ai-workspace-infra/iac_modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

roles/gitlab: update

Browse Source
This commit is contained in:
Haitao Pan 2023-05-11 16:56:16 +08:00
parent d0230ab7a0
commit a3ea6f89cc
7 changed files with 109 additions and 54 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
.github/workflows/setup-k3s-with-existed-vhost.yml vendored
View File

@ -13,6 +13,8 @@ env:
ALI_SK: ${{ secrets.ALI_SK }}
SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}
OIDC_CLIENT_TOKEN: ${{ secrets.OIDC_CLIENT_TOKEN }}
OIDC_ADMIN_PASSWORD: ${{ secrets.OIDC_ADMIN_PASSWORD }}
defaults:
@ -42,7 +44,7 @@ jobs:
mkdir -pv hosts/
cat > hosts/inventory << EOF
[master]
mirrors.onwalk.net ansible_host=43.206.90.100
mirrors.onwalk.net ansible_host=20.18.50.198
[all:vars]
ansible_port=22
@ -53,11 +55,12 @@ jobs:
ali_sk=$ALI_SK
dns_ak=$DNS_AK
dns_sk=$DNS_SK
ingress_ip=43.206.90.100
ingress_ip=20.18.50.198
admin_password=$OIDC_ADMIN_PASSWORD
EOF
ansible-playbook -i hosts/inventory jobs/init_k3s_cluster -D
ansible-playbook -i hosts/inventory jobs/init_chatwithgpt -D
ansible-playbook -i hosts/inventory jobs/init_gitlab -D
#ansible-playbook -i hosts/inventory jobs/init_chatwithgpt -D
#ansible-playbook -i hosts/inventory jobs/init_harbor -D
#ansible-playbook -i hosts/inventory jobs/init_keycloak -D
#ansible-playbook -i hosts/inventory jobs/init_cert_manager -D

29
playbook/jobs/init_gitlab
View File

@ -1,37 +1,26 @@
- name: setup openldap
- name: setup gitlab
hosts: all
user: root
become: yes
gather_facts: yes
tasks:
- include_role:
name: keycloak
name: gitlab
vars:
group: master
namespace: gitlab
domain: onwalk.net
auto_issuance: true
generic:
- name: gitlab-sso-secret
value: "provider=/tmp/provider.yaml"
update_secret: true
oidc_issuer_url: 'https://keycloak.onwalk.net/realms/cloud-sso'
oidc_client_id: 'gitlab-oidc'
oidc_client_token: {{ OIDC_CLIENT_TOKEN }}
oidc_client_redirect_uri: 'https://gitlab.onwalk.net/users/auth/openid_connect/callback'
tls:
- secret_name: gitlab-tls
keyfile: /etc/ssl/onwalk.net.key
keyfile: /etc/sl/onwalk.net.key
certfile: /etc.ssl/onwalk.net.pem
secret:
- secret_name: gitlab-smtp-secret
key: password
value: "{{ stmp_password }}"
namespace: {{ namespace }}
object_bucket: {{ object_bucket }}
gitlab_secret: 'gitlab-tls'
gitlab_stmp_secret: 'gitlab-smtp-secret'
smtp_port: {{ smtp_port }}
smtp_domain: {{ smtp_domain }}
smtp_address: {{ smtp_address }}
smtp_username: {{ smtp_username }}
smtp_emailfrom: {{ smtp_emailfrom }}
smtp_display_name: {{ smtp_display_name }}
oidc_client_id: {{ oidc_client_id }}
oidc_issuer_url: {{ oidc_issuer_url }}
oidc_client_token: {{ oidc_client_token }}
value: "{{ SMTP_PASSWORD }}"

3
playbook/jobs/init_harbor
View File

@ -10,8 +10,9 @@
group: master
namespace: harbor
domain: onwalk.net
auto_issuance: false
db_namespace: database
auto_issuance: true
update_secret: true
storage_type: oss
tls:
- secret_name: harbor-tls

57
playbook/roles/gitlab/files/setup.sh
View File

@ -1,9 +1,27 @@
#!/bin/bash
check_empty() {
if [ -z "$1" ]; then
echo "$2"
exit 1
fi
}
check_empty "$1" "Please provide a domain name as the first argument"
check_empty "$2" "Please provide a namespace as the second argument"
check_empty "$3" "Please provide a GitLab secret as the third argument"
check_empty "$4" "Please provide a GitLab database secret as the fourth argument"
check_empty "$5" "Please provide a GitLab SSO secret as the fifth argument"
check_empty "$6" "Please provide a GitLab SMTP secret as the sixth argument"
check_empty "$7" "Please provide a GitLab Redis secret as the seventh argument"
domain=$1
namespace=$2
gitlab_secret=$3
gitlab_sso_secret=$4
gitlab_db_secret=$4
gitlab_sso_secret=$5
gitlab_smtp_secret=$6
gitlab_redis_secret=$7
cat > gitlab-values.yaml <<EOF
global:
@ -22,6 +40,42 @@ global:
secretName: $gitlab_secret
minio:
enabled: true
gitaly:
persistence:
enabled: true
psql:
host: postgresql.database.svc.cluster.local
port: 5432
username: postgres
database: gitlab
password:
secret: $gitlab_db_secret
key: password
redis:
host: redis-master.redis.svc.cluster.local
port: 6379
password:
enabled: true
secret: $gitlab_redis_secret
key: password
appConfig:
email:
from: 'manbuzhe2009@qq.com'
display_name: GitLab-System
smtp:
tls: true
enabled: true
port: 465
domain: exmail.qq.com
address: smtp.exmail.qq.com
user_name: 'manbuzhe2009@qq.com'
password:
secret: $gitlab_smtp_secret
key: password
authentication: "login"
starttls_auto: false
openssl_verify_mode: "peer"
pool: true
appConfig:
omniauth:
enabled: true
@ -41,6 +95,7 @@ kas:
nginx-ingress:
enabled: false
postgresql:
install: false
metrics:
enabled: false
prometheus:

45
playbook/roles/gitlab/tasks/main.yml
View File

@ -1,11 +1,20 @@
- name: get db password
shell: 'kubectl get secret --namespace database postgresql -o jsonpath="{.data.postgres-password}" | base64 -d'
register: db_password_raw
- name: get redis password
shell: 'kubectl get secret --namespace redis redis -o jsonpath="{.data.redis-password}" | base64 -d'
register: redis_command_raw
when: inventory_hostname in groups[group][0]
- name: set fact join command
- name: set fact join command for redis
set_fact:
db_password : "{{ db_password_raw.stdout }}"
redis_password : "{{ redis_command_raw.stdout }}"
- name: get db password
shell: 'kubectl get secret --namespace database postgresql -o jsonpath="{.data.postgres-password}" | base64 -d'
register: db_command_raw
when: inventory_hostname in groups[group][0]
- name: set fact join command for mysql_db
set_fact:
pg_db_password : "{{ db_command_raw.stdout }}"
when: inventory_hostname in groups[group][0]
#- name: Show Debug Info
@ -16,23 +25,13 @@
with_items:
- provider.yaml
- name: "cluster {{ ClusterContext }} Create New Generic Secret from Key/Vaule"
shell: 'kubectl delete secret {{ item.secret_name }} -n {{ namespace }} || echo true; kubectl create secret generic {{ item.secret_name }} --from-literal={{ item.key }}="{{ item.value }}" -n {{ namespace }}'
loop:
- { secret_name: 'gitlab-sso-secret', key: 'password', value: "provider=/tmp/provider.yaml" }
- { secret_name: 'gitlab-db-secret', key: 'password', value: 'hostvars[groups[group][0]].pg_db_password' }
- { secret_name: 'gitlab-redis-secret', key: 'password', value: 'hostvars[groups[group][0]].redis_password' }
- name: Setup Gitlab Server
script: files/setup.sh {{ domain }} {{ namespace }} {{ gitlab_secret }} {{ gitlab_sso_secret }}
script: files/setup.sh {{ domain }} {{ namespace }} 'gitlab-tls' 'gitlab-db-secret' 'gitlab-sso-secret' 'gitlab-smtp-secret' 'gitlab-redis-secret'
when: inventory_hostname in groups[group]
#- name: Setup Gitlab Server
# script: files/setup.sh \
# {{ domain }} \
# {{ namespace }} \
# {{ object_bucket }} \
# {{ gitlab_secret }} \
# {{ gitlab_stmp_secret }} \
# {{ smtp_port }} \
# {{ smtp_domain }} \
# {{ smtp_address }} \
# {{ smtp_username }} \
# {{ smtp_emailfrom }} \
# {{ smtp_display_name }} \
# {{ oidc_issuer_url }} \
# {{ oidc_client_id }} \
# {{ oidc_client_token }}
# when: inventory_hostname in groups[group]

2
playbook/roles/postgresql/files/post-setup.sh
View File

@ -2,6 +2,8 @@
export namespace=$1
export POSTGRES_PASSWORD=$(kubectl get secret --namespace $namespace postgresql -o jsonpath="{.data.postgres-password}" | base64 -d)
kubectl run postgresql-client --rm --tty -i --restart='Never' --namespace $namespace --image docker.io/bitnami/postgresql:15.2.0-debian-11-r11 --env="PGPASSWORD=$POSTGRES_PASSWORD" --command -- psql --host postgresql -U postgres -d postgres -p 5432 -w -c "CREATE DATABASE gitlab;" || echo true
kubectl run postgresql-client --rm --tty -i --restart='Never' --namespace $namespace --image docker.io/bitnami/postgresql:15.2.0-debian-11-r11 --env="PGPASSWORD=$POSTGRES_PASSWORD" --command -- psql --host postgresql -U postgres -d postgres -p 5432 -w -c "CREATE DATABASE keycloak;" || echo true
kubectl run postgresql-client --rm --tty -i --restart='Never' --namespace $namespace --image docker.io/bitnami/postgresql:15.2.0-debian-11-r11 --env="PGPASSWORD=$POSTGRES_PASSWORD" --command -- psql --host postgresql -U postgres -d postgres -p 5432 -w -c "CREATE DATABASE registry;" || echo true

18
playbook/roles/secret-manger/tasks/main.yml
View File

@ -1,19 +1,23 @@
- name: "cluster {{ ClusterContext }} : Create namespace"
shell: "kubectl create ns {{ namespace }} || echo true"
# Create General Secret for K8S form File
- name: "cluster {{ ClusterContext }} : Clean OLD Secret"
shell: "kubectl delete secret {{ item.secret_name }} -n {{ namespace }}"
ignore_errors: yes
loop: "{{ generic }}"
when: generic is defined
- name: "cluster {{ ClusterContext }} : Create New Generic secret from file"
shell: "kubectl create secret generic {{ item.secret_name }} \
--from-file={{ item.secret_file }} \
-n {{ namespace }}"
- name: "cluster {{ ClusterContext }} Create New Generic Secret from Key/Vaule"
shell: 'kubectl create secret generic {{ item.secret_name }} \
--from-literal={{ item.sercet_key }}="{{ item.secret_value }}" \
-n {{ namespace }}'
loop: "{{ generic }}"
when: generic is defined
# Create General Secret for K8S From Key/Value
- name: "cluster {{ ClusterContext }} : Clean OLD Secret"
shell: "kubectl delete secret {{ item.secret_name }} -n {{ namespace }}"
ignore_errors: yes
@ -27,6 +31,8 @@
loop: "{{ secrets }}"
when: secrets is defined
# TLS Secret for K8S key/cert
- name: "cluster {{ ClusterContext }} : Clean OLD Secret"
shell: "kubectl delete secret {{ item.secret_name }} -n {{ namespace }}"
ignore_errors: yes
@ -34,9 +40,9 @@
when: tls is defined
- name: "cluster {{ ClusterContext }} : Create New tls secret"
shell: "kubectl create secret tls {{ item.secret_name }} \
shell: 'kubectl create secret tls {{ item.secret_name }} \
--key={{ item.keyfile }} \
--cert={{ item.certfile }} \
-n {{ namespace }}"
-n {{ namespace }}'
loop: "{{ tls }}"
when: tls is defined