From a3ea6f89cca06a008bfa1054a296baa888926465 Mon Sep 17 00:00:00 2001
From: Haitao Pan <manbuzhe2009@qq.com>
Date: Thu, 11 May 2023 16:56:16 +0800
Subject: [PATCH] roles/gitlab: update

---
 .../setup-k3s-with-existed-vhost.yml          |  9 ++-
 playbook/jobs/init_gitlab                     | 29 +++-------
 playbook/jobs/init_harbor                     |  3 +-
 playbook/roles/gitlab/files/setup.sh          | 57 ++++++++++++++++++-
 playbook/roles/gitlab/tasks/main.yml          | 45 +++++++--------
 playbook/roles/postgresql/files/post-setup.sh |  2 +
 playbook/roles/secret-manger/tasks/main.yml   | 18 ++++--
 7 files changed, 109 insertions(+), 54 deletions(-)

diff --git a/.github/workflows/setup-k3s-with-existed-vhost.yml b/.github/workflows/setup-k3s-with-existed-vhost.yml
index c5b0c01d..5e40b9cf 100644
--- a/.github/workflows/setup-k3s-with-existed-vhost.yml
+++ b/.github/workflows/setup-k3s-with-existed-vhost.yml
@@ -13,6 +13,8 @@ env:
   ALI_SK: ${{ secrets.ALI_SK }}
   SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
   SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+  SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}
+  OIDC_CLIENT_TOKEN: ${{ secrets.OIDC_CLIENT_TOKEN }}
   OIDC_ADMIN_PASSWORD: ${{ secrets.OIDC_ADMIN_PASSWORD }}
 
 defaults:
@@ -42,7 +44,7 @@ jobs:
           mkdir -pv hosts/ 
           cat > hosts/inventory << EOF
           [master]
-          mirrors.onwalk.net               ansible_host=43.206.90.100
+          mirrors.onwalk.net               ansible_host=20.18.50.198
           
           [all:vars]
           ansible_port=22
@@ -53,11 +55,12 @@ jobs:
           ali_sk=$ALI_SK
           dns_ak=$DNS_AK
           dns_sk=$DNS_SK
-          ingress_ip=43.206.90.100
+          ingress_ip=20.18.50.198
           admin_password=$OIDC_ADMIN_PASSWORD
           EOF
           ansible-playbook -i hosts/inventory jobs/init_k3s_cluster -D
-          ansible-playbook -i hosts/inventory jobs/init_chatwithgpt -D
+          ansible-playbook -i hosts/inventory jobs/init_gitlab -D
+          #ansible-playbook -i hosts/inventory jobs/init_chatwithgpt -D
           #ansible-playbook -i hosts/inventory jobs/init_harbor -D
           #ansible-playbook -i hosts/inventory jobs/init_keycloak -D
           #ansible-playbook -i hosts/inventory jobs/init_cert_manager -D
diff --git a/playbook/jobs/init_gitlab b/playbook/jobs/init_gitlab
index 1a7794f1..ac2a72a5 100644
--- a/playbook/jobs/init_gitlab
+++ b/playbook/jobs/init_gitlab
@@ -1,37 +1,26 @@
-- name: setup openldap 
+- name: setup gitlab 
   hosts: all
   user: root
   become: yes
   gather_facts: yes
   tasks:
     - include_role:
-        name: keycloak
+        name: gitlab
       vars:
         group: master
         namespace: gitlab
         domain: onwalk.net
         auto_issuance: true
-        generic:
-            - name: gitlab-sso-secret
-              value: "provider=/tmp/provider.yaml"
+        update_secret: true  
+        oidc_issuer_url: 'https://keycloak.onwalk.net/realms/cloud-sso'
+        oidc_client_id: 'gitlab-oidc'
+        oidc_client_token: {{ OIDC_CLIENT_TOKEN }} 
+        oidc_client_redirect_uri: 'https://gitlab.onwalk.net/users/auth/openid_connect/callback'
         tls:
           - secret_name: gitlab-tls
-            keyfile: /etc/ssl/onwalk.net.key
+            keyfile: /etc/sl/onwalk.net.key
             certfile: /etc.ssl/onwalk.net.pem
         secret:
           - secret_name: gitlab-smtp-secret
             key: password
-            value: "{{ stmp_password }}"
-        namespace: {{ namespace }}
-        object_bucket: {{ object_bucket }}
-        gitlab_secret: 'gitlab-tls'
-        gitlab_stmp_secret: 'gitlab-smtp-secret'
-        smtp_port: {{ smtp_port }}
-        smtp_domain: {{ smtp_domain }}
-        smtp_address: {{ smtp_address }}
-        smtp_username: {{ smtp_username }}
-        smtp_emailfrom: {{ smtp_emailfrom }}
-        smtp_display_name: {{ smtp_display_name }}
-        oidc_client_id: {{ oidc_client_id }}
-        oidc_issuer_url: {{ oidc_issuer_url }}
-        oidc_client_token: {{ oidc_client_token }} 
+            value: "{{ SMTP_PASSWORD }}"
diff --git a/playbook/jobs/init_harbor b/playbook/jobs/init_harbor
index 8cf20d3f..33c3c5b0 100644
--- a/playbook/jobs/init_harbor
+++ b/playbook/jobs/init_harbor
@@ -10,8 +10,9 @@
         group: master
         namespace: harbor
         domain: onwalk.net
-        auto_issuance: false
         db_namespace: database
+        auto_issuance: true
+        update_secret: true
         storage_type: oss
         tls:
           - secret_name: harbor-tls
diff --git a/playbook/roles/gitlab/files/setup.sh b/playbook/roles/gitlab/files/setup.sh
index 01004fec..e5f1515b 100644
--- a/playbook/roles/gitlab/files/setup.sh
+++ b/playbook/roles/gitlab/files/setup.sh
@@ -1,9 +1,27 @@
 #!/bin/bash
 
+check_empty() {
+  if [ -z "$1" ]; then
+    echo "$2"
+    exit 1
+  fi
+}
+
+check_empty "$1" "Please provide a domain name as the first argument"
+check_empty "$2" "Please provide a namespace as the second argument"
+check_empty "$3" "Please provide a GitLab secret as the third argument"
+check_empty "$4" "Please provide a GitLab database secret as the fourth argument"
+check_empty "$5" "Please provide a GitLab SSO secret as the fifth argument"
+check_empty "$6" "Please provide a GitLab SMTP secret as the sixth argument"
+check_empty "$7" "Please provide a GitLab Redis secret as the seventh argument"
+
 domain=$1
 namespace=$2
 gitlab_secret=$3
-gitlab_sso_secret=$4
+gitlab_db_secret=$4
+gitlab_sso_secret=$5
+gitlab_smtp_secret=$6
+gitlab_redis_secret=$7
 
 cat > gitlab-values.yaml <<EOF
 global:
@@ -22,6 +40,42 @@ global:
       secretName: $gitlab_secret
   minio:
     enabled: true
+  gitaly:
+    persistence:
+      enabled: true
+  psql:
+    host: postgresql.database.svc.cluster.local
+    port: 5432
+    username: postgres
+    database: gitlab
+    password:
+      secret: $gitlab_db_secret
+      key: password
+  redis:
+    host: redis-master.redis.svc.cluster.local
+    port: 6379
+    password:
+      enabled: true
+      secret: $gitlab_redis_secret
+      key: password
+  appConfig:
+    email:
+      from: 'manbuzhe2009@qq.com'
+      display_name: GitLab-System
+    smtp:
+      tls: true
+      enabled: true
+      port: 465
+      domain: exmail.qq.com
+      address: smtp.exmail.qq.com
+      user_name: 'manbuzhe2009@qq.com'
+      password:
+        secret: $gitlab_smtp_secret
+        key: password
+      authentication: "login"
+      starttls_auto: false
+      openssl_verify_mode: "peer"
+      pool: true
   appConfig:
     omniauth:
       enabled: true
@@ -41,6 +95,7 @@ kas:
 nginx-ingress:
   enabled: false
 postgresql:
+  install: false
   metrics:
     enabled: false
 prometheus:
diff --git a/playbook/roles/gitlab/tasks/main.yml b/playbook/roles/gitlab/tasks/main.yml
index f1a4906f..169cec0e 100755
--- a/playbook/roles/gitlab/tasks/main.yml
+++ b/playbook/roles/gitlab/tasks/main.yml
@@ -1,11 +1,20 @@
-- name: get db password
-  shell: 'kubectl get secret --namespace database postgresql -o jsonpath="{.data.postgres-password}" | base64 -d'
-  register: db_password_raw
+- name: get redis password
+  shell: 'kubectl get secret --namespace redis redis -o jsonpath="{.data.redis-password}" | base64 -d'
+  register: redis_command_raw
   when: inventory_hostname in groups[group][0]
 
-- name: set fact join command
+- name: set fact join command for redis
   set_fact:
-    db_password : "{{ db_password_raw.stdout }}"
+    redis_password : "{{ redis_command_raw.stdout }}"
+
+- name: get db password
+  shell: 'kubectl get secret --namespace database postgresql -o jsonpath="{.data.postgres-password}" | base64 -d'
+  register: db_command_raw
+  when: inventory_hostname in groups[group][0]
+
+- name: set fact join command for mysql_db
+  set_fact:
+    pg_db_password : "{{ db_command_raw.stdout }}"
   when: inventory_hostname in groups[group][0]
 
 #- name: Show Debug Info
@@ -16,23 +25,13 @@
   with_items:
     - provider.yaml
 
+- name:  "cluster {{ ClusterContext }} Create New Generic Secret from Key/Vaule"
+  shell: 'kubectl delete secret {{ item.secret_name }} -n  {{ namespace }} || echo true; kubectl create secret generic {{ item.secret_name }} --from-literal={{ item.key }}="{{ item.value }}" -n {{ namespace }}'
+  loop:
+    - { secret_name: 'gitlab-sso-secret', key: 'password', value: "provider=/tmp/provider.yaml" }
+    - { secret_name: 'gitlab-db-secret', key: 'password', value: 'hostvars[groups[group][0]].pg_db_password' }
+    - { secret_name: 'gitlab-redis-secret', key: 'password', value: 'hostvars[groups[group][0]].redis_password' }
+
 - name: Setup Gitlab Server
-  script: files/setup.sh {{ domain }} {{ namespace }} {{ gitlab_secret }} {{ gitlab_sso_secret }}
+  script: files/setup.sh {{ domain }} {{ namespace }} 'gitlab-tls' 'gitlab-db-secret' 'gitlab-sso-secret' 'gitlab-smtp-secret' 'gitlab-redis-secret'
   when: inventory_hostname in groups[group]
-#- name: Setup Gitlab Server
-#  script: files/setup.sh           \
-#          {{ domain }}             \
-#          {{ namespace }}          \
-#          {{ object_bucket }}      \
-#          {{ gitlab_secret }}      \
-#          {{ gitlab_stmp_secret }} \
-#          {{ smtp_port }}          \
-#          {{ smtp_domain }}        \
-#          {{ smtp_address }}       \
-#          {{ smtp_username }}      \
-#          {{ smtp_emailfrom }}     \
-#          {{ smtp_display_name }}  \
-#          {{ oidc_issuer_url }}    \
-#          {{ oidc_client_id }}     \
-#          {{ oidc_client_token }}
-#  when: inventory_hostname in groups[group]
diff --git a/playbook/roles/postgresql/files/post-setup.sh b/playbook/roles/postgresql/files/post-setup.sh
index bd341c77..9e9d5c35 100644
--- a/playbook/roles/postgresql/files/post-setup.sh
+++ b/playbook/roles/postgresql/files/post-setup.sh
@@ -2,6 +2,8 @@
 export namespace=$1
 export POSTGRES_PASSWORD=$(kubectl get secret --namespace $namespace postgresql -o jsonpath="{.data.postgres-password}" | base64 -d)
 
+kubectl run postgresql-client --rm --tty -i --restart='Never' --namespace $namespace --image docker.io/bitnami/postgresql:15.2.0-debian-11-r11 --env="PGPASSWORD=$POSTGRES_PASSWORD" --command -- psql --host postgresql -U postgres -d postgres -p 5432 -w -c "CREATE DATABASE gitlab;" || echo true
+
 kubectl run postgresql-client --rm --tty -i --restart='Never' --namespace $namespace --image docker.io/bitnami/postgresql:15.2.0-debian-11-r11 --env="PGPASSWORD=$POSTGRES_PASSWORD" --command -- psql --host postgresql -U postgres -d postgres -p 5432 -w -c "CREATE DATABASE keycloak;" || echo true
 
 kubectl run postgresql-client --rm --tty -i --restart='Never' --namespace $namespace --image docker.io/bitnami/postgresql:15.2.0-debian-11-r11 --env="PGPASSWORD=$POSTGRES_PASSWORD" --command -- psql --host postgresql -U postgres -d postgres -p 5432 -w -c "CREATE DATABASE registry;" || echo true
diff --git a/playbook/roles/secret-manger/tasks/main.yml b/playbook/roles/secret-manger/tasks/main.yml
index fec34088..f12b12b9 100755
--- a/playbook/roles/secret-manger/tasks/main.yml
+++ b/playbook/roles/secret-manger/tasks/main.yml
@@ -1,19 +1,23 @@
 - name: "cluster {{ ClusterContext }} : Create namespace"
   shell: "kubectl create ns {{ namespace }} || echo true"
 
+# Create General Secret for K8S form File
+
 - name: "cluster {{ ClusterContext }} : Clean OLD Secret"
   shell: "kubectl delete secret {{ item.secret_name }} -n  {{ namespace }}"
   ignore_errors: yes
   loop: "{{ generic }}"
   when: generic is defined
 
-- name: "cluster {{ ClusterContext }} : Create New Generic secret from file"
-  shell: "kubectl create secret generic {{ item.secret_name }}      \
-          --from-file={{ item.secret_file }}                        \
-          -n {{ namespace }}"
+- name: "cluster {{ ClusterContext }} Create New Generic Secret from Key/Vaule"
+  shell: 'kubectl create secret generic {{ item.secret_name }}              \
+          --from-literal={{ item.sercet_key }}="{{ item.secret_value }}"    \
+          -n {{ namespace }}'
   loop: "{{ generic }}"
   when: generic is defined
 
+# Create General Secret for K8S From Key/Value
+
 - name: "cluster {{ ClusterContext }} : Clean OLD Secret"
   shell: "kubectl delete secret {{ item.secret_name }} -n  {{ namespace }}"
   ignore_errors: yes
@@ -27,6 +31,8 @@
   loop: "{{ secrets }}"
   when: secrets is defined
 
+# TLS Secret for K8S key/cert
+ 
 - name: "cluster {{ ClusterContext }} : Clean OLD Secret"
   shell: "kubectl delete secret {{ item.secret_name }} -n {{ namespace }}"
   ignore_errors: yes
@@ -34,9 +40,9 @@
   when: tls is defined
 
 - name: "cluster {{ ClusterContext }} : Create New tls secret"
-  shell: "kubectl create secret tls {{ item.secret_name }}                   \
+  shell: 'kubectl create secret tls {{ item.secret_name }}            \
           --key={{ item.keyfile }}                                    \
           --cert={{ item.certfile }}                                  \
-          -n {{ namespace }}"
+          -n {{ namespace }}'
   loop: "{{ tls }}"
   when: tls is defined