend
|
||||
@@ -0,0 +1,44 @@
|
||||
contour:
|
||||
# This is your live `helm get values contour -n projectcontour` output,
|
||||
# verbatim. This is the ingress for everything else in this repo
|
||||
# (Gitea, ArgoCD, Vault all route through it) — don't tune this without
|
||||
# re-checking those still resolve afterward.
|
||||
#
|
||||
# hostPorts, not a Service type=LoadBalancer: claude.md issue #6 — MetalLB
|
||||
# got a floating IP fine, but this VM's host (VMware Workstation, Bridged
|
||||
# networking, over Wi-Fi) doesn't do true MAC-level bridging, so the IP
|
||||
# was never reachable from outside the VM. hostPort on Envoy binds
|
||||
# directly to the node's real NIC instead — confirmed working by the live
|
||||
# DaemonSet's actual container ports (checked before writing this file,
|
||||
# not assumed): envoy container has hostPort 80/443 exactly matching
|
||||
# envoy.hostPorts below, so this really is Helm-values-driven, not a
|
||||
# hidden out-of-band kubectl patch.
|
||||
#
|
||||
# This is also why ArgoCD's default Ingress health check needed
|
||||
# overriding (see argocd-admin-prd/custom-values.yaml) — there's no
|
||||
# Service type=LoadBalancer here to ever populate
|
||||
# status.loadBalancer.ingress.
|
||||
|
||||
contour:
|
||||
resources:
|
||||
limits:
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
|
||||
envoy:
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
hostNetworking: true
|
||||
hostPorts:
|
||||
enabled: true
|
||||
http: 80
|
||||
https: 443
|
||||
resources:
|
||||
limits:
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
service:
|
||||
type: ClusterIP
|
||||
@@ -1,154 +1,49 @@
|
||||
vault:
|
||||
# This is your live `helm get values vault -n vault` output, verbatim —
|
||||
# not a rewrite. Production mode (file storage, not dev), standalone
|
||||
# (no HA/raft). Init/unseal are still NEVER in Git or scripted: run by
|
||||
# hand and keep the unseal keys / root token in a password manager, same
|
||||
# as claude.md says. This adoption only manages Vault's own Deployment
|
||||
# config, not its data or seal state.
|
||||
#
|
||||
# `ui = true` in the HCL block AND top-level ui.enabled: true are BOTH
|
||||
# required — this is claude.md issue #10 (Vault UI 404'd until both were
|
||||
# set; the chart has two separate toggles for the same thing).
|
||||
injector:
|
||||
enabled: false
|
||||
enabled: true
|
||||
resources:
|
||||
limits:
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
|
||||
server:
|
||||
enabled: "-"
|
||||
|
||||
# Ingress allows ingress services to be created to allow external access
|
||||
# from Kubernetes to access Vault pods.
|
||||
# If deployment is on OpenShift, the following block is ignored.
|
||||
# In order to expose the service, use the route section below
|
||||
ingress:
|
||||
dataStorage:
|
||||
enabled: true
|
||||
ingressClassName: nginx-internal
|
||||
hosts:
|
||||
- host: vault-prd.meeshogcp.in
|
||||
|
||||
tolerations:
|
||||
- effect: NoSchedule
|
||||
key: dedicated
|
||||
operator: Equal
|
||||
value: devops
|
||||
|
||||
nodeSelector:
|
||||
dedicated: devops
|
||||
|
||||
# OpenShift only - create a route to expose the service
|
||||
# By default the created route will be of type passthrough
|
||||
route:
|
||||
enabled: false
|
||||
|
||||
# Priority class for server pods
|
||||
priorityClassName: ""
|
||||
|
||||
# Extra labels to attach to the server pods
|
||||
# This should be a YAML map of the labels to apply to the server pods
|
||||
extraLabels: {}
|
||||
|
||||
# Extra annotations to attach to the server pods
|
||||
# This can either be YAML or a YAML-formatted multi-line templated string map
|
||||
# of the annotations to apply to the server pods
|
||||
annotations: {}
|
||||
|
||||
# Enables a headless service to be used by the Vault Statefulset
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
# This configures the Vault Statefulset to create a PVC for data
|
||||
# storage when using the file or raft backend storage engines.
|
||||
# See https://www.vaultproject.io/docs/configuration/storage/index.html to know more
|
||||
|
||||
# Run Vault in "dev" mode. This requires no further setup, no state management,
|
||||
# and no initialization. This is useful for experimenting with Vault without
|
||||
# needing to unseal, store keys, et. al. All data is lost on restart - do not
|
||||
# use dev mode for anything other than experimenting.
|
||||
# See https://www.vaultproject.io/docs/concepts/dev-server.html to know more
|
||||
dev:
|
||||
enabled: false
|
||||
|
||||
# Set VAULT_DEV_ROOT_TOKEN_ID value
|
||||
devRootToken: "root"
|
||||
|
||||
# Run Vault in "HA" mode. There are no storage requirements unless audit log
|
||||
# persistence is required. In HA mode Vault will configure itself to use Consul
|
||||
# for its storage backend. The default configuration provided will work the Consul
|
||||
# Helm project by default. It is possible to manually configure Vault to use a
|
||||
# different HA backend.
|
||||
standalone:
|
||||
enabled: false
|
||||
# Must stay 5Gi to match the already-bound PVC — local-path-provisioner
|
||||
# doesn't support volume expansion, same constraint as Gitea's PVC.
|
||||
size: 5Gi
|
||||
ha:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
memory: 256Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
standalone:
|
||||
enabled: true
|
||||
replicas: 3
|
||||
|
||||
# Set the api_addr configuration for Vault HA
|
||||
# See https://www.vaultproject.io/docs/configuration#api_addr
|
||||
# If set to null, this will be set to the Pod IP Address
|
||||
apiAddr: null
|
||||
|
||||
# Set the cluster_addr confuguration for Vault HA
|
||||
# See https://www.vaultproject.io/docs/configuration#cluster_addr
|
||||
# If set to null, this will be set to https://$(HOSTNAME).{{ template "vault.fullname" . }}-internal:8201
|
||||
clusterAddr: null
|
||||
|
||||
# Enables Vault's integrated Raft storage. Unlike the typical HA modes where
|
||||
# Vault's persistence is external (such as Consul), enabling Raft mode will create
|
||||
# persistent volumes for Vault to store data according to the configuration under server.dataStorage.
|
||||
# The Vault cluster will coordinate leader elections and failovers internally.
|
||||
|
||||
# config is a raw string of default configuration when using a Stateful
|
||||
# deployment. Default is to use a Consul for its HA storage backend.
|
||||
# This should be HCL.
|
||||
|
||||
# Note: Configuration files are stored in ConfigMaps so sensitive data
|
||||
# such as passwords should be either mounted through extraSecretEnvironmentVars
|
||||
# or through a Kube secret. For more information see:
|
||||
# https://www.vaultproject.io/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations
|
||||
config: |
|
||||
ui = true
|
||||
|
||||
listener "tcp" {
|
||||
tls_disable = 1
|
||||
address = "[::]:8200"
|
||||
cluster_address = "[::]:8201"
|
||||
tls_disable = "true" # lab only - enable TLS for anything beyond local testing
|
||||
}
|
||||
storage "gcs" {
|
||||
bucket = "gcs-meesho-prd-admin-vault-backend"
|
||||
ha_enabled = "true"
|
||||
storage "file" {
|
||||
path = "/vault/data"
|
||||
}
|
||||
|
||||
service_registration "kubernetes" {}
|
||||
|
||||
seal "gcpckms" {
|
||||
project = "meesho-admin-prd-0622"
|
||||
region = "asia-southeast1"
|
||||
key_ring = "keyring-meesho-prd-admin-vault"
|
||||
crypto_key = "key-meesho-prd-admin-vault"
|
||||
}
|
||||
|
||||
# A disruption budget limits the number of pods of a replicated application
|
||||
# that are down simultaneously from voluntary disruptions
|
||||
disruptionBudget:
|
||||
enabled: true
|
||||
|
||||
# maxUnavailable will default to (n/2)-1 where n is the number of
|
||||
# replicas. If you'd like a custom value, you can specify an override here.
|
||||
maxUnavailable: null
|
||||
|
||||
# Definition of the serviceAccount used to run Vault.
|
||||
# These options are also used when using an external Vault server to validate
|
||||
# Kubernetes tokens.
|
||||
serviceAccount:
|
||||
# Specifies whether a service account should be created
|
||||
create: true
|
||||
# The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name: ""
|
||||
# Extra annotations for the serviceAccount definition. This can either be
|
||||
# YAML or a YAML-formatted multi-line templated string map of the
|
||||
# annotations to apply to the serviceAccount.
|
||||
annotations:
|
||||
"iam.gke.io/gcp-service-account": "sa-prd-admin-vault@meesho-admin-prd-0622.iam.gserviceaccount.com"
|
||||
|
||||
# Settings for the statefulSet used to run Vault.
|
||||
statefulSet:
|
||||
# Extra annotations for the statefulSet. This can either be YAML or a
|
||||
# YAML-formatted multi-line templated string map of the annotations to apply
|
||||
# to the statefulSet.
|
||||
annotations: {}
|
||||
|
||||
# Vault UI
|
||||
ui:
|
||||
enabled: true
|
||||
publishNotReadyAddresses: true
|
||||
annotations: {}
|
||||
Reference in New Issue
Block a user