gitops 0.10.7__tar.gz → 0.11.1__tar.gz

gitops-0.11.1/.dockerignore

@@ -0,0 +1 @@
+*.tmp

gitops-0.11.1/.github/workflows/publish.yml

@@ -0,0 +1,77 @@
+name: Release
+on:
+  release:
+    types: [published]
+  workflow_dispatch: {}
+
+
+permissions:
+  actions: read # Read the metrics
+  contents: write # to be able to publish a GitHub release
+  issues: write # to be able to comment on released issues
+  pull-requests: write # to be able to comment on released pull requests
+  id-token: write # to enable use of OIDC for npm provenance / AWS
+
+env:
+  MISE_PYTHON_COMPILE: false
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+jobs:
+  push_to_registry:
+    name: Push Docker image to Docker Hub
+    runs-on: ubuntu-latest
+    steps:
+    - name: Configure AWS credentials
+      uses: aws-actions/configure-aws-credentials@v2
+      with:
+        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        aws-region: ap-southeast-2
+
+    - name: Docker Login to Amazon ECR
+      id: login-ecr
+      uses: aws-actions/amazon-ecr-login@v1
+
+    - name: Check out the repo
+      uses: actions/checkout@v3
+
+    - name: Pull latest image. Build docker image and publish it.
+      env:
+        latest_image: 305686791668.dkr.ecr.ap-southeast-2.amazonaws.com/gitops:latest
+        current_image: 305686791668.dkr.ecr.ap-southeast-2.amazonaws.com/gitops:${{github.event.release.tag_name}}
+      run: |
+        echo ${{secrets.CLUSTER_KEY}} | base64 -d > cluster.key
+        docker pull $latest_image
+        docker build -t $latest_image --cache-from $latest_image .
+        docker push $latest_image
+        docker tag  $latest_image $current_image
+        docker push $current_image
+        echo "Published image at: $current_image"
+
+  publish_helm_chart:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - name: Publish Helm charts
+      uses: stefanprodan/helm-gh-pages@master
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+
+  publish_to_pypi:
+    name: Publishes tag to pypi
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+
+    - uses: jdx/mise-action@v2
+      with:
+        install: true
+        cache: true
+        experimental: true
+
+    - run: |
+        mise run build
+      shell: bash
+
+    - name: Publish Pypi Package
+      uses: pypa/gh-action-pypi-publish@release/v1

gitops-0.11.1/.github/workflows/test.yml

@@ -0,0 +1,26 @@
+name: Test
+on:
+  push:
+    branches:
+    - develop
+  pull_request: ~
+
+permissions:
+  actions: read # Read the metrics
+  contents: write # to be able to publish a GitHub release
+  issues: write # to be able to comment on released issues
+  pull-requests: write # to be able to comment on released pull requests
+  id-token: write # to enable use of OIDC for npm provenance / AWS
+
+jobs:
+  ci:
+    uses: uptick/actions/.github/workflows/ci.yaml@main
+    secrets: inherit
+    with:
+      praise-on-fix: false
+      python-version: 3.12
+      mise: true
+      mise-install: true
+      command: |
+        mise run install
+        mise run ci

gitops-0.11.1/.gitignore

@@ -0,0 +1,14 @@
+**~
+build
+dist
+**/*.tmp
+**.egg-info
+**/__pycache__
+**.pyc
+cluster.key
+secrets.env
+**/.mypy_cache
+**/.pytest_cache
+.cache/
+.DS_Store
+.venv

gitops-0.11.1/.mise.toml

@@ -0,0 +1,50 @@
+[tools]
+python = { version = "3.12.1", venv = ".venv" }
+uv = { version = "0.4.7"}
+
+[env]
+_.python.venv = { path = "{{config_root}}/.venv", create = true }
+
+[tasks.start]
+run = "uvicorn --host 0.0.0.0 --port 8000 gitops_server.main:app --reload"
+
+[tasks."install"]
+run = ["uv sync --all-extras"]
+
+[tasks."lint"]
+run = ["uv run ruff check ."]
+
+[tasks."format"]
+run = ["uv run ruff format ."]
+
+[tasks."test"]
+run = ["uv run py.test"]
+
+[tasks."mypy"]
+run = ["uv run mypy ."]
+
+[tasks."ci"]
+depends = ["lint", "format", "test", "mypy"]
+
+[tasks."helm:lint"]
+run = "helm install --dry-run --debug -f charts/gitops/values.yaml debug charts/gitops"
+
+[tasks.release]
+description = "Bump release versions across all files"
+run = "python release.py"
+
+[tasks.start_otel]
+run = ["""
+OTEL_PYTHON_LOG_CORRELATION=true \
+OTEL_PYTHON_LOGGING_AUTO_INSTRUMENTATION_ENABLED=True \
+OTEL_LOGS_EXPORTER=none \
+OTEL_METRICS_EXPORTER=none \
+OTEL_TRACES_EXPORTER=console \
+OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317 \
+OTEL_RESOURCE_ATTRIBUTES=server_name=gitops \
+OTEL_SERVICE_NAME=gitops-test \
+OTEL_EXPORTER_OTLP_TIMEOUT=1 \
+uvicorn --host 0.0.0.0 --port 7000 gitops_server.main:app"""]
+
+[tasks.build]
+run = "uv build"

gitops-0.11.1/.pre-commit-config.yaml

@@ -0,0 +1,17 @@
+repos:
+- repo: https://github.com/charliermarsh/ruff-pre-commit
+  rev: v0.6.3
+  hooks:
+  - id: ruff
+    args:
+    - --fix
+- repo: https://github.com/charliermarsh/ruff-pre-commit
+  rev: v0.6.3
+  hooks:
+  - id: ruff-format
+- repo: https://github.com/commitizen-tools/commitizen
+  rev: v3.14.1
+  hooks:
+  - id: commitizen
+    stages:
+    - commit-msg

gitops-0.11.1/Dockerfile

@@ -0,0 +1,53 @@
+FROM python:3.12-slim
+
+##
+## Install kubectl and dependencies.
+##
+# RUN apk add -U openssl curl tar gzip bash ca-certificates && \
+# wget -q -O /etc/apk/keys/sgerrand.rsa.pub https://raw.githubusercontent.com/sgerrand/alpine-pkg-glibc/master/sgerrand.rsa.pub && \
+# wget https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.23-r3/glibc-2.23-r3.apk && \
+# apk add glibc-2.23-r3.apk && \
+# rm glibc-2.23-r3.apk
+# RUN curl -L -o /usr/bin/kubectl https://storage.googleapis.com/kubernetes-release/release/v1.8.0/bin/linux/amd64/kubectl && \
+# chmod +x /usr/bin/kubectl && \
+# kubectl version --client
+ENV KUBE_LATEST_VERSION="v1.21.3"
+ENV HELM_VERSION="v3.6.2" \
+    VIRTUAL_ENV="/app/.venv" \
+    PATH="/app/.venv/bin:$PATH"
+RUN apt-get update
+RUN apt-get install wget ca-certificates bash git git-crypt -y --no-install-recommends \
+    && wget -q https://storage.googleapis.com/kubernetes-release/release/${KUBE_LATEST_VERSION}/bin/linux/amd64/kubectl -O /usr/local/bin/kubectl \
+    && chmod +x /usr/local/bin/kubectl \
+    && wget -q https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz -O - | tar -xzO linux-amd64/helm > /usr/local/bin/helm \
+    && chmod +x /usr/local/bin/helm \
+    && helm plugin install https://github.com/jkroepke/helm-secrets --version v4.2.2 \
+    && wget -q https://github.com/mozilla/sops/releases/download/v3.7.3/sops-v3.7.3.linux.amd64 -O /usr/local/bin/sops \
+    && chmod +x  /usr/local/bin/sops \
+    && apt-get clean \
+    && apt-get -y autoremove \
+    && rm -rf /var/lib/apt/lists/* \
+    && rm -rf /var/cache/apt/ \
+    ENV SHELL=/bin/bash
+
+##
+## Install dependencies and copy GitOps server.
+##
+WORKDIR /app
+COPY --from=ghcr.io/astral-sh/uv:0.4.0 /uv /bin/uv
+COPY --link=true pyproject.toml uv.lock /app/
+RUN --mount=type=cache,target=/root/.cache/ \
+    (uv sync --frozen --no-install-project --extra server || uv sync --frozen --no-install-project --extra server)
+# Install dependencies
+RUN git config --global advice.detachedHead false
+
+COPY cluster.key /app/
+COPY gitops /app/gitops/
+COPY gitops_server /app/gitops_server
+
+ENV GIT_CRYPT_KEY_FILE=/app/cluster.key
+ENV PYTHONPATH="$PYTHONPATH:/app"
+ENV ACCESS_LOG=""
+
+
+CMD ["uvicorn", "--host", "0.0.0.0", "--port", "8000", "gitops_server.main:app", "--reload"]

gitops-0.11.1/PKG-INFO

@@ -0,0 +1,90 @@
+Metadata-Version: 2.3
+Name: gitops
+Version: 0.11.1
+Summary: Manage multiple apps across one or more k8s clusters.
+Author-email: Jarek Głowacki <jarekwg@gmail.com>
+License-File: LICENSE
+Requires-Python: >=3.12
+Requires-Dist: boto3==1.35.4
+Requires-Dist: colorama>=0.4.4
+Requires-Dist: dsnparse==0.2.1
+Requires-Dist: humanize>=3.5.0
+Requires-Dist: invoke>=2.2.0
+Requires-Dist: packaging>=24.1
+Requires-Dist: pyyaml>=6.0.2
+Requires-Dist: tabulate>=0.8.9
+Provides-Extra: server
+Requires-Dist: fastapi==0.109.2; extra == 'server'
+Requires-Dist: httpx<0.24.0,>=0.23.0; extra == 'server'
+Requires-Dist: kubernetes-asyncio>=25.1.2; extra == 'server'
+Requires-Dist: sentry-sdk>=1.3.0; extra == 'server'
+Requires-Dist: uptick-observability[fastapi]>=0.2.2; extra == 'server'
+Requires-Dist: uvicorn>=0.17.6; extra == 'server'
+Description-Content-Type: text/markdown
+
+# Gitops
+
+[![PyPI version](https://badge.fury.io/py/gitops.svg)](https://pypi.org/project/gitops/)
+[![versions](https://img.shields.io/pypi/pyversions/gitops.svg)](https://pypi.org/project/gitops/)
+[![Test](https://github.com/uptick/gitops/workflows/Test/badge.svg)](https://github.com/uptick/gitops/actions?query=workflow%3ATest)
+[![Lint](https://github.com/uptick/gitops/workflows/Lint/badge.svg)](https://github.com/uptick/gitops/actions?query=workflow%3ALint)
+
+Manage multiple apps across one or more k8s clusters.
+
+## Overview
+
+Keeping track of numerous of single-tenanted application deployments can quickly become a handful. Enter Gitops!
+
+The tool has two halves:
+
+- Gitops Server - an instance of this gets deployed to each of your kubernetes clusters, listening on changes made to your gitops cluster repo. The server's responsibility is to update the deployments on the cluster it lives on to match the app specifications in the repo.
+- Gitops CLI - this is a tool that you can use to interact comfortably with your cluster repo. It allows listing all deployed applications, what images they're presently running on, and which clusters they live on. It also provides numerous operations that can be applied to one or more apps at a time, such as bumping to a newer version of an image, or running a particular command across your app cohort.
+
+You can install the CLI tool with: `pip install gitops`
+
+Currently Kubernetes/Helm is the only supported cluster interface. All app deployments are performed as applications of Helm charts.
+
+## So what's a "cluster repo"?
+
+This is a git repository that you set up, where you list out all of your applications and how you want them deployed. It looks like this:
+
+<pre>
+.
++- apps
+   +- app_0
+      +- deployment.yml
+      +- secrets.yml
+   +- app_1
+      +- deployment.yml
+      +- secrets.yml
++- jobs
+</pre>
+
+## Installation
+
+Secrets should be placed in `secrets.env`. The example file `secrets.example.env` has the environment variables you will need to supply.
+
+Add `export GITOPS_APPS_DIRECTORY=~/<cluster-apps-folder>` to invoke gitops from any directory.
+
+Ensure that gitops has `edit` access to the namespace it is deploying to. An example RoleBinding is:
+
+```
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: gitops-role-binding
+  namespace: workforce
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: edit
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: gitops
+```
+
+# Making a release
+
+1. Run `make release` to set tag version the multiple required locations.
+2. Create a github release. Set the release tag to match the version number used. The github pipeline will do the following: Create a new version of the chart, create a docker image and release a new python library version to pypi.

gitops-0.11.1/README.md

@@ -0,0 +1,66 @@
+# Gitops
+
+[![PyPI version](https://badge.fury.io/py/gitops.svg)](https://pypi.org/project/gitops/)
+[![versions](https://img.shields.io/pypi/pyversions/gitops.svg)](https://pypi.org/project/gitops/)
+[![Test](https://github.com/uptick/gitops/workflows/Test/badge.svg)](https://github.com/uptick/gitops/actions?query=workflow%3ATest)
+[![Lint](https://github.com/uptick/gitops/workflows/Lint/badge.svg)](https://github.com/uptick/gitops/actions?query=workflow%3ALint)
+
+Manage multiple apps across one or more k8s clusters.
+
+## Overview
+
+Keeping track of numerous of single-tenanted application deployments can quickly become a handful. Enter Gitops!
+
+The tool has two halves:
+
+- Gitops Server - an instance of this gets deployed to each of your kubernetes clusters, listening on changes made to your gitops cluster repo. The server's responsibility is to update the deployments on the cluster it lives on to match the app specifications in the repo.
+- Gitops CLI - this is a tool that you can use to interact comfortably with your cluster repo. It allows listing all deployed applications, what images they're presently running on, and which clusters they live on. It also provides numerous operations that can be applied to one or more apps at a time, such as bumping to a newer version of an image, or running a particular command across your app cohort.
+
+You can install the CLI tool with: `pip install gitops`
+
+Currently Kubernetes/Helm is the only supported cluster interface. All app deployments are performed as applications of Helm charts.
+
+## So what's a "cluster repo"?
+
+This is a git repository that you set up, where you list out all of your applications and how you want them deployed. It looks like this:
+
+<pre>
+.
++- apps
+   +- app_0
+      +- deployment.yml
+      +- secrets.yml
+   +- app_1
+      +- deployment.yml
+      +- secrets.yml
++- jobs
+</pre>
+
+## Installation
+
+Secrets should be placed in `secrets.env`. The example file `secrets.example.env` has the environment variables you will need to supply.
+
+Add `export GITOPS_APPS_DIRECTORY=~/<cluster-apps-folder>` to invoke gitops from any directory.
+
+Ensure that gitops has `edit` access to the namespace it is deploying to. An example RoleBinding is:
+
+```
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: gitops-role-binding
+  namespace: workforce
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: edit
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: gitops
+```
+
+# Making a release
+
+1. Run `make release` to set tag version the multiple required locations.
+2. Create a github release. Set the release tag to match the version number used. The github pipeline will do the following: Create a new version of the chart, create a docker image and release a new python library version to pypi.

gitops-0.11.1/charts/gitops/.helmignore

@@ -0,0 +1,21 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj

gitops-0.11.1/charts/gitops/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+appVersion: "1.0"
+description: GitOps Server Helm chart.
+name: gitops
+version: 0.11.1

gitops-0.11.1/charts/gitops/README.md

@@ -0,0 +1,8 @@
+# GitOps Server Helm Chart
+
+# Releasing a new version
+
+1. Modify `pyproject.toml` and set `version = XXX`
+2. Modify `gitops/__init__.py` and set `__version__ = "XXX"`
+3. Modify `charts/gitops/Chart.yaml` and set `version: "XXX"`
+4. Create a github release. Set the release tag to match `XXX`. The github pipeline will do the following: Create a new version of the chart, create a docker image and release a new python library version to pypi.

gitops-0.11.1/charts/gitops/templates/_helpers.tpl

@@ -0,0 +1,43 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "uptick.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "uptick.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "uptick.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "uptick.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "uptick.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

gitops-0.11.1/charts/gitops/templates/certificate.yml

@@ -0,0 +1,13 @@
+{{- if .Values.certificate.install }}
+apiVersion: cert-manager.io/v1alpha2
+kind: Certificate
+metadata:
+  name:  {{ .Release.Name }}-cert
+spec:
+  secretName: gitops-cert-key
+  issuerRef:
+    name: gitops-issuer
+    kind: Issuer
+  dnsNames:
+  - gitops.{{ .Values.domain }}
+{{- end }}

gitops-0.11.1/charts/gitops/templates/deployment.yml

@@ -0,0 +1,103 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name:  {{ .Release.Name }}
+  labels:
+    app:  {{ .Release.Name }}
+    service: {{ .Release.Name }}-gitops
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app:  {{ .Release.Name }}
+        app.kubernetes.io/name: gitops-server
+        app.kubernetes.io/instance: gitops-server-{{ .Release.Name }}
+      annotations:
+        checksum/environment: {{ include (print $.Template.BasePath "/environment.yml") . | sha256sum }}
+        checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yml") . | sha256sum }}
+    spec:
+      serviceAccountName: {{ include "uptick.serviceAccountName" . }}
+      priorityClassName: system-node-critical
+      containers:
+      - name: gitops
+        image: {{ .Values.image }}
+        livenessProbe:
+          httpGet:
+            path: /livez
+            port: 8000
+          initialDelaySeconds: 5
+          failureThreshold: 5
+          timeoutSeconds: 10
+          periodSeconds: 30
+        ports:
+        - containerPort: 8000
+        resources:
+          requests:
+            memory: "200Mi"
+          limits:
+            memory: "1000Mi"
+        envFrom:
+        - configMapRef:
+            name: {{ .Release.Name }}-environment
+        env:
+          - name: SLACK_URL
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Release.Name }}-secret
+                key: SLACK_URL
+          - name: SLACK_TOKEN
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Release.Name }}-secret
+                key: SLACK_TOKEN
+          - name: SENTRY_DSN
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Release.Name }}-secret
+                key: SENTRY_DSN
+          - name: ACCOUNT_ID
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Release.Name }}-secret
+                key: ACCOUNT_ID
+          - name: GITHUB_OAUTH_TOKEN
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Release.Name }}-secret
+                key: GITHUB_OAUTH_TOKEN
+          - name: GITHUB_WEBHOOK_KEY
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Release.Name }}-secret
+                key: GITHUB_WEBHOOK_KEY
+        volumeMounts:
+        - name: git-crypt-key
+          mountPath: "/etc/gitops"
+          readOnly: true
+      volumes:
+      - name: git-crypt-key
+        secret:
+          secretName: {{ .Release.Name }}-secret
+          items:
+          - key: GIT_CRYPT_KEY
+            path: git_crypt_key
+      restartPolicy: Always
+
+{{- if .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.nodeSelector | indent 8 }}
+    {{- end }}
+    {{- if .Values.affinity }}
+      affinity:
+{{ toYaml .Values.affinity | indent 8 }}
+    {{- end }}
+    {{- if .Values.tolerations }}
+      tolerations:
+{{ toYaml .Values.tolerations | indent 6 }}
+    {{- end }}

gitops-0.11.1/charts/gitops/templates/environment.yml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-environment
+data:
+  {{- range $key, $val := .Values.environment }}
+  {{ $key }}: {{ $val | quote }}
+  {{- end }}

gitops-0.11.1/charts/gitops/templates/ingress.yml

@@ -0,0 +1,29 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ .Release.Name }}-ingress
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ .Release.Name }}
+  annotations:
+    {{- if .Values.certificate.install }}
+    certmanager.k8s.io/cluster-issuer: http-issuer
+    {{- end }}
+    ingress.kubernetes.io/ssl-redirect: "true"
+    {{- range $key, $value := .Values.ingress.annotations }}
+    {{ $key }}: {{ $value | quote }}
+    {{- end }}
+spec:
+  tls:
+  - secretName: gitops-cert-key
+  rules:
+  - host: {{ .Values.domain }}
+    http:
+      paths:
+      - backend:
+          service:
+            name: {{ .Release.Name }}-service
+            port:
+              number: 80
+        path: /
+        pathType: Prefix

gitops-0.11.1/charts/gitops/templates/issuer.yml

@@ -0,0 +1,16 @@
+{{- if .Values.certificate.install }}
+apiVersion: cert-manager.io/v1alpha2
+kind: Issuer
+metadata:
+  name: gitops-issuer
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: "info@uptickhq.com"
+    privateKeySecretRef:
+      name: gitops-issuer-key
+    solvers:
+    - http01:
+        ingress:
+          class: nginx
+{{- end }}

gitops-0.11.1/charts/gitops/templates/secrets.yml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-secret
+type: Opaque
+stringData:
+  ACCOUNT_ID: {{ .Values.secrets.ACCOUNT_ID | quote}}
+  SLACK_URL: {{ .Values.secrets.SLACK_URL| quote}}
+  GITHUB_OAUTH_TOKEN: {{ .Values.secrets.GITHUB_OAUTH_TOKEN| quote}}
+  GITHUB_WEBHOOK_KEY: {{ .Values.secrets.GITHUB_WEBHOOK_KEY| quote}}
+  SENTRY_DSN: {{ .Values.secrets.SENTRY_DSN| quote}}
+  SLACK_TOKEN: {{ .Values.secrets.SLACK_TOKEN| quote}}
+data:
+  GIT_CRYPT_KEY: {{ .Values.secrets.GIT_CRYPT_KEY | quote}}