danmanners / aws-argo-cluster-template

A community opinionated template for deploying Kubernetes clusters on-prem and in AWS using Pulumi, SOPS, Sealed Secrets, GitHub Actions, Renovate, Cilium and more!

Hello, I'm Dan 👋

What am I doing?

• 🌉 Designing and building infrastructure and services @ Cisco
• 🔐 Ensuring security on systems in zero-trust environments
• 🎬 Scaling GitHub Actions for the Enterprise
• 🎉 Making K8s easier for everyone deploying or managing it
• 📦 Containerizing ALL OF THE THINGS
• ☕ Drinking all of the coffee

Connect with me!

Website 🕸️

Want your own personalized Github Readme? codeSTACKr has an excellent YouTube video tutorial here which will help get you started!

aws-argo-cluster-template's Issues

Pulumi - Replace `aws` with `awsnative`

awsnative is better and should be utilized.

Configure automated AWS SSO Access for ArgoCD Auth

See the docs here

Fix value pointer for argocd.yaml in Apps, currently looks at cilium values.

https://github.com/danmanners/aws-argo-cluster-template/blob/22bd464fbb0086c38e065b77894dbd491a48b916/kubernetes/apps/argocd.yaml#L22C11-L22C51

OPTION | Bastion Instantiation

In the event of disaster recovery or wanting to have direct kubectl access without the Tailscale Operator, a bastion may be desired.

We want the ability to toggle a boolean and get your bastion and all relevant resources provisioned by the pulumi stack.

Pulumi - Create the ArgoCD AWS SSO Auth ConfigMap

Check Docs here: https://www.pulumi.com/registry/packages/github/api-docs/repositoryfile/

Note

May be useful for EFS/EBS Configuration as well?

Installation order of operations - Docs & Installation

We need docs and a shell script which will walk a user through the full provisioning of their required resources.

Fundamentally, the order of operations should be:

1. Install the required tooling on your local system
2. Walk user through setting up AWS SSO
3. Configure local AWS SSO credentials
4. Create the state bucket for Pulumi (awscli)
5. Pulumi "Identity Access and Trust" Stack - Configure SSO for your GitHub Actions for ECR Auth
6. GitHub Action for Building & Pushing the cluster instantiation and bootstrapping container
7. Pulumi Cloud Resource Stack - Provision AWS resources and kick off the AWS Lambda, utilizing the ECR container

AWS Authentication

Need to ensure that credential configuration is as secure as possible. Currently, docs reference static credentials. Instead, utilizing the AWS CLI SSO Login flow should be the approach documented and recommended.

No namespace file; this has been replaced

Replace this with kubectl create ns argocd

aws-argo-cluster-template/kubernetes/core/argocd/readme.md

Line 7 in 22bd464

kubectl apply -f namespace.yaml

etcd backup and disaster recovery

Utilize https://github.com/siderolabs/talos-backup as an etcd backup solution?

Enable Talos API Access from Kubernetes

See here

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Rate-Limited

These updates are currently rate-limited. Click on a checkbox below to force their creation now.

• chore(deps): update docker/setup-buildx-action action to v3.1.0
• chore(deps): update helm release ingress-nginx to v4.10.0
• 🔐 Create all rate-limited PRs at once 🔐

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• chore(deps): update helm release argo-cd to v6.4.1
• chore(deps): update helm release cert-manager to v1.14.3
• chore(deps): update helm release coredns to v1.29.0
• chore(deps): update helm release external-dns to v1.14.3
• chore(deps): update helm release sealed-secrets to v2.15.0
• fix(deps): update dependency @pulumi/pulumi to v3.107.0
• chore(deps): update dependency @types/node to v20
• fix(deps): update dependency @pulumi/aws to v6
• fix(deps): update dependency @pulumi/awsx to v2
• fix(deps): update dependency eta to v3
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

dockerfile

containers/Dockerfile

• docker/dockerfile 1.6.0
• docker.io/library/alpine 3.19
• docker.io/library/alpine 3.19

github-actions

.github/workflows/build-container.yaml

• aws-actions/configure-aws-credentials v4
• actions/checkout v4.1.1
• docker/setup-buildx-action v3.0.0
• aws-actions/amazon-ecr-login v2.0.1
• docker/login-action v3
• docker/build-push-action v5

npm

infrastructure/pulumi/package.json

• @pulumi/aws ^5.0.0
• @pulumi/awsx ^1.0.0
• @pulumi/pulumi ^3.0.0
• eta ^1.12.3
• @types/node ^14

regex

kubernetes/core/sealed-secrets/kustomization.yaml

kubernetes/core/argocd/env.sh

• argo-cd 6.2.1

kubernetes/core/cert-manager/env.sh

• cert-manager 1.13.3

kubernetes/core/cilium/env.sh

• cilium 1.15.1

kubernetes/core/coredns/env.sh

• coredns 1.28.2

kubernetes/core/ebs-csi-driver/env.sh

• cert-manager 1.13.3

kubernetes/core/external-dns/env.sh

• external-dns 1.13.3

kubernetes/core/ingress-nginx/env.sh

• ingress-nginx 4.9.1

kubernetes/core/sealed-secrets/env.sh

• sealed-secrets 2.14.1

kubernetes/services/efs-csi-driver/env.sh

• cert-manager 1.13.3

---

• Check this box to trigger a request for Renovate to run again on this repository

Enable Auto-creation and provisioning of IAM Roles for Kubernetes Service Accounts (IRSA)

Need to get IRSA working with Talos. IRSA, or IAM Roles for Kubernetes Service Accounts, will allow significantly more granular control over what pods/services have access to which AWS resources and permissions.

Resources

• YouTube - IRSA for non EKS Clusters | PlatformCon 2023
• Medium - AWS IRSA For Self-Hosted Kubernetes
• GitHub - AWS Docs