diff --git a/README.md b/README.md index 8e3e3816..2abe2d8f 100644 --- a/README.md +++ b/README.md @@ -197,10 +197,9 @@ The [pattern.sh](pattern.sh) script is used to deploy the Layered Zero Trust Val Once the pattern has been successfully deployed, you can review the deployed components. Each are deployed and managed using OpenShift GitOps. -Two (2) instances of OpenShift GitOps has been deployed to your Hub Cluster. Each can be seen within the OpenShift Console by selecting the Application Selector at the top navigation bar (box with 9 smaller squares). +One instance of OpenShift GitOps is deployed to your Hub Cluster. It can be seen within the OpenShift Console by selecting the Application Selector at the top navigation bar (box with 9 smaller squares). -1. Cluster Argo CD - Deploys an Argo CD App of Apps Application called _layered-zero-trust-hub_ which deploys the components associated with the pattern. These _Applications_ are managed by the Hub Argo CD instance (see below) -2. Hub Argo CD - Manages the individual components associated with the pattern on the Hub OpenShift instance. +The consolidated Argo CD instance (namespace `vp-gitops`) manages all pattern applications. If all of the Argo CD applications are reporting healthy, the pattern has been deployed successfully. diff --git a/charts/rh-keycloak/templates/cleanup-keycloak-setup.yaml b/charts/rh-keycloak/templates/cleanup-keycloak-setup.yaml index 7cb7b7bf..b107bd0f 100644 --- a/charts/rh-keycloak/templates/cleanup-keycloak-setup.yaml +++ b/charts/rh-keycloak/templates/cleanup-keycloak-setup.yaml @@ -21,6 +21,9 @@ rules: - apiGroups: [""] resources: ["secrets"] verbs: ["list", "delete"] +- apiGroups: ["k8s.keycloak.org"] + resources: ["keycloakrealmimports"] + verbs: ["get"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -49,7 +52,7 @@ metadata: argocd.argoproj.io/hook-delete-policy: BeforeHookCreation spec: backoffLimit: 2 - activeDeadlineSeconds: 120 + activeDeadlineSeconds: 600 template: metadata: labels: @@ -64,6 +67,35 @@ spec: - /bin/bash - -ce - | - oc delete secret -l "validatedpatterns.io/cleanup=delete" -n "{{ .Release.Namespace }}" --ignore-not-found + echo "Waiting for ztvp-realm-import to complete before cleanup..." + TIMEOUT=540 + ELAPSED=0 + IMPORT_DONE=false + while [ $ELAPSED -lt $TIMEOUT ]; do + DONE=$(oc get keycloakrealmimport ztvp-realm-import \ + -n "{{ .Release.Namespace }}" \ + -o jsonpath='{.status.conditions[?(@.type=="Done")].status}' 2>/dev/null || echo "") + ERRORS=$(oc get keycloakrealmimport ztvp-realm-import \ + -n "{{ .Release.Namespace }}" \ + -o jsonpath='{.status.conditions[?(@.type=="HasErrors")].status}' 2>/dev/null || echo "") + if [ "$DONE" = "True" ]; then + echo "Realm import finished successfully" + IMPORT_DONE=true + break + fi + if [ "$ERRORS" = "True" ]; then + echo "Realm import has errors (${ELAPSED}s elapsed) — keeping secrets so the Job can retry, waiting 15s..." + else + echo "Realm import still in progress (${ELAPSED}s elapsed), waiting 15s..." + fi + sleep 15 + ELAPSED=$((ELAPSED + 15)) + done + if [ "$IMPORT_DONE" != "true" ]; then + echo "Timeout waiting for realm import (Done never became True). Leaving secrets intact — retry this hook after the import completes." >&2 + exit 1 + fi + oc delete secret -l "validatedpatterns.io/cleanup=delete" \ + -n "{{ .Release.Namespace }}" --ignore-not-found echo "Cleanup complete." {{- end }} diff --git a/docs/oidc/entraid.md b/docs/oidc/entraid.md index 10f7c362..58f483fc 100644 --- a/docs/oidc/entraid.md +++ b/docs/oidc/entraid.md @@ -489,7 +489,7 @@ When the pipeline reaches any of these tasks, we will need to follow these steps ##### Using the OpenShift Web UI 1. Select **Pipelines -> Pipelines** from the left hand navigation bar. -2. Locate the **qtodo-supply-chain** pipeline. It's within the **layered-zero-trust-hub** project. +2. Locate the **qtodo-supply-chain** pipeline. It's within the **vp-gitops** project. 3. Select the last `PipelineRun` or start a new one. 4. On the logs tab, select the signing task: `qtodo-sign-artifact`, `qtodo-sign-image` or `qtodo-sbom-attestation` 5. In the log box, on the last lines, you can get the verification code. @@ -499,24 +499,24 @@ When the pipeline reaches any of these tasks, we will need to follow these steps ##### Using the OpenShift CLI -1. List the `TaskRuns` in the namespace **layered-zero-trust-hub**. +1. List the `TaskRuns` in the namespace **vp-gitops**. ```shell - oc get taskrun -n layered-zero-trust-hub + oc get taskrun -n vp-gitops ``` 2. Continue monitoring the status of the tasks until one of the signing tasks (`qtodo-sign-artifact`, `qtodo-sign-image` or `qtodo-sbom-attestation`) starts. 3. For each signing task, obtain the verification code and verify it using a Web browser: ```shell - export SIGN_ARTIFACT_POD=$(oc get taskrun -n layered-zero-trust-hub -l tekton.dev/pipelineTask=qtodo-sign-artifact -o jsonpath='{ .items[0].status.podName }') - oc logs -n layered-zero-trust-hub ${SIGN_ARTIFACT_POD} | grep 'verification code' + export SIGN_ARTIFACT_POD=$(oc get taskrun -n vp-gitops -l tekton.dev/pipelineTask=qtodo-sign-artifact -o jsonpath='{ .items[0].status.podName }') + oc logs -n vp-gitops ${SIGN_ARTIFACT_POD} | grep 'verification code' - export SIGN_IMAGE_POD=$(oc get taskrun -n layered-zero-trust-hub -l tekton.dev/pipelineTask=qtodo-sign-image -o jsonpath='{ .items[0].status.podName }') - oc logs -n layered-zero-trust-hub ${SIGN_IMAGE_POD} | grep 'verification code' + export SIGN_IMAGE_POD=$(oc get taskrun -n vp-gitops -l tekton.dev/pipelineTask=qtodo-sign-image -o jsonpath='{ .items[0].status.podName }') + oc logs -n vp-gitops ${SIGN_IMAGE_POD} | grep 'verification code' - export SIGN_SBOM_POD=$(oc get taskrun -n layered-zero-trust-hub -l tekton.dev/pipelineTask=qtodo-sbom-attestation -o jsonpath='{ .items[0].status.podName }') - oc logs -n layered-zero-trust-hub ${SIGN_SBOM_POD} | grep 'verification code' + export SIGN_SBOM_POD=$(oc get taskrun -n vp-gitops -l tekton.dev/pipelineTask=qtodo-sbom-attestation -o jsonpath='{ .items[0].status.podName }') + oc logs -n vp-gitops ${SIGN_SBOM_POD} | grep 'verification code' ``` 4. Go to [https://login.microsoft.com/device](https://login.microsoft.com/device) and enter the verification code @@ -827,7 +827,7 @@ vault_jwt_roles: **Key Parameters**: * **audience**: Internal identifier for supply chain Vault authentication (`supply-chain`) -* **subject**: The SPIFFE ID of the Tekton pipeline service account (e.g., `spiffe://apps./ns/layered-zero-trust-hub/sa/pipeline`) +* **subject**: The SPIFFE ID of the Tekton pipeline service account (e.g., `spiffe://apps./ns/vp-gitops/sa/pipeline`) * **policies**: Vault policies granting access to supply chain secrets **Vault Policy for Supply Chain**: diff --git a/docs/supply-chain.md b/docs/supply-chain.md index 1e48e864..337969ad 100644 --- a/docs/supply-chain.md +++ b/docs/supply-chain.md @@ -261,7 +261,7 @@ Once the supply-chain application has synced in Argo CD, start the pipeline usin 1. Launch the OpenShift Web console. 2. Select **Pipelines -> Pipelines** from the left hand navigation bar. -3. Locate the **qtodo-supply-chain** pipeline. It's within the **layered-zero-trust-hub** project. +3. Locate the **qtodo-supply-chain** pipeline. It's within the **vp-gitops** project. 4. In the kebab menu (three vertical dots) from the right-hand, select **Start**. Review the configurable parameters. Most parameters should be correct with their default values if we are in single-cluster mode. But, double-check their values just in case. @@ -287,7 +287,7 @@ apiVersion: tekton.dev/v1 kind: PipelineRun metadata: generateName: qtodo-manual-run- - namespace: layered-zero-trust-hub + namespace: vp-gitops spec: pipelineRef: name: qtodo-supply-chain @@ -318,7 +318,7 @@ apiVersion: tekton.dev/v1 kind: PipelineRun metadata: generateName: qtodo-manual-run- - namespace: layered-zero-trust-hub + namespace: vp-gitops spec: pipelineRef: name: qtodo-supply-chain @@ -348,20 +348,20 @@ oc create -f qtodo-pipeline.yaml You can review the current pipeline logs using the [Tekton CLI](https://tekton.dev/docs/cli/). ```shell -tkn pipeline logs -n layered-zero-trust-hub -L -f +tkn pipeline logs -n vp-gitops -L -f ``` Or use `oc` commands to monitor progress: ```shell # List pipeline runs -oc get pipelinerun -n layered-zero-trust-hub +oc get pipelinerun -n vp-gitops # Check task status for a specific run -oc get taskruns -n layered-zero-trust-hub -l tekton.dev/pipelineRun= +oc get taskruns -n vp-gitops -l tekton.dev/pipelineRun= # View logs for a specific task -oc logs -n layered-zero-trust-hub -l tekton.dev/pipelineRun=,tekton.dev/pipelineTask= +oc logs -n vp-gitops -l tekton.dev/pipelineRun=,tekton.dev/pipelineTask= ``` ### Protected Repositories @@ -498,7 +498,7 @@ This section applies whenever the pipeline clones from a Git server whose TLS ce When a repository is hosted on an internal Git server (e.g. GitLab behind a corporate CA), the `git-clone` task will fail with `SSL certificate problem: self-signed certificate in certificate chain` because the pod does not trust the corporate CA. -The `ztvp-certificates` chart already extracts and distributes the cluster's CA bundle (ingress, service, and any custom/corporate CAs). When the `supply-chain` feature is enabled, the `ztvp-trusted-ca` ConfigMap is automatically distributed to the pipeline namespace (`layered-zero-trust-hub`) via ACM policy. +The `ztvp-certificates` chart already extracts and distributes the cluster's CA bundle (ingress, service, and any custom/corporate CAs). When the `supply-chain` feature is enabled, the `ztvp-trusted-ca` ConfigMap is automatically distributed to the pipeline namespace (`vp-gitops`) via ACM policy. To make the `git-clone` task use this CA bundle, enable the SSL CA bundle mount in the `supply-chain` application overrides: @@ -553,7 +553,7 @@ The pipeline we have prepared has the following steps: 1. Launch the OpenShift Web console. 2. Select **Pipelines -> Pipelines** from the left hand navigation bar. -3. Locate the **qtodo-supply-chain** pipeline (**layered-zero-trust-hub** project). +3. Locate the **qtodo-supply-chain** pipeline (**vp-gitops** project). 4. Select the **PipelineRun** link in the column **Last run**. 5. In the **Details** tab we can see a summary of the pipeline execution and tasks. 6. By **clicking** on each individual task, or on the **Logs** tab, we can see the output of the tasks. @@ -563,7 +563,7 @@ The pipeline we have prepared has the following steps: The first thing we'll check is whether our pipeline has finished successfully. ```shell -oc get pipelinerun -n layered-zero-trust-hub +oc get pipelinerun -n vp-gitops NAME SUCCEEDED REASON STARTTIME COMPLETIONTIME qtodo-manual-run-p46f7 True Succeeded 7m4s 2m12s @@ -572,7 +572,7 @@ qtodo-manual-run-p46f7 True Succeeded 7m4s 2m12s We can see the individual result of each step by reviewing the `TaskRuns`. ```shell -oc get taskruns -n layered-zero-trust-hub +oc get taskruns -n vp-gitops NAME SUCCEEDED REASON STARTTIME COMPLETIONTIME qtodo-manual-run-p46f7-qtodo-build-artifact True Succeeded 7m44s 5m17s @@ -587,10 +587,10 @@ qtodo-manual-run-p46f7-qtodo-verify-artifact True Succeeded qtodo-manual-run-p46f7-qtodo-verify-image True Succeeded 3m22s 3m3s ``` -Tasks run as pods within OpenShift. We can find these pods in the namespace `layered-zero-trust-hub`. +Tasks run as pods within OpenShift. We can find these pods in the namespace `vp-gitops`. ```shell -oc get pods -n layered-zero-trust-hub +oc get pods -n vp-gitops NAME READY STATUS RESTARTS AGE qtodo-manual-run-p46f7-qtodo-build-artifact-pod 0/1 Completed 0 10m @@ -608,7 +608,7 @@ qtodo-manual-run-p46f7-qtodo-verify-image-pod 0/1 Completed 0 If we want to see the output of a particular step, we can view this information in the pod logs. For example, let's look at the image verification messages: ```shell -oc logs -n layered-zero-trust-hub qtodo-manual-run-p46f7-qtodo-verify-image-pod +oc logs -n vp-gitops qtodo-manual-run-p46f7-qtodo-verify-image-pod Success: true Result: SUCCESS @@ -649,7 +649,7 @@ The credentials to access the Quay web interface can be obtained as follows: * Quay password: ```shell - oc get secret -n layered-zero-trust-hub qtodo-quay-password -o json | jq '.data["password"] | @base64d' + oc get secret -n vp-gitops qtodo-quay-password -o json | jq '.data["password"] | @base64d' ``` Now that we have the credentials, we can check the content in Quay. diff --git a/overrides/values-vault-network-policy.yaml b/overrides/values-vault-network-policy.yaml index 23abfc46..61246387 100644 --- a/overrides/values-vault-network-policy.yaml +++ b/overrides/values-vault-network-policy.yaml @@ -33,7 +33,7 @@ vault: job-name: registry-token-refresher-seed namespaceSelector: matchLabels: - kubernetes.io/metadata.name: layered-zero-trust-hub + kubernetes.io/metadata.name: vp-gitops # registry-token-refresher CronJob — periodic token refresh to Vault - ports: - protocol: TCP @@ -44,7 +44,7 @@ vault: app.kubernetes.io/name: registry-token-refresher namespaceSelector: matchLabels: - kubernetes.io/metadata.name: layered-zero-trust-hub + kubernetes.io/metadata.name: vp-gitops # Vault cluster replication port — HA readiness - ports: - protocol: TCP diff --git a/scripts/gen-imageset-config.py b/scripts/gen-imageset-config.py index 049f0db8..c3f77b38 100644 --- a/scripts/gen-imageset-config.py +++ b/scripts/gen-imageset-config.py @@ -177,7 +177,7 @@ def get_workload_namespaces() -> set: Namespaces with the argocd.argoproj.io/managed-by label are ZTVP workload namespaces. The label value is the ArgoCD instance namespace itself - (e.g. layered-zero-trust-hub), which we exclude since it contains ArgoCD + (e.g. vp-gitops), which we exclude since it contains ArgoCD infrastructure images already covered by the GitOps operator catalog. """ # Always include these regardless of ArgoCD labels diff --git a/tests/interop/test_validate_hub_site_components.py b/tests/interop/test_validate_hub_site_components.py index ef1b48a0..156710e1 100644 --- a/tests/interop/test_validate_hub_site_components.py +++ b/tests/interop/test_validate_hub_site_components.py @@ -71,7 +71,7 @@ def test_validate_argocd_reachable_hub_site(openshift_dyn_client): @pytest.mark.validate_argocd_applications_health_hub_site def test_validate_argocd_applications_health_hub_site(openshift_dyn_client): logger.info("Get all applications deployed by argocd on hub site") - projects = ["openshift-gitops", "layered-zero-trust-hub"] + projects = ["openshift-gitops", "vp-gitops"] unhealthy_apps = application.get_argocd_application_status( openshift_dyn_client, projects ) diff --git a/values-global.yaml b/values-global.yaml index c050c5fb..1ab12b6c 100644 --- a/values-global.yaml +++ b/values-global.yaml @@ -1,6 +1,7 @@ --- global: pattern: layered-zero-trust + singleArgoCD: true options: useCSV: false syncPolicy: Automatic