الگوی برنامه‌های کاربردی: استراتژی‌های استقرار کارآمد Kubernetes با Terraform و ArgoCD

├── Makefile
├── README.md
├── plans
│   └── plan.tfplan
├── resources.helm.tf
├── resources.main.tf
├── resources.outputs.tf
├── resources.variables.tf
├── terraform.backend.tf
├── terraform.data.tf
├── terraform.locals.tf
└── terraform.provider.tf

module "network_security_group" {
  source              = "git::ssh://git@ssh.dev.azure.com/v3/////modules/network_security_group"
  name                = "rnd-nsg"
  location            = data.azurerm_resource_group.existing.location
  resource_group_name = data.azurerm_resource_group.existing.name

  rules = [
    {
      name                       = "nsg-rule-1"
      priority                   = 100
      direction                  = "Inbound"
      access                     = "Allow"
      protocol                   = "*"
      source_port_range          = "*"
      destination_port_range     = "*"
      source_address_prefix      = "*"
      destination_address_prefix = "*"
    },
    {
      name                       = "nsg-rule-2"
      priority                   = 101
      direction                  = "Outbound"
      access                     = "Allow"
      protocol                   = "*"
      source_port_range          = "*"
      destination_port_range     = "*"
      source_address_prefix      = "*"
      destination_address_prefix = "*"
    }
  ]
  depends_on = [data.azurerm_resource_group.existing]
  tags       = merge(var.tags)
}

module "virtual_network" {
  source              = "git::ssh://git@ssh.dev.azure.com/v3/////modules/virtual_network"
  name                = "rndvnet"
  location            = data.azurerm_resource_group.existing.location
  resource_group_name = data.azurerm_resource_group.existing.name
  address_space       = ["10.0.0.0/16"]
  depends_on          = [data.azurerm_resource_group.existing, module.network_security_group.this]
  tags                = merge(var.tags)
}

module "k8ssubnet" {
  source                     = "git::ssh://git@ssh.dev.azure.com/v3/////modules/subnet"
  name                       = "rndsubnetk8s"
  resource_group_name        = data.azurerm_resource_group.existing.name
  virtual_network_name       = module.virtual_network.virtual_network_name
  subnet_address_prefix      = ["10.0.1.0/24"]
  service_endpoints          = ["Microsoft.Storage", "Microsoft.Web"]
  delegation_name            = null
  service_delegation_name    = null
  service_delegation_actions = null
  depends_on                 = [data.azurerm_resource_group.existing, module.virtual_network.this, module.network_security_group.this]
}

module "podsubnet" {
  source                     = "git::ssh://git@ssh.dev.azure.com/v3/////modules/subnet"
  name                       = "rndsubnetpods"
  resource_group_name        = data.azurerm_resource_group.existing.name
  virtual_network_name       = module.virtual_network.virtual_network_name
  subnet_address_prefix      = ["10.0.2.0/24"]
  service_endpoints          = ["Microsoft.Storage"]
  delegation_name            = "aks-delegation"
  service_delegation_name    = "Microsoft.ContainerService/managedClusters"
  service_delegation_actions = ["Microsoft.Network/virtualNetworks/subnets/join/action"]
  depends_on                 = [data.azurerm_resource_group.existing, module.virtual_network.this, module.network_security_group.this]
}

module "subnet_nsg_association" {
  source                    = "git::ssh://git@ssh.dev.azure.com/v3/////modules/subnet_network_security_group_association"
  subnet_id                 = module.k8ssubnet.subnet_id
  network_security_group_id = module.network_security_group.id
  depends_on                = [data.azurerm_resource_group.existing, module.k8ssubnet.this, module.network_security_group.this]
}

module "container_registry" {
  source                           = "git::ssh://git@ssh.dev.azure.com/v3/////modules/container_registry"
  resource_group_name              = data.azurerm_resource_group.existing.name
  location                         = data.azurerm_resource_group.existing.location
  name                             = "rndacrteo"
  sku                              = "Standard"
  is_admin_enabled                 = true
  is_public_network_access_enabled = true
  depends_on                       = [data.azurerm_resource_group.existing]
  tags                             = merge(var.tags)
}

module "kubernetes" {
  source                               = "git::ssh://git@ssh.dev.azure.com/v3/////modules/kubernetes/kubernetes_cluster"
  name                                 = "k8s-cluster"
  resource_group_name                  = data.azurerm_resource_group.existing.name
  location                             = data.azurerm_resource_group.existing.location
  node_count                           = 1
  dns_prefix                           = "rndaks"
  vnet_subnet_id                       = module.k8ssubnet.subnet_id
  vm_size                              = "Standard_A2_v2"
  pod_subnet_id                        = module.podsubnet.subnet_id
  kubernetes_version                   = "1.30.0"
  is_role_based_access_control_enabled = true
  sku_tier                             = "Free"
  default_node_pool_name               = "k8spool"
  service_cidr                         = "10.1.0.0/16"
  dns_service_ip                       = "10.1.0.10"
  depends_on                           = [module.k8ssubnet.this, module.podsubnet.this]
}

module "k8s_role_assignment" {
  source                           = "git::ssh://git@ssh.dev.azure.com/v3/////modules/role_assignment"
  principal_id                     = module.kubernetes.kubelet_identity_object_id
  role_definition_name             = "AcrPull"
  scope                            = module.container_registry.id
  skip_service_principal_aad_check = true
}

module "ingress_nginx" {
  source = "git::ssh://git@ssh.dev.azure.com/v3/////modules/helm/helm_release"

  chart            = "ingress-nginx"
  name             = "ingress-nginx"
  create_namespace = true
  namespace        = "ingress-nginx"
  values = [
    <<-EOF
    controller:
      service:
        type: LoadBalancer
    EOF
  ]
  repository = "https://kubernetes.github.io/ingress-nginx"
  providers = {
    helm = helm.helmk8s
  }
  depends_on = [data.azurerm_kubernetes_cluster.cluster, module.kubernetes]
}

module "argocd" {
  source = "git::ssh://git@ssh.dev.azure.com/v3/////modules/helm/helm_release"

  chart            = "argo-cd"
  name             = "argocd"
  create_namespace = true
  namespace        = "argocd"
  values = [
    <<-EOF
    server:
      service:
        type: ClusterIP
      configs:
        params:
          "server.insecure": "true"
    admin:
        username: admin
    EOF
  ]
  repository = "https://argoproj.github.io/argo-helm"
  providers = {
    helm = helm.helmk8s
  }
  depends_on = [data.azurerm_kubernetes_cluster.cluster, module.kubernetes]
}

# Reset the admin secret by clearing existing password data
kubectl patch secret argocd-secret -n argocd -p '{"data": {"admin.password": null, "admin.passwordMtime": null}}'

##### Restart ArgoCD server to generate new password
kubectl delete pods -n argocd -l app.kubernetes.io/name=argocd-server

##### Retrieve the initial admin password
kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d

kubectl -n argocd edit configmap argocd-rbac-cm

policy.csv: |
# Grant full admin access to all applications
p, role:admin, applications, *, *, *

# Set default role to admin
policy.default: role:admin

# Restart ArgoCD to apply RBAC changes
kubectl -n argocd rollout restart deployment argocd-server

# Forward port to access ArgoCD server locally
kubectl port-forward service/argocd-server -n argocd 8888:443

##### Login using admin credentials
argocd login 127.0.0.1:8888 --username admin --password 

./project
├── Azure-Pipelines
│   ├── azure-pipelines.yml
│   ├── azure-pipelines2.yml
│   └── azure-pipelines3.yml
├── Docker
│   ├── Dockerfile.1
│   ├── Dockerfile.2
│   ├── Dockerfile.3
│   └── nginx.conf
├── demo-app
│   ├── README.md
│   ├── angular.json
│   ├── package.json
│   ├── public
│   │   └── favicon.ico
│   ├── src
│   │   ├── app
│   │   │   ├── app.component.css
│   │   │   ├── app.component.html
│   │   │   ├── app.component.spec.ts
│   │   │   ├── app.component.ts
│   │   │   ├── app.config.server.ts
│   │   │   ├── app.config.ts
│   │   │   └── app.routes.ts
│   │   ├── index.html
│   │   ├── main.server.ts
│   │   ├── main.ts
│   │   ├── server.ts
│   │   └── styles.css
│   ├── tsconfig.app.json
│   ├── tsconfig.json
│   └── tsconfig.spec.json
├── demo-app2
│   ├── README.md
│   ├── angular.json
│   ├── package.json
│   ├── public
│   │   └── favicon.ico
│   ├── src
│   │   ├── app
│   │   │   ├── app.component.css
│   │   │   ├── app.component.html
│   │   │   ├── app.component.spec.ts
│   │   │   ├── app.component.ts
│   │   │   ├── app.config.server.ts
│   │   │   ├── app.config.ts
│   │   │   └── app.routes.ts
│   │   ├── index.html
│   │   ├── main.server.ts
│   │   ├── main.ts
│   │   ├── server.ts
│   │   └── styles.css
│   ├── tsconfig.app.json
│   ├── tsconfig.json
│   └── tsconfig.spec.json
└── demo-app3
    ├── README.md
    ├── angular.json
    ├── package.json
    ├── public
    │   └── favicon.ico
    ├── src
    │   ├── app
    │   │   ├── app.component.css
    │   │   ├── app.component.html
    │   │   ├── app.component.spec.ts
    │   │   ├── app.component.ts
    │   │   ├── app.config.server.ts
    │   │   ├── app.config.ts
    │   │   └── app.routes.ts
    │   ├── index.html
    │   ├── main.server.ts
    │   ├── main.ts
    │   ├── server.ts
    │   └── styles.css
    ├── tsconfig.app.json
    ├── tsconfig.json
    └── tsconfig.spec.json

./demo-app-manifests
├── manifests
│   ├── argocd
│   │   ├── argocd-application-master
│   │   │   └── masterapp.yaml
│   │   └── argocd-applications
│   │       ├── demo-app-argoapp.yaml
│   │       ├── demo-app2-argoapp.yaml
│   │       └── demo-app3-argoapp.yaml
│   └── main
│       ├── demo-app
│       │   ├── deployment.yaml
│       │   └── service-ingress.yaml
│       ├── demo-app2
│       │   ├── deployment.yaml
│       │   └── service-ingress.yaml
│       └── demo-app3
│           ├── deployment.yaml
│           └── service-ingress.yaml
└── readmes
    ├── README.md
    └── argoCD.md

    argocd repo add git@ssh.dev.azure.com:v3/myteo/Cloud/demo-app-manifests \
    --ssh-private-key-path ~/.ssh/id_azure \
    --upsert

    argocd proj create demo-app-project \
    --dest https://kubernetes.default.svc,* \
    --description "demo app project" \
    --src git@ssh.dev.azure.com:v3/myteo/Cloud/demo-app-manifests \
    --upsert

    kubectl apply -f ./manifests/argocd/argocd-application-master/masterapp.yaml