ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/argo-workflows/helm-release.yaml

@@ -0,0 +1,222 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: argo-workflows
+  namespace: argo
+spec:
+  interval: 15m
+  releaseName: argo-workflows
+  targetNamespace: argo
+  chart:
+    spec:
+      chart: argo-workflows
+      version: 2.0.14
+      sourceRef:
+        kind: HelmRepository
+        name: argo
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    images:
+      tag: v4.1.6
+      pullPolicy: IfNotPresent
+
+    crds:
+      install: true
+      keep: true
+      full: true
+      upgradeJob:
+        image:
+          registry: quay.io
+          repository: argoproj/argo-workflows-crdinstaller
+          tag: v4.1.6@sha256:b9be70ef3f4a0709d771e9c098a99fd2d97be1b095c1b160c668a2fde61dc237
+        resources:
+          requests:
+            cpu: 50m
+            memory: 128Mi
+          limits:
+            memory: 256Mi
+
+    singleNamespace: false
+
+    workflow:
+      serviceAccount:
+        create: true
+        name: argo-workflow
+      rbac:
+        create: true
+        rules:
+          - apiGroups: [""]
+            resources: [secrets]
+            resourceNames:
+              - argo-artifacts
+              - argo-internal-ca
+            verbs: [get]
+
+    controller:
+      image:
+        registry: quay.io
+        repository: argoproj/workflow-controller
+        tag: v4.1.6@sha256:a012a639ead374a4a9306093d6b29dfdc7e6c4c1a85c684582cb961a6cc8bcf3
+      extraEnv:
+        - name: WORKFLOW_USER_OVERRIDE_ALLOWLIST
+          value: synchronization
+      replicas: 2
+      pdb:
+        enabled: true
+        minAvailable: 1
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app.kubernetes.io/name: argo-workflows-workflow-controller
+                  app.kubernetes.io/instance: argo-workflows
+              topologyKey: kubernetes.io/hostname
+      workflowNamespaces:
+        - argo
+        - argo-opnsense-certificate
+      workflowRestrictions:
+        templateReferencing: Secure
+      resources:
+        requests:
+          cpu: 100m
+          memory: 256Mi
+        limits:
+          memory: 1Gi
+      securityContext:
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+            - ALL
+      persistence:
+        archive: true
+        archiveTTL: 30d
+        nodeStatusOffLoad: true
+        connectionPool:
+          maxIdleConns: 100
+          maxOpenConns: 0
+        postgresql:
+          host: main-rw.postgres.svc.cluster.local
+          port: 5432
+          database: argo
+          tableName: argo_workflows
+          userNameSecret:
+            name: argo-db
+            key: username
+          passwordSecret:
+            name: argo-db
+            key: password
+          ssl: true
+          sslMode: require
+      workflowDefaults:
+        metadata:
+          labels:
+            app.kubernetes.io/part-of: argo-workflows
+        spec:
+          serviceAccountName: argo-workflow
+          podMetadata:
+            labels:
+              app.kubernetes.io/name: argo-workflow
+              app.kubernetes.io/instance: argo-workflows
+          ttlStrategy:
+            secondsAfterSuccess: 86400
+            secondsAfterFailure: 259200
+            secondsAfterCompletion: 604800
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1000
+            seccompProfile:
+              type: RuntimeDefault
+
+    executor:
+      image:
+        registry: quay.io
+        repository: argoproj/argoexec
+        tag: v4.1.6@sha256:28432d912a716167709429b28e2755f49416eb4754c35ca3013863fb72717a00
+      resources:
+        requests:
+          cpu: 10m
+          memory: 64Mi
+        limits:
+          memory: 256Mi
+      securityContext:
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 8737
+        capabilities:
+          drop:
+            - ALL
+
+    mainContainer:
+      resources:
+        requests:
+          cpu: 50m
+          memory: 64Mi
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+            - ALL
+
+    server:
+      enabled: true
+      image:
+        registry: quay.io
+        repository: argoproj/argocli
+        tag: v4.1.6@sha256:acb4c1de9a9c5fa109fb3094eebbc3eac42d2dd328181b0a395488cc97de75e5
+      replicas: 2
+      pdb:
+        enabled: true
+        minAvailable: 1
+      authModes:
+        - server
+      secure: false
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app.kubernetes.io/name: argo-workflows-server
+                  app.kubernetes.io/instance: argo-workflows
+              topologyKey: kubernetes.io/hostname
+      resources:
+        requests:
+          cpu: 50m
+          memory: 128Mi
+        limits:
+          memory: 512Mi
+      securityContext:
+        readOnlyRootFilesystem: false
+        runAsNonRoot: true
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+            - ALL
+
+    useStaticCredentials: true
+    artifactRepository:
+      archiveLogs: false
+      s3:
+        bucket: argo-workflows
+        endpoint: s3.quorate.internal
+        region: us-east-1
+        insecure: false
+        accessKeySecret:
+          name: argo-artifacts
+          key: accesskey
+        secretKeySecret:
+          name: argo-artifacts
+          key: secretkey
+        caSecret:
+          name: argo-internal-ca
+          key: internal-ca.crt
+        keyFormat: "artifacts/{{workflow.namespace}}/{{workflow.name}}/{{pod.name}}"