Ajout du support des dépôts Helm OCI pour les apps d'infra, cert-manager et Kyverno

roles/cert-manager/tasks/main.yaml

@@ -19,11 +19,6 @@
     cm_mwhc.resources | length == 0 or
     dsc.certmanager.forcedInstall
   block:
-    - name: Add cert-manager helm repo
-      kubernetes.core.helm_repository:
-        name: jetstack
-        repo_url: "{{ dsc.certmanager.helmRepoUrl }}"
-        force_update: true
 
     # Installation des CRDs indépendamment du chart helm.
     # Recommandé en production.
@@ -42,20 +37,29 @@
     - name: Set path fact
       ansible.builtin.set_fact:
         path: "{{ role_path + '/templates/values' }}"
+        is_oci_repo: "{{ dsc.certmanager.helmRepoUrl.startswith('oci://') }}"
+        repo_name: "jetstack" # for HTTP repositories
+
+    - name: Add cert-manager Helm repo (HTTP repo only)
+      when: not is_oci_repo
+      kubernetes.core.helm_repository:
+        name: "{{ repo_name }}"
+        repo_url: "{{ dsc.certmanager.helmRepoUrl }}"
+        force_update: true
 
-    - name: Compute Cert-manager Helm values
+    - name: Compute cert-manager Helm values
       ansible.builtin.include_role:
         name: combine
       vars:
         combine_path: "{{ path }}"
         combine_user_values: "{{ dsc.certmanager['values'] }}"
         combine_dest_var: "cm_values"
 
-    - name: Deploy helm
+    - name: Deploy cert-manager Helm chart
       kubernetes.core.helm:
         #    force: true
         name: cert-manager
-        chart_ref: jetstack/cert-manager
+        chart_ref: "{{ is_oci_repo | ternary(dsc.certmanager.helmRepoUrl, repo_name) }}/cert-manager"
         chart_version: "{{ dsc.certmanager.chartVersion }}"
         release_namespace: cert-manager
         create_namespace: true

roles/cloudnativepg/tasks/main.yml

@@ -26,28 +26,31 @@
         kind: Namespace
         state: present
 
-    - name: Add CloudNativePG helm repo
+    - name: Set path and repo type facts
+      ansible.builtin.set_fact:
+        path: "{{ role_path + '/templates/values' }}"
+        is_oci_repo: "{{ dsc.cloudnativepg.operator.helmRepoUrl.startswith('oci://') }}"
+        repo_name: "cnpg" # for HTTP repositories
+
+    - name: Add CloudNativePG operator Helm repo (HTTP repo only)
+      when: not is_oci_repo
       kubernetes.core.helm_repository:
-        name: cnpg
+        name: "{{ repo_name }}"
         repo_url: "{{ dsc.cloudnativepg.operator.helmRepoUrl }}"
         force_update: true
 
-    - name: Set path fact
-      ansible.builtin.set_fact:
-        path: "{{ role_path + '/templates/values' }}"
-
-    - name: Compute Gitlab Helm values
+    - name: Compute GitLab Helm values
       ansible.builtin.include_role:
         name: combine
       vars:
         combine_path: "{{ path }}"
         combine_user_values: "{{ dsc.cloudnativepg.operator['values'] }}"
         combine_dest_var: "cnpg_values"
 
-    - name: Deploy CloudNativePG helm
+    - name: Deploy CloudNativePG operator Helm chart
       kubernetes.core.helm:
         name: cloudnative-pg
-        chart_ref: cnpg/cloudnative-pg
+        chart_ref: "{{ is_oci_repo | ternary(dsc.cloudnativepg.operator.helmRepoUrl, repo_name) }}/cloudnative-pg"
         chart_version: "{{ dsc.cloudnativepg.operator.chartVersion }}"
         release_namespace: "{{ dsc.cloudnativepg.namespace }}"
         values: "{{ cnpg_values }}"

roles/gitops/rendering-apps-files/tasks/preliminary.yml

@@ -1,25 +1,58 @@
 ---
-- name: Get Argo CD app version
+- name: Set repo type fact
+  ansible.builtin.set_fact:
+    is_oci_repo: "{{ dsc.argocdInfra.helmRepoUrl.startswith('oci://') }}"
+    repo_name: "argo" # for HTTP repositories
+
+- name: Get Argo CD infra app version (HTTP)
+  when: not is_oci_repo
   block:
-    - name: Add Argo CD helm repo
+    - name: Add Argo CD Helm repo (HTTP repo only)
       changed_when: false
       kubernetes.core.helm_repository:
-        name: argo
-        repo_url: "{{ dsc.argocd.helmRepoUrl }}"
+        name: "{{ repo_name }}"
+        repo_url: "{{ dsc.argocdInfra.helmRepoUrl }}"
         force_update: true
 
-    - name: Retrieve Argo CD Helm infos
+    - name: Retrieve Argo CD Helm chart info (HTTP)
+      changed_when: false
+      ansible.builtin.command: >-
+        helm search repo {{ repo_name }}/argo-cd --version "{{ dsc.argocdInfra.chartVersion }}"
+      register: argo_infos
+      ignore_errors: true
+
+    - name: Fail if chart version retrieval failed (HTTP)
+      when: argo_infos.rc != 0 or argo_infos.stdout == ""
+      ansible.builtin.fail:
+        msg: >-
+          Failed to retrieve Argo CD Helm chart version.
+          Check the repository URL ({{ dsc.argocdInfra.helmRepoUrl }}) and chart version ({{ dsc.argocdInfra.chartVersion }}).
+
+    - name: Set argo_app_version fact (HTTP)
+      ansible.builtin.set_fact:
+        argo_app_version: >-
+          {{ argo_infos.stdout | regex_search('v([0-9]+\\.[0-9]+\\.[0-9]+)') }}
+
+- name: Get Argo CD infra app version (OCI)
+  when: is_oci_repo
+  block:
+    - name: Retrieve Argo CD Helm chart info (OCI)
       changed_when: false
-      ansible.builtin.shell:
-        cmd: |
-          set -o pipefail
-          helm search repo -l argo --version "{{ dsc.argocd.chartVersion }}" | tail -n 1
-        executable: /bin/bash
+      ansible.builtin.command: >-
+        helm show chart {{ dsc.argocdInfra.helmRepoUrl }}/argo-cd --version "{{ dsc.argocdInfra.chartVersion }}"
       register: argo_infos
+      ignore_errors: true
+
+    - name: Fail if chart version retrieval failed (OCI)
+      when: argo_infos.rc != 0 or argo_infos.stdout == ""
+      ansible.builtin.fail:
+        msg: >-
+          Failed to retrieve Argo CD Helm chart version.
+          Check the repository URL ({{ dsc.argocdInfra.helmRepoUrl }}) and chart version ({{ dsc.argocdInfra.chartVersion }}).
 
-    - name: Set argo_app_version fact
+    - name: Set argo_app_version fact (OCI)
       ansible.builtin.set_fact:
-        argo_app_version: "{{ argo_infos.stdout | regex_search('v([0-9]*\\.)+([0-9]+)') }}"
+        argo_app_version: "{{ argo_infos.stdout | regex_search('(?<=appVersion: )v([0-9]+\\.[0-9]+\\.[0-9]+)') }}"
 
 - name: Find argo crd existence
   kubernetes.core.k8s_info:
@@ -41,7 +74,7 @@
   ansible.builtin.set_fact:
     path: "{{ role_path + '/gitlab/values' }}"
 
-- name: Compute Gitlab Helm values
+- name: Compute GitLab Helm values
   ansible.builtin.include_role:
     name: combine
   vars:

roles/gitops/rendering-apps-files/tasks/template.yml

@@ -98,26 +98,39 @@
 - name: Values rendering
   when: install_enabled
   block:
+    - name: Check for cpin-ansible-job template file existence
+      ansible.builtin.stat:
+        path: "{{ source_path }}/values/200-ansible-job.j2"
+      register: ansible_job_template
+
     - name: Compute "{{ item.1.argocd_app }}" Helm values
       ansible.builtin.include_role:
         name: combine
       vars:
         combine_path: "{{ source_path }}/values"
         combine_user_values: >-
           {%- set app_name = item.1.argocd_app -%}
+          {%- set app_values = dsc[app_name].get('values', {}) -%}
+          {%- set cnpg_values = dsc[app_name].get('cnpg', {}).get('values', {}) -%}
+          {%- set cluster_values = {} -%}
           {%- if app_name == 'gitlab' -%}
-            {%- if 'cnpg' in dsc.gitlab and 'values' in dsc.gitlab['cnpg'] -%}
-          {{ {} | combine({app_name: dsc.gitlabOperator['values'], 'cluster': dsc[app_name]['cnpg']['values']}) }}
-            {%- else -%}
-          {{ {} | combine({app_name: dsc.gitlabOperator['values']}) }}
-            {%- endif -%}
+            {%- set app_values = dsc.gitlabOperator.get('values', {}) -%}
+            {%- set cluster_values = dsc.gitlab.get('cnpg', {}).get('values', {}) -%}
           {%- elif app_name == 'cloudnativepg' -%}
-          {{ {} | combine({app_name: dsc[app_name]['operator']['values']}) }}
-          {%- elif 'cnpg' in dsc[app_name] and 'values' in dsc[app_name]['cnpg'] -%}
-          {{ {} | combine({app_name: dsc[app_name]['values'], 'cluster': dsc[app_name]['cnpg']['values']}) }}
-          {%- else -%}
-          {{ {} | combine({app_name: dsc[app_name]['values']}) }}
+            {%- set app_values = dsc[app_name].get('operator', {}).get('values', {}) -%}
+          {%- endif -%}
+
+          {%- set result = {} -%}
+          {%- if app_values -%}
+            {%- set _ = result.update({app_name: app_values}) -%}
+          {%- endif -%}
+          {%- if cnpg_values or cluster_values -%}
+            {%- set _ = result.update({'cluster': cnpg_values | combine(cluster_values)}) -%}
+          {%- endif -%}
+          {%- if dsc.get('cpnAnsibleJob', {}).get('values') is defined and ansible_job_template.stat.exists -%}
+            {%- set _ = result.update({'cpn-ansible-job': dsc.cpnAnsibleJob['values']}) -%}
           {%- endif -%}
+          {{ result }}
         combine_dest_var: "{{ item.1.argocd_app }}_values"
 
     - name: Render "{{ item.1.argocd_app }}" values and write values.yaml to destination

roles/infra/argocd-infra/tasks/main.yaml

@@ -68,6 +68,7 @@
 # OpenShift CRB
 
 - name: Argo CD OpenShift scc crb
+  when: dsc.global.platform == "openshift"
   kubernetes.core.k8s:
     definition:
       apiVersion: rbac.authorization.k8s.io/v1
@@ -96,29 +97,63 @@
           namespace: "{{ dsc.argocdInfra.namespace }}"
           name: "{{ dsc_name }}-argo-infra-redis-ha-haproxy"
 
-- name: Add Argo CD helm repo
-  changed_when: false
-  kubernetes.core.helm_repository:
-    name: argo
-    repo_url: "{{ dsc.argocdInfra.helmRepoUrl }}"
-    force_update: true
+- name: Set repo type facts
+  ansible.builtin.set_fact:
+    is_oci_repo: "{{ dsc.argocdInfra.helmRepoUrl.startswith('oci://') }}"
+    repo_name: argo
 
-# Vault plugin setup
+# Retreive Argo CD app version
 
-- name: Get Argo CD infra app version
+- name: Get Argo CD infra app version (HTTP)
+  when: not is_oci_repo
   block:
-    - name: Retrieve Argo CD Helm infos
+    - name: Add Argo CD Helm repo (HTTP repo only)
       changed_when: false
-      ansible.builtin.shell:
-        cmd: |
-          set -o pipefail
-          helm search repo -l argo --version "{{ dsc.argocdInfra.chartVersion }}" | tail -n 1
-        executable: /bin/bash
+      kubernetes.core.helm_repository:
+        name: "{{ repo_name }}"
+        repo_url: "{{ dsc.argocdInfra.helmRepoUrl }}"
+        force_update: true
+    - name: Retrieve Argo CD Helm chart info (HTTP)
+      changed_when: false
+      ansible.builtin.command: >-
+        helm search repo {{ repo_name }}/argo-cd --version "{{ dsc.argocdInfra.chartVersion }}"
       register: argo_infos
+      ignore_errors: true
 
-    - name: Set argo_app_version fact
+    - name: Fail if chart version retrieval failed (HTTP)
+      when: argo_infos.rc != 0 or argo_infos.stdout == ""
+      ansible.builtin.fail:
+        msg: >-
+          Failed to retrieve Argo CD Helm chart version.
+          Check the repository URL ({{ dsc.argocdInfra.helmRepoUrl }}) and chart version ({{ dsc.argocdInfra.chartVersion }}).
+
+    - name: Set argo_app_version fact (HTTP)
       ansible.builtin.set_fact:
-        argo_app_version: "{{ argo_infos.stdout | regex_search('v([0-9]*\\.)+([0-9]+)') }}"
+        argo_app_version: >-
+          {{ argo_infos.stdout | regex_search('v([0-9]+\\.[0-9]+\\.[0-9]+)') }}
+
+- name: Get Argo CD infra app version (OCI)
+  when: is_oci_repo
+  block:
+    - name: Retrieve Argo CD Helm chart info (OCI)
+      changed_when: false
+      ansible.builtin.command: >-
+        helm show chart {{ dsc.argocdInfra.helmRepoUrl }}/argo-cd --version "{{ dsc.argocdInfra.chartVersion }}"
+      register: argo_infos
+      ignore_errors: true
+
+    - name: Fail if chart version retrieval failed (OCI)
+      when: argo_infos.rc != 0 or argo_infos.stdout == ""
+      ansible.builtin.fail:
+        msg: >-
+          Failed to retrieve Argo CD Helm chart version.
+          Check the repository URL ({{ dsc.argocdInfra.helmRepoUrl }}) and chart version ({{ dsc.argocdInfra.chartVersion }}).
+
+    - name: Set argo_app_version fact (OCI)
+      ansible.builtin.set_fact:
+        argo_app_version: "{{ argo_infos.stdout | regex_search('(?<=appVersion: )v([0-9]+\\.[0-9]+\\.[0-9]+)') }}"
+
+# Vault plugin setup
 
 - name: Deploy Argo CD infra Vault plugin config
   kubernetes.core.k8s:
@@ -152,8 +187,7 @@
         missing_secret: false
 
     - name: Update missing_secret fact
-      when:
-        (helm_docker_registry_secret.resources | length == 0) or
+      when: (helm_docker_registry_secret.resources | length == 0) or
         (oci_dockerhub_creds.resources | length == 0)
       ansible.builtin.set_fact:
         missing_secret: true
@@ -217,10 +251,10 @@
     combine_user_values: "{{ dsc.argocdInfra['values'] }}"
     combine_dest_var: "argo_values"
 
-- name: Deploy helm
+- name: Deploy Argo CD Helm chart
   kubernetes.core.helm:
     name: "{{ dsc_name }}-argo-infra"
-    chart_ref: argo/argo-cd
+    chart_ref: "{{ is_oci_repo | ternary(dsc.argocdInfra.helmRepoUrl, repo_name) }}/argo-cd"
     chart_version: "{{ dsc.argocdInfra.chartVersion }}"
     release_namespace: "{{ dsc.argocdInfra.namespace }}"
     create_namespace: true

roles/infra/keycloak-infra/tasks/main.yml

@@ -148,9 +148,19 @@
 
 # Deploy Keycloak
 
-- name: Set path fact
+- name: Set path and repo type facts
   ansible.builtin.set_fact:
     path: "{{ role_path + '/templates/values' }}"
+    is_oci_repo: "{{ dsc.keycloakInfra.helmRepoUrl.startswith('oci://') }}"
+    repo_name: "hashicorp" # for HTTP repositories
+
+- name: Add Keycloak Helm repo (HTTP repo only)
+  when: not is_oci_repo
+  changed_when: false
+  kubernetes.core.helm_repository:
+    name: "{{ repo_name }}"
+    repo_url: "{{ dsc.keycloakInfra.helmRepoUrl }}"
+    force_update: true
 
 - name: Compute Keycloak Helm values
   ansible.builtin.include_role:
@@ -160,9 +170,9 @@
     combine_user_values: "{{ dsc.keycloakInfra['values'] }}"
     combine_dest_var: "kc_values"
 
-- name: Deploy helm
+- name: Deploy Keycloak Helm chart
   kubernetes.core.helm:
-    chart_ref: "{{ dsc.keycloakInfra.helmRepoUrl }}/keycloak"
+    chart_ref: "{{ is_oci_repo | ternary(dsc.keycloakInfra.helmRepoUrl, repo_name) }}/keycloak"
     chart_version: "{{ dsc.keycloakInfra.chartVersion }}"
     release_namespace: "{{ dsc.keycloakInfra.namespace }}"
     release_name: keycloak