The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-[Changelog](#changelog)
-[[Unreleased]](#unreleased)
-[Added](#added)
## [1.2.1]
## [Unreleased]
### Changed
- Moved TLS cert back out of configmap.yaml
- Updated documentation on how to add and update TLS certificates to encrypted secret.
- Fixed Big Bang version mismatch using semver in kustomization
- Fixed flux install instructions to use version rather than master. New versions of flux may not be backwards compatible.
- Cleaned up dev values.yaml
## [1.2.0]
### Changed
- Fix namespace error (istio-system) when deploying wildcard-cert
- Updated expired certificate for *.bigbang.dev
- Added default values for `istio.ingress.tls.*` to workaround Helm error on `nil` values.
- Updated [README.md](./README.md) for TLS cert
- Updated [README.md](./README.md) for sops key creation (Issue #8)
- Updated default BigBang release to 1.12.0 in kustomization.
## [1.1.1]
### Changed
- Security groups between internet facing network load balancer and agent's node ports updated to fix ingress
## [1.1.0]
### Added
- Upload of private SSH to encrypted S3 bucket
- Rename of `default` Kubernetes profile to environment name
- Change permissions of local Kubernetes config file to read/write of owner only
### Changed
- Migrated terraform classic load balancer to regular load balancer
## [1.0.1]
### Changed
- Terraform cache S3 bucket created off of name in environment
## [1.0.0]
### Added
...
...
@@ -28,3 +69,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
The `base/configmap.yaml` is setup to use the domain `bigbang.dev` by default. A demo TLS certificate is provided in `base/bigbang-dev-cert.yaml` to use. Certificates should be encrypted before pushing to Git since they contain both the public and private key.
@@ -95,8 +117,7 @@ You will need pull credentials for Iron Bank to retrieve images for Big Bang.
> Secrets can be specific to an environment if they are located in that environment's folder (e.g. `prod`, `dev`). Or, they can be shared between environments if located in the `base` directory.
``` shell
# Create a new encrypted secret to contain your pull credentials
cd base
# Edit the same secret holding your TLS certificates to add the pull credentials
When you save the file, it will automatically encrypt your secret using SOPS.
When you save the file, it will automatically re-encrypt your secret using SOPS.
```shell
# Save encrypted secrets into Git
# Configuration changes must be stored in Git to take affect
git add secrets.enc.yaml ../.sops.yaml
git commit -m"chore: added encrypted credentials"
git push --set-upstream origin template-demo
# Save pull credentials into Git
git add secrets.enc.yaml
git commit -m"chore: added iron bank pull credentials"
git push
```
> Your private key to decrypt these secrets is stored in your GPG key ring. You must **NEVER** export this key and commit it to your Git repository since this would comprimise your secrets.
...
...
@@ -173,7 +195,7 @@ Big Bang follows a [GitOps](https://www.weave.works/blog/what-is-gitops-really)
```shell
# The private key is not stored in Git (and should NEVER be stored there). We deploy it manually by exporting the key into a secret.
kubectl get deploy -o name -n flux-system | xargs -n1-t kubectl rollout status -n flux-system
...
...
@@ -232,7 +256,7 @@ Big Bang follows a [GitOps](https://www.weave.works/blog/what-is-gitops-really)
# If you are deployed on a remote host you will need to point "kiali.bigbang.dev" to your cluster master node via your /etc/hosts file
```
> If you cannot get to the main page of Kiali, it may be due to an expired certificate. Check the expiration of the certificate in `base/bigbang-dev-cert.yaml`.
> If you cannot get to the main page of Kiali, it may be due to an expired certificate. Check the expiration of the certificate in `base/configmap.yaml`.
> For troubleshooting deployment problems, refer to the [Big Bang](https://repo1.dsop.io/platform-one/big-bang/bigbang) documentation.
...
...
@@ -274,7 +298,7 @@ To minimize the risk of an unexpected deployment of a BigBang release, the BigBa
@@ -287,7 +311,7 @@ To minimize the risk of an unexpected deployment of a BigBang release, the BigBa
spec:
ref:
$patch:replace
semver: "1.8.0"
tag:"1.12.0"
```
To update `dev/kustomization.yaml`, you would create a `mergePatch` like the following:
...
...
@@ -303,7 +327,7 @@ patchesStrategicMerge:
interval: 1m
ref:
$patch: replace
semver: "1.9.0"
tag: "1.13.0"
```
> This does not update the kustomize base, but it is unusual for that to change.
...
...
@@ -312,13 +336,13 @@ Then, commit your change:
```shell
git add kustomization.yaml
git commit -m "feat(dev): update bigbang to 1.9.0"
git commit -m"feat(dev): update bigbang to 1.13.0"
git push
```
> It may take Big Bang up to 10 minutes to recognize your changes and start to deploy them. This is based on the interval set for polling. You can force Big Bang to recheck by running the [sync.sh](https://repo1.dsop.io/platform-one/big-bang/bigbang/-/blob/master/hack/sync.sh) script.
It is recommended that you track Big Bang releases using the version. However, you can use `tag` or `branch` in place of `semver` if needed. The kustomize base uses [Go-Getter](https://github.com/hashicorp/go-getter)'s syntax for the reference. The helm release (GitRepository) resource uses the [GitRepository CRD](https://toolkit.fluxcd.io/components/source/gitrepositories/#specification)'s syntax.
It is recommended that you track Big Bang releases using the version. However, you can use `branch` in place of `tag` if needed. The kustomize base uses [Go-Getter](https://github.com/hashicorp/go-getter)'s syntax for the reference. The helm release (GitRepository) resource uses the [GitRepository CRD](https://toolkit.fluxcd.io/components/source/gitrepositories/#specification)'s syntax.
When you are done testing, you can update the reference in `base` (and delete this setting in `dev`) to update Big Bang in all environments.
...
...
@@ -326,25 +350,36 @@ When you are done testing, you can update the reference in `base` (and delete th
### Update the domain
Big Bang deploys applications to `*.bigbang.dev` by default. You can override the `bigbang.dev` domain to your domain by updating `dev/configmap.yaml` and adding the following:
Big Bang deploys applications to `*.bigbang.dev` by default. You can override the `bigbang.dev` domain to your domain by updating `base/configmap.yaml` and adding the following:
```yaml
hostname:insert-your-domain-here
```
> NOTE: The `dev` template includes several overrides to minimize resource usage and increase polling time in a development environment. They are provided for convenience and are NOT required.
Commit your change:
In addition, you will need to update the TLS certificates by updating `base/secrets.enc.yaml`.
```shell
git add configmap.yaml
git commit -m "feat(dev): updated domain name"
git push
# Open and edit the encrypted file
sops base/secrets.enc.yaml
```
After saving the secrets.enc.yaml file, it will be automatically re-encrypted.
``` shell
# Push changes to Git
git add base/configmap.yaml base/secrets.enc.yaml
git commit -m"chore: updated domain and tls certificates"
git push
```
> If you have different certificates for `dev` and `prod`, you can also put the values in `dev/secrets.enc.yaml` or `prod/secrets.enc.yaml` respectively. The name of the secret must be `common-bb` if the secret is in the `base` folder or `environment-bb` if the secret is in the `dev` or `prod` folder. The `environment-bb` values take precedence over the `common-bb` values.
Make sure to add the file to `kustomization.yaml` as a resource if it is not already.
### Additional Big Bang values
For additional configuration options, refer to the [Big Bang](https://repo1.dsop.io/platform-one/big-bang/bigbang) and [Big Bang Package](https://repo1.dsop.io/platform-one/big-bang/apps) documentation.
For additional configuration options, refer to the [Big Bang](https://repo1.dsop.io/platform-one/big-bang/bigbang) and [Big Bang Package](https://repo1.dsop.io/platform-one/big-bang/apps) documentation. Big Bang values can be passed down in the `configmap.yaml` or `secrets.enc.yaml`. See the Kubernetes documentation on [configmaps](https://kubernetes.io/docs/concepts/configuration/configmap/) and [secrets](https://kubernetes.io/docs/concepts/configuration/secret/) for differences between the two. Secrets should always be SOPS encrypted before committing to Git.
> NOTE: The `dev` template includes several overrides in the `configmap.yaml` to minimize resource usage and increase polling time in a development environment. They are provided for convenience and are NOT required.
