mirror of https://github.com/fluxcd/flux2.git
chore(integrations/registry): remove deprecated kustomize features
Signed-off-by: Artem <67638547+Stringls@users.noreply.github.com>pull/4395/head
Artem
1 year ago
parent
659ce798c9
commit
e0dcd85e52
@ -0,0 +1,9 @@
|
||||
# Bind IRSA for the ServiceAccount
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
namespace: flux-system
|
||||
annotations:
|
||||
eks.amazonaws.com/role-arn: <role arn> # set the ARN for your role
|
||||
@ -0,0 +1,9 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
data:
|
||||
ECR_REGION: us-east-1 # set the region
|
||||
ECR_REGISTRY: <account id>.dkr.ecr.<region>.amazonaws.com # fill in the account id and region
|
||||
KUBE_SECRET: ecr-credentials # does not yet exist -- will be created in the same Namespace
|
||||
@ -1,52 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
data:
|
||||
ECR_REGION: us-east-1 # set the region
|
||||
ECR_REGISTRY: <account id>.dkr.ecr.<region>.amazonaws.com # fill in the account id and region
|
||||
KUBE_SECRET: ecr-credentials # does not yet exist -- will be created in the same Namespace
|
||||
|
||||
|
||||
# Bind IRSA for the ServiceAccount
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
namespace: flux-system
|
||||
annotations:
|
||||
eks.amazonaws.com/role-arn: <role arn> # set the ARN for your role
|
||||
|
||||
|
||||
# Set the reconcile period
|
||||
---
|
||||
apiVersion: batch/v1beta1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
namespace: flux-system
|
||||
spec:
|
||||
schedule: 0 */6 * * * # every 6hrs -- ECR tokens expire every 12 hours; refresh faster than that
|
||||
|
||||
|
||||
## If not using IRSA, set the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables
|
||||
## Store these values in a Secret and load them in the container using envFrom.
|
||||
## For managing this secret via GitOps, consider using SOPS or SealedSecrets and add that manifest in a resource file for this kustomize build.
|
||||
## https://fluxcd.io/docs/guides/mozilla-sops/
|
||||
## https://fluxcd.io/docs/guides/sealed-secrets/
|
||||
# ---
|
||||
# apiVersion: apps/v1
|
||||
# kind: Deployment
|
||||
# metadata:
|
||||
# name: credentials-sync
|
||||
# namespace: flux-system
|
||||
# spec:
|
||||
# template:
|
||||
# spec:
|
||||
# containers:
|
||||
# - name: sync
|
||||
# envFrom:
|
||||
# secretRef:
|
||||
# name: $(ECR_SECRET_NAME) # uncomment the var for this in kustomization.yaml
|
||||
@ -0,0 +1,21 @@
|
||||
# If not using IRSA, set the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables
|
||||
# Store these values in a Secret and load them in the container using envFrom.
|
||||
# For managing this secret via GitOps, consider using SOPS or SealedSecrets and add that manifest in a resource file for this kustomize build.
|
||||
# https://fluxcd.io/docs/guides/mozilla-sops/
|
||||
# https://fluxcd.io/docs/guides/sealed-secrets/
|
||||
---
|
||||
apiVersion: batch/v1beta1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
namespace: flux-system
|
||||
spec:
|
||||
jobTemplate:
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- name: sync
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: $(ECR_SECRET_NAME) # uncomment the var for this in kustomization.yaml
|
||||
@ -0,0 +1,9 @@
|
||||
# Set the reconcile period
|
||||
---
|
||||
apiVersion: batch/v1beta1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
namespace: flux-system
|
||||
spec:
|
||||
schedule: 0 */6 * * * # every 6hrs -- ECR tokens expire every 12 hours; refresh faster than that
|
||||
@ -0,0 +1,8 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
data:
|
||||
AWS_ACCESS_KEY_ID: Zm9vCg==
|
||||
AWS_SECRET_ACCESS_KEY: YmFyCg==
|
||||
type: Opaque
|
||||
@ -0,0 +1,3 @@
|
||||
varReference:
|
||||
- path: spec/jobTemplate/spec/template/spec/containers/envFrom/secretRef
|
||||
kind: CronJob
|
||||
@ -0,0 +1,8 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
data:
|
||||
ACR_NAME: my-registry
|
||||
KUBE_SECRET: acr-my-registry # does not yet exist -- will be created in the same Namespace
|
||||
@ -0,0 +1,15 @@
|
||||
# Set the reconcile period + specify the pod-identity via the aadpodidbinding label
|
||||
---
|
||||
apiVersion: batch/v1beta1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
namespace: flux-system
|
||||
spec:
|
||||
schedule: 0 * * * * # ACR tokens expire every 3 hours; refresh faster than that
|
||||
jobTemplate:
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
aadpodidbinding: $(AZ_IDENTITY_NAME) # match the AzureIdentity name
|
||||
@ -0,0 +1,9 @@
|
||||
# Bind to the GCP service-account
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
namespace: flux-system
|
||||
annotations:
|
||||
iam.gke.io/gcp-service-account: <name>@<project-id>.iam.gserviceaccount.com # set the GCP service-account
|
||||
@ -0,0 +1,8 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
data:
|
||||
GCR_REGISTRY: gcr.io # set the registry
|
||||
KUBE_SECRET: gcr-credentials # does not yet exist -- will be created in the same Namespace
|
||||
@ -1,28 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
data:
|
||||
GCR_REGISTRY: gcr.io # set the registry
|
||||
KUBE_SECRET: gcr-credentials # does not yet exist -- will be created in the same Namespace
|
||||
|
||||
# Bind to the GCP service-account
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
namespace: flux-system
|
||||
annotations:
|
||||
iam.gke.io/gcp-service-account: <name>@<project-id>.iam.gserviceaccount.com # set the GCP service-account
|
||||
|
||||
# Set the reconcile period
|
||||
---
|
||||
apiVersion: batch/v1beta1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
namespace: flux-system
|
||||
spec:
|
||||
schedule: 0,30 * * * * # 30m interval -- GCR tokens expire every hour; refresh faster than that
|
||||
@ -0,0 +1,9 @@
|
||||
# Set the reconcile period
|
||||
---
|
||||
apiVersion: batch/v1beta1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
namespace: flux-system
|
||||
spec:
|
||||
schedule: 0,30 * * * * # 30m interval -- GCR tokens expire every hour; refresh faster than that
|
||||
@ -0,0 +1,9 @@
|
||||
# Bind IRSA for the ServiceAccount
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
namespace: flux-system
|
||||
annotations:
|
||||
eks.amazonaws.com/role-arn: <role arn> # set the ARN for your role
|
||||
@ -0,0 +1,10 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
data:
|
||||
ECR_REGION: us-east-1 # set the region
|
||||
ECR_REGISTRY: <account id>.dkr.ecr.<region>.amazonaws.com # fill in the account id and region
|
||||
KUBE_SECRET: ecr-credentials # does not yet exist -- will be created in the same Namespace
|
||||
SYNC_PERIOD: "21600" # 6hrs -- ECR tokens expire every 12 hours; refresh faster than that
|
||||
@ -1,42 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
data:
|
||||
ECR_REGION: us-east-1 # set the region
|
||||
ECR_REGISTRY: <account id>.dkr.ecr.<region>.amazonaws.com # fill in the account id and region
|
||||
KUBE_SECRET: ecr-credentials # does not yet exist -- will be created in the same Namespace
|
||||
SYNC_PERIOD: "21600" # 6hrs -- ECR tokens expire every 12 hours; refresh faster than that
|
||||
|
||||
|
||||
# Bind IRSA for the ServiceAccount
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
namespace: flux-system
|
||||
annotations:
|
||||
eks.amazonaws.com/role-arn: <role arn> # set the ARN for your role
|
||||
|
||||
|
||||
## If not using IRSA, set the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables
|
||||
## Store these values in a Secret and load them in the container using envFrom.
|
||||
## For managing this secret via GitOps, consider using SOPS or SealedSecrets and add that manifest in a resource file for this kustomize build.
|
||||
## https://fluxcd.io/flux/guides/mozilla-sops/
|
||||
## https://fluxcd.io/flux/guides/sealed-secrets/
|
||||
# ---
|
||||
# apiVersion: apps/v1
|
||||
# kind: Deployment
|
||||
# metadata:
|
||||
# name: credentials-sync
|
||||
# namespace: flux-system
|
||||
# spec:
|
||||
# template:
|
||||
# spec:
|
||||
# containers:
|
||||
# - name: sync
|
||||
# envFrom:
|
||||
# secretRef:
|
||||
# name: $(ECR_SECRET_NAME) # uncomment the var for this in kustomization.yaml
|
||||
@ -0,0 +1,19 @@
|
||||
# If not using IRSA, set the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables
|
||||
# Store these values in a Secret and load them in the container using envFrom.
|
||||
# For managing this secret via GitOps, consider using SOPS or SealedSecrets and add that manifest in a resource file for this kustomize build.
|
||||
# https://fluxcd.io/flux/guides/mozilla-sops/
|
||||
# https://fluxcd.io/flux/guides/sealed-secrets/
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
namespace: flux-system
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- name: sync
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: $(ECR_SECRET_NAME) # uncomment the var for this in kustomization.yaml
|
||||
@ -0,0 +1,8 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
data:
|
||||
AWS_ACCESS_KEY_ID: Zm9vCg==
|
||||
AWS_SECRET_ACCESS_KEY: YmFyCg==
|
||||
type: Opaque
|
||||
@ -0,0 +1,3 @@
|
||||
varReference:
|
||||
- path: spec/template/spec/containers/envFrom/secretRef
|
||||
kind: Deployment
|
||||
@ -0,0 +1,9 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
data:
|
||||
ACR_NAME: my-registry
|
||||
KUBE_SECRET: acr-my-registry # does not yet exist -- will be created in the same Namespace
|
||||
SYNC_PERIOD: "3600" # ACR tokens expire every 3 hours; refresh faster than that
|
||||
@ -0,0 +1,12 @@
|
||||
# Specify the pod-identity via the aadpodidbinding label
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
namespace: flux-system
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
aadpodidbinding: $(AZ_IDENTITY_NAME) # match the AzureIdentity name
|
||||
@ -0,0 +1,9 @@
|
||||
# Bind to the GCP service-account
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: credentials-sync
|
||||
namespace: flux-system
|
||||
annotations:
|
||||
iam.gke.io/gcp-service-account: <name>@<project-id>.iam.gserviceaccount.com # set the GCP service-account
|
||||
Loading…
Reference in New Issue