refactor: move linkerd extra resources to own dir

Move extra Linkerd related resources (such as the trust anchor) to their
own directory at the root of this repository. Similarly values are now
obtained from a file within that directory instead of being passed
directly to the chart in the Application.

app-of-apps/templates/linkerd/application.yaml

@@ -0,0 +1,70 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: linkerd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: linkerd
+  sources:
+    - repoURL: {{ .Values.repository.url }}
+      targetRevision: HEAD
+      path: linkerd
+      ref: extraResources
+
+    - repoURL: https://helm.linkerd.io/stable
+      targetRevision: 1.8.0
+      chart: linkerd-crds
+
+    - repoURL: https://helm.linkerd.io/stable
+      targetRevision: 1.16.11
+      chart: linkerd-control-plane
+      helm:
+        valueFiles:
+          - $extraResources/linkerd/values.yaml
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: linkerd
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+
+  ignoreDifferences:
+    - group: ""
+      kind: Secret
+      name:  linkerd-proxy-injector-k8s-tls
+      jsonPointers:
+        - /data/tls.crt
+        - /data/tls.key
+    - group: ""
+      kind: Secret
+      name:  linkerd-sp-validator-k8s-tls
+      jsonPointers:
+        - /data/tls.crt
+        - /data/tls.key
+    - group: ""
+      kind: Secret
+      name:  linkerd-policy-validator-k8s-tls
+      jsonPointers:
+        - /data/tls.crt
+        - /data/tls.key
+    - group: admissionregistration.k8s.io/v1
+      kind: MutatingWebhookConfiguration
+      name:  linkerd-proxy-injector-webhook-config
+      jsonPointers:
+        - /webhooks/0/clientConfig/caBundle
+    - group: admissionregistration.k8s.io/v1
+      kind: ValidatingWebhookConfiguration
+      name:  linkerd-sp-validator-webhook-config
+      jsonPointers:
+        - /webhooks/0/clientConfig/caBundle
+    - group: admissionregistration.k8s.io/v1
+      kind: ValidatingWebhookConfiguration
+      name:  linkerd-policy-validator-webhook-config
+      jsonPointers:
+        - /webhooks/0/clientConfig/caBundle

app-of-apps/templates/linkerd/project.yaml

@@ -0,0 +1,27 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: linkerd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  description: A minimal service mesh for Kubernetes
+  sourceRepos:
+    - https://helm.linkerd.io/stable
+    - {{ .Values.repository.url }}
+  destinations:
+    - namespace: linkerd
+      server: https://kubernetes.default.svc
+  clusterResourceWhitelist:
+    - group: ''
+      kind: Namespace
+    - group: apiextensions.k8s.io
+      kind: CustomResourceDefinition
+    - group: rbac.authorization.k8s.io
+      kind: ClusterRole
+    - group: rbac.authorization.k8s.io
+      kind: ClusterRoleBinding
+    - group: admissionregistration.k8s.io
+      kind: ValidatingWebhookConfiguration
+    - group: admissionregistration.k8s.io
+      kind: MutatingWebhookConfiguration

app-of-apps/templates/linkerd/trust-anchor.yaml → linkerd/trust-anchor.yaml

@@ -1,13 +1,7 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: linkerd
----
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
 metadata:
   name: linkerd-trust-anchor
-  namespace: linkerd
 spec:
   encryptedData:
     tls.crt: AgCjgc4ngGbntjiFSqSo1bkzOkN8OVVcSwMZ1aCqYEavpX+H2OGbzzxnjOZNnK73s345nkduZ5S8GHj6h/jnv0CHPsM1Mk1fxCDcdhP4expTWAi6V9dKDqiRO183kC00pN4CC0hjcGtpU6wqmM0eStjOmnDdQEepkl9NQ6rSA3ctlKbY8KcjZSXHRZ3d6zYyq9hSgiy0tBA+WHFTb+jV/pTfat4JcSlgTe8hTPGpijHXyY7MPrRr3P9aw4Wjf/Pu3I/jYR06o4h1oTcfxLd+CTpmghiqvQj/uS/ZBNyEErOqX+rASQUv/saIwjtBto9/mHMsu/zETiId6KJIh2iZYKJ5foye6wBmRrjXvemH5l6UFj1GAFD4sOYn6tOP7stszHnbP4aQwTaLaGycXwTaheAvZU6sSN1WBlePgJvIXpGFqaYWbi/kaQRtw/JWaAbPWhTMxPsCDhgMBiE/5YCjIK3mXUECWYJkrGIzVTGTV9dSXTP6jGWvGRfnJvS42yAOAcUQHzjcMeObHl4+KOa+WaI6AGxlKI4bOdfu0GexyFjt02N5DPUJ/xKSIBGxGzEcbadNbCx+SR/qWttLW/8nuHbQ6ERr/DiRBlQ1gFe5XewhWzhpYP9MT62rLyvfTBvb9j7MmO/ZHCpq93uf+BMNkJnobfbfYTjFOEf1lrv5+0VgUWWr0azoUECbJso/f5djmojOILePRKkwevle2KwsdFE3n7W1ocIq31wsyqckxGRnW6duxsu1u/5PCwIkRwuWCE787M6aseEfO1vPKG7zSswcOG4KPMEhXUqzu/z8uJpUkvbEK9zQRHZeL9vyAiWsi45pHWrTh1lashemAXaicLD9WfN8GK5HfRfiZC0tAQMCAISrkn6I9b6jTXZymixOUvq/6MNJgqpG0Jj/wQipeTqKm/88kTWhdk2cHiGiTjq4jfTRdDuBfCYGFhWXYYW7DNT7oAv46rWfwOT3SwFBHJioXcQDj5AMi9eVATDSgdAYMAvD007QGIv693onwNKNfO0EwLkAaD5uKwEAvUhQw4PH+2z1KLgBCP9LbQW60SFhb5RB+PJq2WY1LVqv7PKZPm5mMp6xnOmEW+/mGn2QN/BxcLHOlMjeD2o0obhUG7XpNHH3whp3clFglpO+/62lDjdSZCGQ8eiB6q42iSAUXVG8La8eHjQLUB1WRJqxeSdzs7lj/rRpv8JKnQPGY2fRCxC0UkrocYgq61NY+lP2kMrp2xjbfKkG5YTN5+gzd9KUfcjMnUw/OcnGBKaklhzruRUOM+fhAiCzuG5zExCd4S4+aAHkq+/lnhblTuZlGsFoMF34IxfdzoThvmzT/lPrHUEtokhrEsyDr9HCpBlFOMHptX138wXT745o9Z7DXImLR1h48VU/I6emrLrqvQCN8p41NTtoTwD7wdMCun4ax4phDFf2OrTPPMivP04E1a1KVpWV5F8X8cfOw5rK+EKbPQG1Ii+irQ4KqcA/wlocaDJIJ26Zvp/Izg==
@@ -25,7 +19,6 @@ apiVersion: cert-manager.io/v1
 kind: Issuer
 metadata:
   name: linkerd-trust-anchor
-  namespace: linkerd
 spec:
   ca:
     secretName: linkerd-trust-anchor
@@ -34,7 +27,6 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   name: linkerd-identity-issuer
-  namespace: linkerd
 spec:
   secretName: linkerd-identity-issuer
   duration: 730h0m0s

linkerd/values.yaml

@@ -0,0 +1,15 @@
+identityTrustAnchorsPEM: |
+  -----BEGIN CERTIFICATE-----
+  MIIBjTCCATOgAwIBAgIQIvht8hmkwHraoV7BtVvwgjAKBggqhkjOPQQDAjAlMSMw
+  IQYDVQQDExpyb290LmxpbmtlcmQuY2x1c3Rlci5sb2NhbDAeFw0yNDA0MDMwMTIw
+  NTJaFw0yOTA0MDIwMTIwNTJaMCUxIzAhBgNVBAMTGnJvb3QubGlua2VyZC5jbHVz
+  dGVyLmxvY2FsMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE4EeQn8MUtU3UBWeW
+  dg3YaBncGPGAzO/hDh2zZ/uHkH47O8Q3V7lhwPUYDBG5WDe0DIad6Mz/4VgArI1L
+  0SI7BqNFMEMwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYD
+  VR0OBBYEFKrK/huKsXPuF5Eoqo8Zy97yI9+WMAoGCCqGSM49BAMCA0gAMEUCIBCj
+  JBT2hrqrkmgO1bXlTE6cnyvJw+/v/bcGuOSO90EyAiEA6QKMzMi5S1nybawDYTuC
+  xmzLng6l/Y18scw8DdDS8iQ=
+  -----END CERTIFICATE-----
+identity:
+  issuer:
+    scheme: kubernetes.io/tls