feat(argocd): ApplicationSet for Security stack (#4740)

Signed-off-by: Nicolas Lamirault <nicolas.lamirault@gmail.com>

gitops/argocd/apps/k3s/homelab/security/annotations.yaml

@@ -35,3 +35,5 @@ annotations:
 fieldSpecs:
 - path: metadata/annotations
   create: true
+- path: spec/template/metadata/annotations
+  create: true

gitops/argocd/apps/k3s/homelab/security/applicationset.yaml

@@ -0,0 +1,101 @@
+---
+# Copyright (C) Nicolas Lamirault <nicolas.lamirault@gmail.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: security
+  labels:
+    app.kubernetes.io/name: security
+    app.kubernetes.io/instance: security-argocd-applicationset
+    app.kubernetes.io/component: argocd-applicationset
+    app.kubernetes.io/part-of: security-argocd
+spec:
+  generators:
+  - list:
+      elements:
+      - appName: authentik
+        namespace: identity
+        path: gitops/argocd/charts/identity/authentik
+        targetRevision: master
+      - appName: kyverno
+        namespace: kyverno
+        path: gitops/argocd/charts/kyverno/kyverno
+        targetRevision: master
+      - appName: kyverno-reporter
+        namespace: kyverno
+        path: gitops/argocd/charts/kyverno/kyverno-reporter
+        targetRevision: master
+      - appName: sbom-operator
+        namespace: security
+        path: gitops/argocd/charts/security/sbom-operator
+        targetRevision: master
+      - appName: trivy-operator
+        namespace: security
+        path: gitops/argocd/charts/security/trivy-operator
+        targetRevision: master
+      - appName: vault
+        namespace: security
+        path: gitops/argocd/charts/security/vault
+        targetRevision: master
+      - appName: tetragon
+        namespace: security
+        path: gitops/argocd/charts/security/tetragon
+        targetRevision: master
+  template:
+    metadata:
+      name: "{{appName}}"
+      annotations:
+        # https://argo-cd.readthedocs.io/en/stable/operator-manual/high_availability/#webhook-and-manifest-paths-annotation
+        argocd.argoproj.io/manifest-generate-paths: "/{{path}}"
+      finalizers:
+      - resources-finalizer.argocd.argoproj.io
+      labels:
+        app.kubernetes.io/name: "{{appName}}"
+        app.kubernetes.io/instance: "{{appName}}-argocd-application"
+        app.kubernetes.io/component: argocd-application
+        app.kubernetes.io/part-of: "{{appName}}-argocd"
+    spec:
+      destination:
+        namespace: "{{namespace}}"
+        server: https://kubernetes.default.svc
+      project: portefaix-k3s-homelab
+      source:
+        repoURL: https://github.com/portefaix/portefaix-kubernetes.git
+        targetRevision: "{{targetRevision}}"
+        path: "{{path}}"
+        helm:
+          valueFiles:
+          - values.yaml
+          - values-k3s-homelab.yaml
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+          allowEmpty: false
+        syncOptions:
+        - CreateNamespace=true
+        - Validate=false
+        - SkipDryRunOnMissingResource=true
+        - ApplyOutOfSyncOnly=true
+        # - ServerSideApply=true
+        # retry:
+        #   limit: 5
+        #   backoff:
+        #     duration: 5s
+        #     factor: 2
+        #     maxDuration: 3m0s

gitops/argocd/apps/k3s/homelab/security/kustomization.yaml

@@ -22,20 +22,4 @@ transformers:
 - annotations.yaml
 - labels.yaml
 resources:
-# Identity
-- authentik.yaml
-# Policies
-- kyverno.yaml
-- kyverno-reporter.yaml
-# - kube-bench-adapter.yaml
-# - kubewarden.yaml
-# SBOM
-- sbom-operator.yaml
-# TODO: wait for https://github.com/ckotzbauer/vulnerability-operator/issues/267
-# - vulnerability-operator.yaml
-- trivy-operator.yaml
-# Secrets
-- vault.yaml
-# Observability
-# - falco.yaml
-- tetragon.yaml
+- applicationset.yaml