Skip to content

Commit d5c4be9

Browse files
attilaedelenyiattilaedelenyi
committed
Initial check in of argocd examples
1 parent 8adf73d commit d5c4be9

5 files changed

Lines changed: 255 additions & 58 deletions

File tree

‎README.md‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,25 @@ See each chart's README for full configuration reference:
4444

4545
Ready-to-use ArgoCD Application manifests are in [`examples/argocd/`](examples/argocd/):
4646

47-
| File | Description |
48-
|------|-------------|
49-
| [`dev-readonly.yaml`](examples/argocd/dev-readonly.yaml) | Read-only dev/evaluation server — sidecar PostgreSQL, ephemeral storage, Varnish, Envoy Gateway |
47+
| File | How to use | Description |
48+
|------|------------|-------------|
49+
| [`dev-readonly.yaml`](examples/argocd/dev-readonly.yaml) | App-of-Apps inner app | Read-only dev server — sidecar PostgreSQL, ephemeral storage, Varnish. Expects a `quay-pull-secret` in the destination namespace (see below). No networking config — add your own gateway/ingress. |
50+
| [`app-of-apps.yaml`](examples/argocd/app-of-apps.yaml) | App-of-Apps outer wrapper | Deploys `dev-readonly.yaml` from Git. Add a second source pointing to a path in your private repo that creates the `quay-pull-secret`. |
51+
| [`dev-readonly-envoy-appset.yaml`](examples/argocd/dev-readonly-envoy-appset.yaml) | ApplicationSet | Two-instance setup: read/write StatefulSet (content development) + scaled read-only StatefulSet (production serving). Envoy Gateway, cert-manager TLS, external PostgreSQL, per-pod attached disks, Varnish with `$closure` routing. Hostname, namespace, and database URL are parameterised per instance. |
52+
53+
#### Image pull credentials for ArgoCD
54+
55+
The `dev-readonly.yaml` and `dev-readonly-envoy-appset.yaml` examples use
56+
`deployment.imagePullSecrets` to reference a pre-existing `kubernetes.io/dockerconfigjson`
57+
Secret named `quay-pull-secret`. Credentials must **not** be stored inline in the
58+
Application manifest. Create the secret in the destination namespace using whichever
59+
mechanism your cluster provides:
60+
61+
- **ExternalSecret** — use [External Secrets Operator](https://external-secrets.io/) to sync from your secrets manager (see `charts/ontoserver/README.md` for an example ExternalSecret)
62+
- **SealedSecret** — encrypt with [Sealed Secrets](https://sealed-secrets.netlify.app/) and commit to your private cluster-config repo
63+
- **Manual** — `kubectl create secret docker-registry quay-pull-secret --docker-server=quay.io --docker-username=… --docker-password=… -n <namespace>`
64+
65+
In an App-of-Apps, supply the credentials as a second `source` in your outer Application pointing to a path in your own (private) repository, as shown in [`app-of-apps.yaml`](examples/argocd/app-of-apps.yaml).
5066

5167
### Prerequisites
5268

‎charts/ontoserver/README.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -463,9 +463,10 @@ See [`examples/k3d-traefik-values.yaml`](examples/k3d-traefik-values.yaml) for t
463463

464464
Ready-to-use ArgoCD Application manifests are in [`examples/argocd/`](../../examples/argocd/) at the root of this repository. Reference them directly from your ArgoCD instance or use them as a starting point.
465465

466-
| File | Description |
467-
|------|-------------|
468-
| [`dev-readonly.yaml`](../../examples/argocd/dev-readonly.yaml) | Read-only dev/evaluation server — sidecar PostgreSQL, ephemeral storage, Varnish, Envoy Gateway |
466+
| File | How to use | Description |
467+
|------|------------|-------------|
468+
| [`dev-readonly.yaml`](../../examples/argocd/dev-readonly.yaml) | App-of-Apps | Read-only dev server — sidecar PostgreSQL, ephemeral storage, Varnish. No networking — reference directly from an App-of-Apps and add your own gateway/ingress. |
469+
| [`dev-readonly-envoy-appset.yaml`](../../examples/argocd/dev-readonly-envoy-appset.yaml) | ApplicationSet | Same topology with Envoy Gateway. Hostname and namespace are parameterised — supports multiple instances from a single manifest. |
469470

470471
The ArgoCD examples use multi-source Applications with both the `ontoserver` and `ontoserver-extras` charts as sources, wired together so that enabling Varnish automatically routes the Ingress through it. See the [extras chart README](../../charts/ontoserver-extras/README.md#deploying-alongside-the-ontoserver-chart) for the wiring details.
471472

‎examples/argocd/app-of-apps.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# App-of-Apps wrapper for ontoserver-dev
2+
#
3+
# Apply this once to bootstrap ArgoCD management:
4+
#
5+
# kubectl apply -f app-of-apps.yaml -n argocd
6+
#
7+
# Structure
8+
# ─────────
9+
# This Application deploys the ontoserver-dev Application resource
10+
# (dev-readonly.yaml) into the argocd namespace. ArgoCD reconciles
11+
# that inner Application, which deploys ontoserver and Varnish into
12+
# ontoserver-dev.
13+
#
14+
# The second source points to a path in YOUR private repository that
15+
# creates the quay-pull-secret (type kubernetes.io/dockerconfigjson)
16+
# in the ontoserver-dev namespace. Use whatever secret management
17+
# tooling your cluster provides — ExternalSecret, SealedSecret, etc.
18+
# Replace the repoURL and path below with your actual values.
19+
20+
apiVersion: argoproj.io/v1alpha1
21+
kind: Application
22+
metadata:
23+
name: ontoserver-apps
24+
namespace: argocd
25+
finalizers:
26+
- resources-finalizer.argocd.argoproj.io
27+
spec:
28+
project: default
29+
destination:
30+
server: https://kubernetes.default.svc
31+
namespace: argocd
32+
sources:
33+
- repoURL: https://github.com/aehrc/ontoserver-deploy
34+
targetRevision: HEAD
35+
path: examples/argocd
36+
directory:
37+
include: 'dev-readonly.yaml'
38+
- repoURL: https://github.com/yourorg/your-cluster-config # ← your private repo
39+
targetRevision: HEAD
40+
path: credentials/ontoserver-dev # ← path to quay-pull-secret
41+
syncPolicy:
42+
automated:
43+
prune: true
44+
selfHeal: true

‎examples/argocd/dev-readonly-envoy-appset.yaml‎

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
# Ontoserver — ApplicationSet for content development + production read-only
2+
#
3+
# Creates two Applications from a single manifest:
4+
#
5+
# ontoserver-rw — Read/write StatefulSet for content development.
6+
# Single instance, external PostgreSQL, attached disk,
7+
# not publicly exposed.
8+
#
9+
# ontoserver-prod — Read-only StatefulSet cluster for production serving.
10+
# Scaled (2+ replicas), external PostgreSQL, per-pod
11+
# attached disks, Varnish cache, $closure routing to pod-0.
12+
#
13+
# Topology reference: charts/ontoserver/README.md — Production recommendations
14+
#
15+
# Prerequisites on the cluster:
16+
# - Envoy Gateway: https://gateway.envoyproxy.io/docs/install/install-helm/
17+
# - cert-manager: https://cert-manager.io/docs/installation/ (if TLS enabled)
18+
#
19+
# Before applying:
20+
# 1. Set hostname values in generators.list.elements
21+
# 2. Set database URLs (or replace config block with External Secrets)
22+
# 3. Set quay.io credentials (or use imagePullSecrets from a pre-created secret)
23+
# 4. Adjust storage sizes and resource requests to match your node pool
24+
#
25+
# Apply to your ArgoCD instance:
26+
# kubectl apply -f dev-readonly-envoy-appset.yaml -n argocd
27+
28+
apiVersion: argoproj.io/v1alpha1
29+
kind: ApplicationSet
30+
metadata:
31+
name: ontoserver
32+
namespace: argocd
33+
spec:
34+
generators:
35+
- list:
36+
elements:
37+
# ── Read/write — content development ─────────────────────────────────
38+
- appName: ontoserver-rw
39+
namespace: ontoserver-rw
40+
hostname: ontoserver-rw.example.com
41+
deploymentType: single
42+
isReadOnly: "false"
43+
replicas: "1"
44+
healthCheckOption: -f
45+
clusterName: ""
46+
closureBackend: ""
47+
dbUrl: jdbc:postgresql://db.example.com:5432/ontoserver_rw
48+
dbUsername: ontoserver
49+
storageSize: 512Gi
50+
51+
# ── Read-only — production serving ───────────────────────────────────
52+
- appName: ontoserver-prod
53+
namespace: ontoserver-prod
54+
hostname: ontoserver.example.com
55+
deploymentType: scaled
56+
isReadOnly: "true"
57+
replicas: "2"
58+
healthCheckOption: -s
59+
clusterName: ontoserver-prod
60+
# $closure routes to pod-0 via headless service DNS
61+
closureBackend: ontoserver-prod-statefulset-0.ontoserver-prod-ontoserver-headless
62+
dbUrl: jdbc:postgresql://db.example.com:5432/ontoserver_prod
63+
dbUsername: ontoserver
64+
storageSize: 1Ti
65+
66+
template:
67+
metadata:
68+
name: "{{appName}}"
69+
finalizers:
70+
- resources-finalizer.argocd.argoproj.io
71+
spec:
72+
project: default
73+
destination:
74+
server: https://kubernetes.default.svc
75+
namespace: "{{namespace}}"
76+
sources:
77+
# ── ontoserver ─────────────────────────────────────────────────────────
78+
- repoURL: https://github.com/aehrc/ontoserver-deploy
79+
targetRevision: HEAD
80+
path: charts/ontoserver
81+
helm:
82+
valuesObject:
83+
ontoserver:
84+
deployment:
85+
kind: StatefulSet
86+
type: "{{deploymentType}}"
87+
isReadOnly: "{{isReadOnly}}"
88+
replicas: "{{replicas}}"
89+
clusterName: "{{clusterName}}"
90+
db:
91+
enabled: false # external PostgreSQL for both environments
92+
persistence:
93+
files:
94+
accessMode: ReadWriteOnce
95+
storageSize: "{{storageSize}}"
96+
97+
imageCredentials:
98+
username: your-quay-username
99+
password: your-quay-password
100+
101+
serverName: "{{hostname}}"
102+
hostNames:
103+
- "{{hostname}}"
104+
105+
timeZone: Australia/Brisbane
106+
language: en_AU
107+
108+
resources:
109+
ontoserver:
110+
requests:
111+
cpu: "1000m"
112+
memory: "4Gi"
113+
limits:
114+
cpu: "4000m"
115+
memory: "12Gi"
116+
initialHeapSize: "1000m"
117+
maxHeapSize: "10000m"
118+
119+
healthCheckOption: "{{healthCheckOption}}"
120+
121+
gateway:
122+
enabled: true
123+
className: envoy-gateway-class
124+
requestTimeout: 300s
125+
backendServiceNameOverride: "{{appName}}-varnish-service"
126+
127+
tls:
128+
enabled: true
129+
certRef: "{{appName}}-tls"
130+
certmanager:
131+
enabled: true
132+
email: your-email@example.com
133+
134+
config:
135+
spring.datasource.url: "{{dbUrl}}"
136+
spring.datasource.username: "{{dbUsername}}"
137+
# spring.datasource.password set via External Secrets or --set
138+
139+
# Configure syndication subscriptions here:
140+
# config:
141+
# ontoserver.syndication.plus.subscriptions.0.uri: https://your-syndication-server/fhir/SubscriptionDefinition/...
142+
143+
# ── ontoserver-extras (Varnish) ────────────────────────────────────────
144+
- repoURL: https://github.com/aehrc/ontoserver-deploy
145+
targetRevision: HEAD
146+
path: charts/ontoserver-extras
147+
helm:
148+
valuesObject:
149+
varnish:
150+
enabled: true
151+
graceSeconds: 30
152+
# For the scaled prod instance, route $closure to pod-0.
153+
# Empty string disables dedicated $closure routing (used for rw).
154+
closureBackend: "{{closureBackend}}"
155+
cache:
156+
time200: 10m
157+
time404: 1m
158+
159+
syncPolicy:
160+
automated:
161+
prune: true
162+
selfHeal: true
163+
syncOptions:
164+
- CreateNamespace=true

‎examples/argocd/dev-readonly.yaml‎

Lines changed: 24 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -2,25 +2,30 @@
22
#
33
# Topology: Deployment (single) · isReadOnly · sidecar PostgreSQL · ephemeral storage · Varnish cache
44
#
5-
# Suitable for a development or evaluation instance on any Kubernetes cluster
6-
# (AKS, EKS, GKE, on-prem). Not suitable for production — storage is ephemeral
7-
# so the Lucene index is rebuilt from syndication feeds on every pod restart.
5+
# Not suitable for production — storage is ephemeral so the Lucene index is
6+
# rebuilt from syndication feeds on every pod restart.
87
#
9-
# Prerequisites on the cluster:
10-
# - Envoy Gateway installed and a GatewayClass named "envoy-gateway-class"
11-
# https://gateway.envoyproxy.io/docs/install/install-helm/
12-
# - (Optional) cert-manager for automatic TLS certificates
13-
# https://cert-manager.io/docs/installation/
8+
# Networking is intentionally omitted — hostnames and ingress/gateway config
9+
# are site-specific. Add your gateway or ingress block under ontoserver before
10+
# applying. See charts/ontoserver/README.md for Gateway API and Ingress options.
1411
#
15-
# Customise before applying:
16-
# 1. Replace <YOUR-HOSTNAME> with your actual DNS name (e.g. ontoserver-dev.example.com)
17-
# 2. Set quay.io credentials — either inline (not recommended for production)
18-
# or via a pre-created pull secret and ontoserver.deployment.imagePullSecrets
19-
# 3. Uncomment the syndication subscription block and point it at your feed
20-
# 4. Uncomment the TLS / cert-manager block if you want HTTPS
12+
# Image pull credentials
13+
# This Application expects a Kubernetes secret named quay-pull-secret of type
14+
# kubernetes.io/dockerconfigjson to exist in the ontoserver-dev namespace.
15+
# Create it via your own mechanism (ExternalSecret, SealedSecret, Vault, …)
16+
# and supply it as a second source in your App-of-Apps — see app-of-apps.yaml.
2117
#
22-
# Apply to your ArgoCD instance:
23-
# kubectl apply -f dev-readonly.yaml -n argocd
18+
# Can be referenced directly from an ArgoCD App-of-Apps:
19+
#
20+
# apiVersion: argoproj.io/v1alpha1
21+
# kind: Application
22+
# spec:
23+
# source:
24+
# repoURL: https://github.com/aehrc/ontoserver-deploy
25+
# path: examples/argocd
26+
# targetRevision: HEAD
27+
# directory:
28+
# include: 'dev-readonly.yaml'
2429

2530
apiVersion: argoproj.io/v1alpha1
2631
kind: Application
@@ -35,7 +40,6 @@ spec:
3540
server: https://kubernetes.default.svc
3641
namespace: ontoserver-dev
3742
sources:
38-
# ── ontoserver ─────────────────────────────────────────────────────────────
3943
- repoURL: https://github.com/aehrc/ontoserver-deploy
4044
targetRevision: HEAD
4145
path: charts/ontoserver
@@ -47,16 +51,10 @@ spec:
4751
type: single
4852
isReadOnly: true
4953
replicas: 1
54+
imagePullSecrets:
55+
- name: quay-pull-secret # must exist in ontoserver-dev — see app-of-apps.yaml
5056
db:
51-
enabled: true # sidecar PostgreSQL — no external database needed
52-
53-
imageCredentials:
54-
username: your-quay-username
55-
password: your-quay-password
56-
57-
serverName: <YOUR-HOSTNAME>
58-
hostNames:
59-
- <YOUR-HOSTNAME>
57+
enabled: true # sidecar PostgreSQL
6058

6159
timeZone: Australia/Brisbane
6260
language: en_AU
@@ -79,41 +77,15 @@ spec:
7977
cpu: "500m"
8078
memory: "512Mi"
8179

82-
# -l: hold the pod unready while the startup preload is running.
83-
# Traffic is allowed as soon as the preload finishes.
8480
healthCheckOption: -l
8581

86-
gateway:
87-
enabled: true
88-
className: envoy-gateway-class
89-
requestTimeout: 120s
90-
# Route all requests through the Varnish service deployed below.
91-
# The service name is always <ArgoCD-app-name>-varnish-service.
92-
backendServiceNameOverride: ontoserver-dev-varnish-service
93-
94-
# Uncomment to enable HTTPS via cert-manager:
95-
# tls:
96-
# enabled: true
97-
# certRef: ontoserver-dev-tls
98-
# certmanager:
99-
# enabled: true
100-
# email: your-email@example.com
101-
102-
# Configure what terminology to load on startup.
103-
# Add subscriptions to your syndication server here:
104-
# config:
105-
# ontoserver.syndication.plus.subscriptions.0.uri: https://your-syndication-server/fhir/SubscriptionDefinition/...
106-
107-
# ── ontoserver-extras (Varnish) ────────────────────────────────────────────
10882
- repoURL: https://github.com/aehrc/ontoserver-deploy
10983
targetRevision: HEAD
11084
path: charts/ontoserver-extras
11185
helm:
11286
valuesObject:
11387
varnish:
11488
enabled: true
115-
# 30 s grace period: serve stale content if ontoserver is temporarily
116-
# unavailable (e.g. during a pod restart).
11789
graceSeconds: 30
11890
cache:
11991
time200: 10m

0 commit comments

Comments
 (0)