251 lines
7.9 KiB
YAML
251 lines
7.9 KiB
YAML
argo-cd:
|
|
createClusterRoles: false
|
|
global:
|
|
image:
|
|
tag: "v2.13.8"
|
|
additionalLabels:
|
|
bu: infra
|
|
team: devops
|
|
podLabels:
|
|
bu: infra
|
|
team: devops
|
|
nodeSelector:
|
|
dedicated: devops
|
|
tolerations:
|
|
- key: "dedicated"
|
|
operator: "Equal"
|
|
value: "devops"
|
|
effect: "NoSchedule"
|
|
dex:
|
|
enabled: true
|
|
resources:
|
|
limits:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
metrics:
|
|
enabled: true
|
|
podAnnotations:
|
|
prometheus.io/scrape: true
|
|
prometheus.io/path: /metrics
|
|
prometheus.io/port: 5558
|
|
controller:
|
|
replicas: 2
|
|
enableStatefulSet: true
|
|
podAnnotations:
|
|
prometheus.io/scrape: true
|
|
prometheus.io/path: /metrics
|
|
prometheus.io/port: 8082
|
|
resources:
|
|
limits:
|
|
cpu: "6"
|
|
memory: "12Gi"
|
|
requests:
|
|
cpu: "4"
|
|
memory: "8Gi"
|
|
env:
|
|
- name: ARGOCD_CONTROLLER_REPLICAS
|
|
value: '2'
|
|
- name: ARGOCD_RECONCILIATION_JITTER
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: timeout.reconciliation.jitter
|
|
name: argocd-cm
|
|
optional: true
|
|
redis-ha:
|
|
enabled: true
|
|
repoServer:
|
|
autoscaling:
|
|
enabled: true
|
|
maxReplicas: 3
|
|
minReplicas: 2
|
|
targetMemoryUtilizationPercentage: 60
|
|
targetCPUUtilizationPercentage: 60
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: false
|
|
interval: 60s
|
|
podAnnotations:
|
|
prometheus.io/scrape: true
|
|
prometheus.io/path: /metrics
|
|
prometheus.io/port: 8084
|
|
resources:
|
|
limits:
|
|
cpu: 1500m
|
|
memory: 3Gi
|
|
requests:
|
|
cpu: "1"
|
|
memory: 2Gi
|
|
env:
|
|
- name: ARGOCD_HELM_ALLOW_CONCURRENCY
|
|
value: 'true'
|
|
- name: GIT_DEPTH
|
|
value: '1'
|
|
- name: ARGOCD_RECONCILIATION_JITTER
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: timeout.reconciliation.jitter
|
|
name: argocd-cm
|
|
optional: true
|
|
server:
|
|
replicas: 3
|
|
autoscaling:
|
|
enabled: true
|
|
minReplicas: 3
|
|
maxReplicas: 20
|
|
targetMemoryUtilizationPercentage: 60
|
|
targetCPUUtilizationPercentage: 60
|
|
extraArgs:
|
|
- --insecure
|
|
ingress:
|
|
annotations.nginx.ingress.kubernetes.io/force-ssl-redirect: false
|
|
annotations.nginx.ingress.kubernetes.io/rewrite-target: /
|
|
annotations.nginx.ingress.kubernetes.io/ssl-redirect: false
|
|
enabled: true
|
|
hostname: "argocd-demand-ase1c-prd.meeshogcp.in"
|
|
ingressClassName: nginx-internal
|
|
podAnnotations:
|
|
prometheus.io/scrape: true
|
|
prometheus.io/path: /metrics
|
|
prometheus.io/port: 8083
|
|
resources:
|
|
limits:
|
|
cpu: "2"
|
|
memory: 4Gi
|
|
requests:
|
|
cpu: "1"
|
|
memory: 2Gi
|
|
env:
|
|
- name: ARGOCD_GRPC_KEEP_ALIVE_MIN
|
|
value: '30s'
|
|
applicationSet:
|
|
replicaCount: 2
|
|
notifications:
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: false
|
|
resources:
|
|
limits:
|
|
cpu: 500m
|
|
memory: 1Gi
|
|
requests:
|
|
cpu: 300m
|
|
memory: 512Mi
|
|
configs:
|
|
cm:
|
|
resource.customizations: |
|
|
keda.sh/ScaledObject:
|
|
health.lua: |
|
|
local hs = {}
|
|
local healthy = false
|
|
local degraded = false
|
|
local suspended = false
|
|
|
|
if obj.status ~= nil then
|
|
if obj.status.conditions ~= nil then
|
|
for i, condition in ipairs(obj.status.conditions) do
|
|
if condition.status == "False" and condition.type == "Ready" then
|
|
degraded = true
|
|
hs.message = condition.message
|
|
end
|
|
if condition.status == "True" and condition.type == "Ready" then
|
|
healthy = true
|
|
hs.message = condition.message
|
|
end
|
|
if condition.status == "True" and condition.type == "Paused" then
|
|
suspended = true
|
|
hs.message = condition.message
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
if degraded == true then
|
|
hs.status = "Degraded"
|
|
return hs
|
|
elseif healthy == true then
|
|
hs.status = "Healthy"
|
|
if suspended == true then
|
|
hs.message = "ScaledObject is paused as part of normal operations."
|
|
else
|
|
hs.message = "ScaledObject is active."
|
|
end
|
|
return hs
|
|
end
|
|
|
|
hs.status = "Progressing"
|
|
hs.message = "Creating ScaledObject or waiting for conditions."
|
|
return hs
|
|
url: https://argocd-demand-ase1c-prd.meeshogcp.in
|
|
statusbadge.enabled: "true"
|
|
timeout.reconciliation.jitter: 60s
|
|
help.chatUrl: "https://meesho.slack.com/archives/C021QNS6JLV"
|
|
help.chatText: "Chat now!"
|
|
dex.config: |
|
|
logger:
|
|
level: error
|
|
format: json
|
|
connectors:
|
|
- type: github
|
|
id: github
|
|
name: GitHub
|
|
loadAllGroups: true
|
|
admin.enabled: "true"
|
|
config:
|
|
clientID: Ov23lieojxIuQFqAqT2N
|
|
clientSecret: $github-sso-secret:dex.github.clientSecret
|
|
orgs:
|
|
- name: Meesho
|
|
params:
|
|
controller.sharding.algorithm: round-robin
|
|
controller.status.processors: '40'
|
|
controller.operation.processors: '20'
|
|
controller.repo.server.timeout.seconds: '60'
|
|
rbac:
|
|
policy.csv: |
|
|
## Policy for live-commerce team
|
|
p, role:live-commerce, applications, create, dmnd-*/*, allow
|
|
p, role:live-commerce, applications, get, dmnd-*/*, allow
|
|
p, role:live-commerce, applications, override, dmnd-*/*, allow
|
|
p, role:live-commerce, applications, sync, dmnd-*/*, allow
|
|
p, role:live-commerce, applications, update, dmnd-*/*, allow
|
|
p, role:live-commerce, logs, get, dmnd-*/*, allow
|
|
p, role:live-commerce, exec, create, dmnd-*/*, allow
|
|
p, role:live-commerce, projects, get, dmnd-*, allow
|
|
p, role:live-commerce, projects, sync, dmnd-*, allow
|
|
p, role:live-commerce, applications, action/apps/Deployment/restart, dmnd-*/*, allow
|
|
p, role:live-commerce, repositories, update, dmnd-*/*, allow
|
|
p, role:admins, *, *, */*, allow
|
|
## Policy for BACKEND team
|
|
p, role:backend, applications, create, dmnd-*/*, allow
|
|
p, role:backend, applications, get, dmnd-*/*, allow
|
|
p, role:backend, applications, override, dmnd-*/*, allow
|
|
p, role:backend, applications, sync, dmnd-*/*, allow
|
|
p, role:backend, applications, update, dmnd-*/*, allow
|
|
p, role:backend, applications, delete, */*, deny
|
|
p, role:backend, applications, delete/*/Pod/*/*, dmnd-*/*, allow
|
|
p, role:backend, logs, get, dmnd-*/*, allow
|
|
p, role:backend, exec, create, dmnd-*/*, allow
|
|
p, role:backend, projects, get, dmnd-*, allow
|
|
p, role:backend, projects, sync, dmnd-*, allow
|
|
p, role:backend, applications, action/apps/Deployment/restart, dmnd-*/*, allow
|
|
p, role:backend, repositories, update, dmnd-*/*, allow
|
|
## Policy for Admin-NoDelete role
|
|
p, role:admin-nodelete, *, get, *, allow
|
|
p, role:admin-nodelete, *, create, *, allow
|
|
p, role:admin-nodelete, *, update, *, allow
|
|
p, role:admin-nodelete, applications, override, *, allow
|
|
p, role:admin-nodelete, applications, sync, *, allow
|
|
p, role:admin-nodelete, applications, action/*, *, allow
|
|
p, role:admin-nodelete, applications, delete/*/Pod/*/*, */*, allow
|
|
g, Meesho:devops-new, role:admin-nodelete
|
|
## Teams and policy mapping
|
|
g, Meesho:devops, role:admin
|
|
g, Meesho:backend, role:backend
|
|
g, Meesho:live-commerce, role:live-commerce
|
|
g, ringmaster, role:backend
|