Add new overlay for Zuul test instance

kubernetes/zuul/overlays/zuul_ci_test/configs/kube.config.hcl

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Config
+current-context: otcci
+preferences: {}
+
+clusters:
+  - name: otcci
+    cluster:
+      server: "https://192.168.21.182:5443"
+      insecure-skip-tls-verify: true
+
+contexts:
+  - name: otcci
+    context:
+      cluster: otcci
+      user: otcci-admin
+
+users:
+  - name: otcci-admin
+    user:
+{{- with secret "secret/kubernetes/otcci_k8s" }}
+      client-certificate-data: "{{ base64Encode .Data.data.client_crt }}"
+      client-key-data: "{{ base64Encode .Data.data.client_key }}"
+{{- end }}

kubernetes/zuul/overlays/zuul_ci_test/configs/openstack/clouds.yaml.hcl

@@ -0,0 +1,52 @@
+---
+# Nodepool openstacksdk configuration
+#
+# This file is deployed to nodepool launcher and builder hosts
+# and is used there to authenticate nodepool operations to clouds.
+# This file only contains projects we are launching test nodes in, and
+# the naming should correspond that used in nodepool configuration
+# files.
+#
+# Generated automatically, please do not edit directly!
+cache:
+  expiration:
+    server: 5
+    port: 5
+    floating-ip: 5
+clouds:
+  otcci-pool1:
+    auth:
+{{- with secret "secret/clouds/otcci_nodepool_pool1" }}
+{{- with secret (printf "secret/%s" .Data.data.user_secret_name) }}
+       auth_url: "{{ .Data.data.auth_url }}"
+       user_domain_name: "{{ .Data.data.user_domain_name }}"
+       username: "{{ .Data.data.username }}"
+       password: "{{ .Data.data.password }}"
+{{- end }}
+       project_name: "{{ .Data.data.project_name }}"
+{{- end }}
+    private: true
+  otcci-pool2:
+    auth:
+{{- with secret "secret/clouds/otcci_nodepool_pool2" }}
+{{- with secret (printf "secret/%s" .Data.data.user_secret_name) }}
+       auth_url: "{{ .Data.data.auth_url }}"
+       user_domain_name: "{{ .Data.data.user_domain_name }}"
+       username: "{{ .Data.data.username }}"
+       password: "{{ .Data.data.password }}"
+{{- end }}
+       project_name: "{{ .Data.data.project_name }}"
+{{- end }}
+    private: true
+  otcci-pool3:
+    auth:
+{{- with secret "secret/clouds/otcci_nodepool_pool3" }}
+{{- with secret (printf "secret/%s" .Data.data.user_secret_name) }}
+       auth_url: "{{ .Data.data.auth_url }}"
+       user_domain_name: "{{ .Data.data.user_domain_name }}"
+       username: "{{ .Data.data.username }}"
+       password: "{{ .Data.data.password }}"
+{{- end }}
+       project_name: "{{ .Data.data.project_name }}"
+{{- end }}
+    private: true

kubernetes/zuul/overlays/zuul_ci_test/configs/site-vars.yaml

@@ -0,0 +1,3 @@
+---
+zuul_base_vault_token_path: /var/run/zuul/trusted-ro/zuul-base-vault-token
+zuul_vault_addr: https://vault-lb.eco.tsi-dev.otc-service.com:8200

kubernetes/zuul/overlays/zuul_ci_test/configs/vault-agent/config-nodepool.hcl

@@ -0,0 +1,31 @@
+pid_file = "/home/vault/.pid"
+"auto_auth" = {
+    "method" = {
+        "mount_path" = "auth/kubernetes_otcci"
+        "config" = {
+          "role" = "zuul"
+        }
+        "type" = "kubernetes"
+      }
+    sink "file" {
+        config = {
+            path = "/home/vault/.token"
+        }
+    }
+}
+
+cache {
+    use_auto_auth_token = true
+}
+
+template {
+  destination = "/vault/secrets/openstack/clouds.yaml"
+  source = "/vault/custom/clouds.yaml.hcl"
+  perms = "0640"
+}
+
+template {
+  destination = "/vault/secrets/.kube/config"
+  source = "/vault/custom/kube.config.hcl"
+  perms = "0640"
+}

kubernetes/zuul/overlays/zuul_ci_test/configs/vault-agent/config-zuul.hcl

@@ -0,0 +1,55 @@
+pid_file = "/home/vault/.pid"
+"auto_auth" = {
+    "method" = {
+        "mount_path" = "auth/kubernetes_otcci"
+        "config" = {
+          "role" = "zuul"
+        }
+        "type" = "kubernetes"
+      }
+    sink "file" {
+        config = {
+            path = "/home/vault/.token"
+        }
+    }
+}
+
+cache {
+    use_auto_auth_token = true
+}
+
+template {
+  destination = "/vault/secrets/connections/github.key"
+  contents = <<EOT
+{{- with secret "secret/zuul/connections/github" }}{{ .Data.data.app_key }}{{ end }}
+EOT
+  perms = "0600"
+}
+template {
+  destination = "/vault/secrets/connections/gitlab.key"
+  contents = <<EOT
+{{ with secret "secret/zuul/connections/gitlab" }}{{ .Data.data.ssh_key }}{{ end }}
+EOT
+  perms = "0600"
+}
+template {
+  destination = "/vault/secrets/connections/gitea.key"
+  contents = <<EOT
+{{ with secret "secret/zuul/connections/gitea" }}{{ .Data.data.ssh_key }}{{ end }}
+EOT
+  perms = "0600"
+}
+
+template {
+  destination = "/vault/secrets/zuul.conf"
+  source = "/vault/custom/zuul.conf.hcl"
+  perms = "0644"
+  # exec = { command = "sh -c '{ if [ -f /secrets/config.check ]; then kubectl -n zuul-ci-test rollout restart statefulset zuul-executor; else touch /secrets/config.check; fi }'", timeout = "30s" }
+}
+template {
+  destination = "/vault/secrets/sshkey"
+  contents = <<EOT
+{{- with secret "secret/zuul/sshkey" }}{{ .Data.data.private_key }}{{ end }}
+EOT
+  perms = "0600"
+}

kubernetes/zuul/overlays/zuul_ci_test/configs/vault-agent/executor-base-vault-agent.hcl

@@ -0,0 +1,29 @@
+pid_file = "/home/vault/.pid"
+
+"auto_auth" = {
+    "method" = {
+        "mount_path" = "auth/kubernetes_otcci"
+        "config" = {
+          # Here we explicitly request zuul-base role which gives access to 
+          # only certain policies
+          "role" = "zuul-base"
+        }
+        "type" = "kubernetes"
+      }
+    sink "file" {
+        config = {
+            # Write token into the file zuul executor reads
+            path = "/var/run/zuul/trusted-ro/zuul-base-vault-token"
+        }
+    }
+}
+
+cache {
+    use_auto_auth_token = true
+}
+
+# Vault agent requires at least one template or listener is present. Add a socket
+listener "unix" {
+    address = "/home/vault/vault_agent.socket"
+    tls_disable = true
+}

kubernetes/zuul/overlays/zuul_ci_test/configs/zuul.conf.hcl

@@ -0,0 +1,109 @@
+[zookeeper]
+hosts=zookeeper.zuul-ci-test.svc.cluster.local:2281
+tls_cert=/tls/client/tls.crt
+tls_key=/tls/client/tls.key
+tls_ca=/tls/client/ca.crt
+session_timeout=40
+
+[scheduler]
+#tenant_config=/etc/zuul-config/zuul/main.yaml
+tenant_config_script=/etc/zuul-config/tools/render_config.py
+state_dir=/var/lib/zuul
+relative_priority=true
+prometheus_port=9091
+
+[web]
+listen_address=0.0.0.0
+port=9000
+status_url=https://zuul-test.otc-service.com
+root=https://zuul-test.otc-service.com
+prometheus_port=9091
+
+[fingergw]
+port=9079
+user=zuul
+
+[keystore]
+{{- with secret "secret/zuul/keystore_password" }}
+password={{ .Data.data.password }}
+{{- end }}
+
+[merger]
+git_dir=/var/lib/zuul/git
+git_timeout=600
+[email protected]
+git_user_name=OpenTelekomCloud Zuul
+prometheus_port=9091
+
+[executor]
+manage_ansible=true
+ansible_root=/var/lib/zuul/managed_ansible
+private_key_file=/etc/zuul/sshkey
+disk_limit_per_job=2000
+max_starting_builds=5
+trusted_ro_paths=/var/run/zuul/trusted-ro
+variables=/var/run/zuul/vars/site-vars.yaml
+prometheus_port=9091
+
+[database]
+{{- with secret "database/static-creds/zuul-static" }}
+dburi=postgresql://{{ .Data.username }}:{{ .Data.password }}@192.168.21.196:5432/zuul?sslmode=require
+{{- end }}
+
+[connection "github"]
+name=github
+driver=github
+{{- with secret "secret/zuul/connections/github" }}
+webhook_token={{ .Data.data.webhook_token }}
+app_id={{ .Data.data.app_id }}
+{{- end }}
+app_key=/etc/zuul/connections/github.key
+
+[connection "gitlab"]
+name=gitlab
+driver=gitlab
+canonical_hostname=gitlab
+cloneurl=ssh://[email protected]
+server=git.tsi-dev.otc-service.com
+{{- with secret "secret/zuul/connections/gitlab" }}
+api_token={{ .Data.data.api_token }}
+webhook_token={{ .Data.data.webhook_token }}
+{{- end }}
+sshkey=/etc/zuul/connections/gitlab.key
+
+[connection "opendev"]
+name=opendev
+driver=git
+baseurl=https://opendev.org
+
+[connection "gitea"]
+name=gitea
+driver=gitea
+baseurl=https://gitea.eco.tsi-dev.otc-service.com
+server=gitea.eco.tsi-dev.otc-service.com
+cloneurl=ssh://[email protected]:2222
+{{- with secret "secret/zuul/connections/gitea" }}
+api_token={{ .Data.data.api_token }}
+webhook_secret={{ .Data.data.webhook_secret }}
+{{- end }}
+sshkey=/etc/zuul/connections/gitea.key
+
+[connection "smtp"]
+name=smtp
+driver=smtp
+server=otc-de-out.mms.t-systems-service.com
+port=25
+[email protected]
+[email protected]
+{{- with secret "secret/smtp_gw" }}
+user={{ .Data.data.username }}
+password={{ .Data.data.password }}
+{{- end }}
+use_starttls=True
+
+[auth "keycloak"]
+default=True
+driver=OpenIDConnect
+realm=eco
+issuer_id=https://keycloak.eco.tsi-dev.otc-service.com/realms/eco
+client_id=zuul

kubernetes/zuul/overlays/zuul_ci_test/crb.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: "rbac.authorization.k8s.io/v1"
+kind: "ClusterRoleBinding"
+metadata:
+  name: "zuul-vault-crb"
+roleRef:
+  apiGroup: "rbac.authorization.k8s.io"
+  kind: "ClusterRole"
+  name: "system:auth-delegator"
+subjects:
+  - kind: "ServiceAccount"
+    name: "zuul"
+    namespace: "zuul-ci-test"

kubernetes/zuul/overlays/zuul_ci_test/crb_admin.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: "rbac.authorization.k8s.io/v1"
+kind: "ClusterRoleBinding"
+metadata:
+  name: "zuul-admin-crb"
+roleRef:
+  kind: "ClusterRole"
+  name: "cluster-admin"
+  apiGroup: ""
+subjects:
+  - kind: "ServiceAccount"
+    name: "zuul"
+    namespace: "zuul-ci-test"