chore(add-ons): Let Image Updater read GHCR

add-ons/argocd-image-updater/applications.yaml

@@ -0,0 +1,18 @@
+# Rolls out each push of :latest by pinning its digest on the Application, so
+# CI never commits a tag
+apiVersion: argocd-image-updater.argoproj.io/v1alpha1
+kind: ImageUpdater
+metadata:
+  name: applications
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  applicationRefs:
+    - namePattern: applications
+      images:
+        - alias: app
+          imageName: ghcr.io/pixelos-ci/applications:latest
+          commonUpdateSettings:
+            updateStrategy: digest
+            pullSecret: pullsecret:argocd/ghcr-pull

add-ons/argocd-image-updater/ghcr-sealedsecret.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ghcr-pull
+  namespace: argocd
+spec:
+  encryptedData:
+    .dockerconfigjson: AgCRsZSHP+T0U4pLck8AJ++dCb47OklXOgediZXPUSENy2/W/o4ooDgr+vP9GmSMoSm/5FBahmiSF8WYth0TYL4bdTKMQfnFO4kAOxk5QXuyyaKL+ZxL3XFfKRUeVD4m+HFJrvUsHC36TeJy0SYwkaS5isWdNTPFPdNRhXQ9OiTKQlL2tPZgOzk48CH5wDCugI3uC6/1tuzoeNzbIWRFpbkDtwhdGBqnZIiZZhOliXBV5wGnEcPKpxBnE21PNBsr2A8/lisuTsmcsyZDj3uenLjcdITdTs57sss8HPEI9u+cIuNFCZVO/URtJEV1k24oEr3CAPJojic6vT6jS0Ow9H3VEJpEObAN4E02+yC/gZjkLOBSO9aq77SzVRJpTxmcuW4s2U91hegYzS33H0jBCB1EJ5y/rYZUFrdBQnr16gENbMo8HuYf0jnogDvyGjd4Kf4HWDl97yiOv2xdm7Jb3MBrgyCQSw2uU4QpvgwGpTCo8j3LrfqQjBZRyTn/HplLO+zGkQKcqsNosZ0a+fm990gDWEgBuNjf/2iVLsYMJrz8da3Fu4k2TTtzxtAZ0eFJbxa97CRC3d/4nx/vS/S3zTzoXhp2XHdlG3RfurrKKtxeretRlTtbTM8CjahMB0/oLgBKSaNs5gEtvaATKe8jBfAw+WHxCFJC+0Jxj8IfDq0KWv2I1OO2r+7TK+o2Ed/7SucJQd4e4NQJfWQW/xiq4RL3StJdO3WXcICloslTMtE9EaZn/w/dx98bLRus9mrkom+tPSHw63tHPn6C4B75Ya8qA5LSBylMEZXg8CG5xfqmR3C0F/c4XCYerfbzNg88AIw2VBsAgW6aySCkZCa9rkaCx5AyzblCVQxGZ+PpR0RdaBkuT2hXoWHBZZu9Dmhk6Qr1HyqCBaV2DmsYFcYB+pfHUKzT0BAWO7BdbiLFil0V779JZw==
+  template:
+    metadata:
+      name: ghcr-pull
+      namespace: argocd
+    type: kubernetes.io/dockerconfigjson

add-ons/argocd-image-updater/kustomization.yaml

@@ -1,4 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - applications.yaml
+  - ghcr-sealedsecret.yaml
   - networkpolicy.yaml

add-ons/traefik/kustomization.yaml

@@ -3,4 +3,5 @@ kind: Kustomization
 resources:
   - wildcard-whyredfire-dev.yaml
   - wildcard-whyredfire-dpdns-org.yaml
+  - wildcard-pixelos-net.yaml
   - networkpolicy.yaml

add-ons/traefik/wildcard-pixelos-net.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-pixelos-net
+  namespace: traefik
+spec:
+  dnsNames:
+    - '*.pixelos.net'
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-prod
+  privateKey:
+    rotationPolicy: Always
+  secretName: wildcard-pixelos-net

argocd-apps/add-ons/traefik.yaml

@@ -64,6 +64,17 @@ spec:
                   - kind: Secret
                     name: wildcard-whyredfire-dpdns-org
                     group: ""
+              websecure-pixelos:
+                port: 8443
+                protocol: HTTPS
+                mode: Terminate
+                hostname: "*.pixelos.net"
+                namespacePolicy:
+                  from: All
+                certificateRefs:
+                  - kind: Secret
+                    name: wildcard-pixelos-net
+                    group: ""
           resources:
             limits:
               cpu: 1000m

argocd-apps/apps/applications-repo-sealedsecret.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: applications-repo
+  namespace: argocd
+spec:
+  encryptedData:
+    sshPrivateKey: AgDIXYZfl1u4KR4YgGx8XHpiM1MXnvv39MJV07StKwk2LCsCamL31HDzaA34L5VV5wsnLEgx1CR7i9WMEd6lUyuQWG4YGI4JUgcYV8clMpu/Ih64io2rWs7TTLs1FUqrkLvGwx6aCVFYNQMOnDpY5+RJ63WC8JTM/z0rr16F/47d1BKrW0WVaEZcyy+AT1wG8Y+R7qNDxqND9W7X3+sQfBP+nI2WiTplDe3vbk6WTolKpofME+x6u70j2JpP2rfIhnttNv88qiM9CNssHqxQ4TlH1BNrI2SdnLwX6bWLvCqVKrj8TAh18yZzrkYy1wwI+4ZKCcTSUNsKgtwrrj/BmPEmQsxJ241e/uZzRyuT+VdOls2gtdpc1gz/sxlgRNALZd/BQcYq/XV3pe07STujqXoZgNjC92vRrVY6wPdycCmKHrGSyhN34KdqTi9lfrYc0MtI0c0T0BgXt+ButNKfSHt/2m4SZ8HGne22b3pIltsJP58R8XtomTbHa9VFfTWfiEhuKpwWzM/UsDo7PYhd+TdZFkTj9zfUrR1JluJLuFknUp3hpsU1F1HSyXLGtVmdKb+nD/7n4RTP3zGWNZfCRG3PqsAgR2TBwPKo+7RTq5B1BPqNXjoEWaI3P+divrkZT1PooqHuLEWJOr+68azSy04AnlhBzI06w/FZIgMSjV4adqizFlVBR5BTQgQULDSISYlMRoQz2Z1HUXr9JbqEZBHTwmcSgNilagKYM7dE5mLNXswys4IvlG+SxzDHgTCQH+7ZRS3n2prIZRWqHHhh1EcE7FChvN13HnzwY5PtHi8AQje6dRxCxliQ/nRrjhRQRM+4XQj4bI6wT+kSCjM71hTe/Zg7WguNoyc8Jt105X2YApFTCu6AIBNi5vGIqWXfAofoDvrBM2Flu0kVnbwOCrShh3SXuO/wr8mAdZC1DfbRNFnPNog0Iav4t2iju25YEk1a0SczpyjqVyJRU0IaZx21Ean0B/EweNCC3qt5++mVveuxSfOLJOnX/0mOkwNeJS/6jxiCU4IijDwUEW4FLMiz5yOXM3ktnNdPkauD9IP7py/kmdjgXSjwBr0mSRmzyQe8QaYUIsX15pZoiIdDcrCX8pf5ftzzxxB145SBajQW9YmAIh4DrtrGCpGYTWjd9AVEUYEIh3P0lxN/KtXQdsZvYK5/Gjb2MAeoFXlaussHTWNlULHEo7PDgIyE0oeeXN9qcbU/EJ4H47z9JOTFhVqLWdYECv1ueamHVAZ5CVQDQdQWBqVlOwX2ltM2g84GCiLMIng7WopZtDujMp1bwT3zzTblYXfx0gk6Gp1nNlGOHw==
+    type: AgA4zCPMAfGwpRf7SNkANByWaxs64jB7YKBTbb5Q1y+UF1u+/tEuYYAFySGRRffLPxjXWutwkcCJvzCaJn4v0KaUCT05HAyRPILgE9aNxa3NIAz80hkTBPDInakvrUq6AysKKHl5TvMsd6YCI40EM2aVrUYcEAwaNycFMaYQNXrfJeJdrSBjgLPqWLudos2e9U1yC8vqrfaCDnTCQitgxfVkD7YNhtfpKWUnMOdO2GDx+yOfom4KxUWSwnfvbXOgA+xmCYqpJ96TCEg6Jar5xcGsZuEluS8cMrbw+tSUqfsGYpmA4Q9KllloFTmNZrUi49R5MgE9dU5i7+WmOX6RbbSfI2scVACvnzYA7yKQMXI58ngwtTB/yYM24/ylV+6ltl2n8XDXSMJ7qZ8h4QJ0IOPAuehQTYy+SQLaVKYdfKzUoSi2mA+CHH948Ul6KbNiCbhv4AptlV4amg1PDITz4YmtOWh0rO9PxQFN92FY6dScoDSyACon1nniE9p2k/fF9AsagDoBLl+h66mreHH8KlzjlmsVTuq2Wdn9sCZKw0EfyH8u78Th8Kj7/tpAEKmjvt81YM6miZGgOT71Vg/ttluLqetud98rz/G7wLPKsonFGvrBCVvmJ+cSYs6jp/HNAY5pN30A0515vRutXDeo7Q0UUoOwxGdFRd//lptKZus/WrvyzBqKmGzArn9CLjWqpLA0Jtg=
+    url: AgBjKOHHrbW6YouHDudb2TOBBqQnvsK1FAZG+matWvjJcdCDzEHaX5libU103q9dAMzrEizYrRcy0TxPVn8frwblRcdOvRXL4RDzSaLxS5vnWW/pfCjk9O3imwG987jy1qiRgsiqXNDhaiNor0KCak/9oYiNjhwVzqmQJW3A6lyjwjYZO+1piNeQGn5oO1mIBJnz/dNw6lrtevSG5B785h9Jpo3n2UUbvFgOcPT4lOOxpWBETAvIo5o5fy4AdfKwHCBfm/GpAsXWyNV3bop6h117NVsXc+ysigjC0NIjCobf03J5EA9H1f/byuSyiUDsI1LVAtw+0YlUSvAXGYwVnnCLqxJDkIkrXlVtF18+kR9ktavm1Xkq2eIeL32yJ/v+WTcT9ilOhwEdfHin89l5Qhv4/VJL2CWlpllpZnHvgyD8RjeI0liW4v3HKZkiHbXmthNNrdCinJQJWpsvZBGC41NHYtFXd18i/iu29MwZ6Z7+dR/i5QHF/PxH3OH4ZB58Khuy7Y2BbKNK/KBVjV3Hm4hzHXtbEawPI4SOSyhgqTeD3eh2O5Xs7PQFkgbZzO2vOIRtRxO3F5oJOdGUhjWCLpi+gqcQhHsVodM+hYkVFsYMGBbGHKdGBX78e2q3QHBNSpyDLyoR5TOw6BzQG+C+oqlbcMwF+fkMzPT6nRbKmKtEdFqFZAW2Y6RA3jYf5Fn870wayZ/Hj5j8vhpcR6LW5DKamFkcGSZ7+ugAHEo9Tsx8xMfMaFqU1KeTUOI=
+  template:
+    metadata:
+      labels:
+        argocd.argoproj.io/secret-type: repository
+      name: applications-repo
+      namespace: argocd

argocd-apps/apps/applications.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
+    argocd.argoproj.io/sync-wave: "3"
+  name: applications
+  namespace: argocd
+spec:
+  destination:
+    namespace: pixelos
+    server: https://kubernetes.default.svc
+  project: default
+  # Private; read with the applications-repo deploy key
+  source:
+    path: k8s
+    repoURL: [email protected]:PixelOS-CI/applications.git
+    targetRevision: main
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

argocd-apps/apps/kustomization.yaml

@@ -1,6 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - applications.yaml
+  - applications-repo-sealedsecret.yaml
   - bentopdf.yaml
   - betterslcm.yaml
   - garage.yaml