kustomization.yaml

kind: Kustomization
apiVersion: kustomize.config.k8s.io/v1beta1

resources:
- k8s-configs

patchesStrategicMerge:

- |-
  apiVersion: v1
  kind: ConfigMap
  metadata:
   name: pingaccess-was-admin-environment-variables
  data:
    PING_IDENTITY_DEVOPS_USER: ${PING_IDENTITY_DEVOPS_USER}
    PING_IDENTITY_DEVOPS_KEY: ${PING_IDENTITY_DEVOPS_KEY}
    PA_WAS_ADMIN_PUBLIC_HOSTNAME: pingaccess-was-admin.${TENANT_DOMAIN}
    PA_WAS_ENGINE_PUBLIC_HOSTNAME: pingaccess-was.${TENANT_DOMAIN}
    PA_ADMIN_PUBLIC_HOSTNAME: pingaccess-admin.${TENANT_DOMAIN}
    PA_ADMIN_API_PUBLIC_HOSTNAME: pingaccess-admin-api.${TENANT_DOMAIN}
    PA_ENGINE_PUBLIC_HOSTNAME: pingaccess.${TENANT_DOMAIN}
    PF_ADMIN_PUBLIC_HOSTNAME: pingfederate-admin.${TENANT_DOMAIN}
    PF_ADMIN_API_PUBLIC_HOSTNAME: pingfederate-admin-api.${TENANT_DOMAIN}
    PF_ENGINE_PUBLIC_HOSTNAME: pingfederate.${TENANT_DOMAIN}
    PROMETHEUS_PUBLIC_HOSTNAME: prometheus.${TENANT_DOMAIN}
    GRAFANA_PUBLIC_HOSTNAME: monitoring.${TENANT_DOMAIN}
    KIBANA_PUBLIC_HOSTNAME: logs.${TENANT_DOMAIN}
    ARGOCD_PUBLIC_HOSTNAME: argocd.${TENANT_DOMAIN}
    HEALTHCHECK_HTTPBIN_PA_WAS_PUBLIC_HOSTNAME: healthcheck-httpbin-pa-was.${TENANT_DOMAIN}
    HEALTHCHECK_HTTPBIN_PA_PUBLIC_HOSTNAME: healthcheck-httpbin-pa.${TENANT_DOMAIN}
    PC_ADMIN_PUBLIC_HOSTNAME: pingcentral-admin.${TENANT_DOMAIN}
    BACKUP_URL: ${BACKUP_URL}
    REGION: ${REGION}
- |-
  apiVersion: v1
  kind: ConfigMap
  metadata:
   name: pingaccess-was-environment-variables
  data:
    PING_IDENTITY_DEVOPS_USER: ${PING_IDENTITY_DEVOPS_USER}
    PING_IDENTITY_DEVOPS_KEY: ${PING_IDENTITY_DEVOPS_KEY}
    PA_WAS_ADMIN_PUBLIC_HOSTNAME: pingaccess-was-admin.${TENANT_DOMAIN}
    PA_WAS_ENGINE_PUBLIC_HOSTNAME: pingaccess-was.${TENANT_DOMAIN}
    PA_ADMIN_PUBLIC_HOSTNAME: pingaccess-admin.${TENANT_DOMAIN}
    PA_ADMIN_API_PUBLIC_HOSTNAME: pingaccess-admin-api.${TENANT_DOMAIN}
    PA_ENGINE_PUBLIC_HOSTNAME: pingaccess.${TENANT_DOMAIN}
    PF_ADMIN_PUBLIC_HOSTNAME: pingfederate-admin.${TENANT_DOMAIN}
    PF_ADMIN_API_PUBLIC_HOSTNAME: pingfederate-admin-api.${TENANT_DOMAIN}
    PF_ENGINE_PUBLIC_HOSTNAME: pingfederate.${TENANT_DOMAIN}
    PROMETHEUS_PUBLIC_HOSTNAME: prometheus.${TENANT_DOMAIN}
    GRAFANA_PUBLIC_HOSTNAME: monitoring.${TENANT_DOMAIN}
    KIBANA_PUBLIC_HOSTNAME: logs.${TENANT_DOMAIN}
    ARGOCD_PUBLIC_HOSTNAME: argocd.${TENANT_DOMAIN}
    HEALTHCHECK_HTTPBIN_PA_WAS_PUBLIC_HOSTNAME: healthcheck-httpbin-pa-was.${TENANT_DOMAIN}
    HEALTHCHECK_HTTPBIN_PA_PUBLIC_HOSTNAME: healthcheck-httpbin-pa.${TENANT_DOMAIN}
    PC_ADMIN_PUBLIC_HOSTNAME: pingcentral-admin.${TENANT_DOMAIN}
    BACKUP_URL: ${BACKUP_URL}
    REGION: ${REGION}
- |-
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: pingaccess-admin-environment-variables
  data:
    PING_IDENTITY_DEVOPS_USER: ${PING_IDENTITY_DEVOPS_USER}
    PING_IDENTITY_DEVOPS_KEY: ${PING_IDENTITY_DEVOPS_KEY}
    BACKUP_URL: ${BACKUP_URL}
    PA_WAS_ADMIN_PUBLIC_HOSTNAME: pingaccess-was-admin.${TENANT_DOMAIN}
    PA_WAS_ENGINE_PUBLIC_HOSTNAME: pingaccess-was.${TENANT_DOMAIN}
    PA_ADMIN_PUBLIC_HOSTNAME: pingaccess-admin.${TENANT_DOMAIN}
    PA_ADMIN_API_PUBLIC_HOSTNAME: pingaccess-admin-api.${TENANT_DOMAIN}
    PA_ENGINE_PUBLIC_HOSTNAME: pingaccess.${TENANT_DOMAIN}
    PF_ADMIN_PUBLIC_HOSTNAME: pingfederate-admin.${TENANT_DOMAIN}
    PF_ADMIN_API_PUBLIC_HOSTNAME: pingfederate-admin-api.${TENANT_DOMAIN}
    PF_ENGINE_PUBLIC_HOSTNAME: pingfederate.${TENANT_DOMAIN}
    REGION: ${REGION}
- |-
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: pingaccess-environment-variables
  data:
    PING_IDENTITY_DEVOPS_USER: ${PING_IDENTITY_DEVOPS_USER}
    PING_IDENTITY_DEVOPS_KEY: ${PING_IDENTITY_DEVOPS_KEY}
    BACKUP_URL: ${BACKUP_URL}
    PA_WAS_ADMIN_PUBLIC_HOSTNAME: pingaccess-was-admin.${TENANT_DOMAIN}
    PA_WAS_ENGINE_PUBLIC_HOSTNAME: pingaccess-was.${TENANT_DOMAIN}
    PA_ADMIN_PUBLIC_HOSTNAME: pingaccess-admin.${TENANT_DOMAIN}
    PA_ADMIN_API_PUBLIC_HOSTNAME: pingaccess-admin-api.${TENANT_DOMAIN}
    PA_ENGINE_PUBLIC_HOSTNAME: pingaccess.${TENANT_DOMAIN}
    PF_ADMIN_PUBLIC_HOSTNAME: pingfederate-admin.${TENANT_DOMAIN}
    PF_ADMIN_API_PUBLIC_HOSTNAME: pingfederate-admin-api.${TENANT_DOMAIN}
    PF_ENGINE_PUBLIC_HOSTNAME: pingfederate.${TENANT_DOMAIN}
    REGION: ${REGION}
- |-
  apiVersion: v1
  kind: ConfigMap
  metadata:
   name: pingcentral-environment-variables
  data:
    PING_IDENTITY_DEVOPS_USER: ${PING_IDENTITY_DEVOPS_USER}
    PING_IDENTITY_DEVOPS_KEY: ${PING_IDENTITY_DEVOPS_KEY}
    PA_WAS_ADMIN_PUBLIC_HOSTNAME: pingaccess-was-admin.${TENANT_DOMAIN}
    PA_WAS_ENGINE_PUBLIC_HOSTNAME: pingaccess-was.${TENANT_DOMAIN}
    PA_ADMIN_PUBLIC_HOSTNAME: pingaccess-admin.${TENANT_DOMAIN}
    PA_ADMIN_API_PUBLIC_HOSTNAME: pingaccess-admin-api.${TENANT_DOMAIN}
    PA_ENGINE_PUBLIC_HOSTNAME: pingaccess.${TENANT_DOMAIN}
    PF_ADMIN_PUBLIC_HOSTNAME: pingfederate-admin.${TENANT_DOMAIN}
    PF_ADMIN_API_PUBLIC_HOSTNAME: pingfederate-admin-api.${TENANT_DOMAIN}
    PF_ENGINE_PUBLIC_HOSTNAME: pingfederate.${TENANT_DOMAIN}
    PROMETHEUS_PUBLIC_HOSTNAME: prometheus.${TENANT_DOMAIN}
    GRAFANA_PUBLIC_HOSTNAME: monitoring.${TENANT_DOMAIN}
    KIBANA_PUBLIC_HOSTNAME: logs.${TENANT_DOMAIN}
    ARGOCD_PUBLIC_HOSTNAME: argocd.${TENANT_DOMAIN}
    HEALTHCHECK_HTTPBIN_PA_WAS_PUBLIC_HOSTNAME: healthcheck-httpbin-pa-was.${TENANT_DOMAIN}
    HEALTHCHECK_HTTPBIN_PA_PUBLIC_HOSTNAME: healthcheck-httpbin-pa.${TENANT_DOMAIN}
    BACKUP_URL: ${BACKUP_URL}
    REGION: ${REGION}
- |-
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: pingdirectory-environment-variables
  data:
    PING_IDENTITY_DEVOPS_USER: ${PING_IDENTITY_DEVOPS_USER}
    PING_IDENTITY_DEVOPS_KEY: ${PING_IDENTITY_DEVOPS_KEY}
    PA_WAS_ADMIN_PUBLIC_HOSTNAME: pingaccess-was-admin.${TENANT_DOMAIN}
    PA_WAS_ENGINE_PUBLIC_HOSTNAME: pingaccess-was.${TENANT_DOMAIN}
    PA_ADMIN_PUBLIC_HOSTNAME: pingaccess-admin.${TENANT_DOMAIN}
    PA_ADMIN_API_PUBLIC_HOSTNAME: pingaccess-admin-api.${TENANT_DOMAIN}
    PA_ENGINE_PUBLIC_HOSTNAME: pingaccess.${TENANT_DOMAIN}
    PF_ADMIN_PUBLIC_HOSTNAME: pingfederate-admin.${TENANT_DOMAIN}
    PF_ADMIN_API_PUBLIC_HOSTNAME: pingfederate-admin-api.${TENANT_DOMAIN}
    PF_ENGINE_PUBLIC_HOSTNAME: pingfederate.${TENANT_DOMAIN}
    PD_DELEGATOR_PUBLIC_HOSTNAME: pingdelegator.${TENANT_DOMAIN}
    PD_HTTP_PUBLIC_HOSTNAME: pingdirectory.${TENANT_DOMAIN}
    REGION: ${REGION}
- |-
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: pingdelegator-environment-variables
  data:
    PING_IDENTITY_DEVOPS_USER: ${PING_IDENTITY_DEVOPS_USER}
    PING_IDENTITY_DEVOPS_KEY: ${PING_IDENTITY_DEVOPS_KEY}
    PA_WAS_ADMIN_PUBLIC_HOSTNAME: pingaccess-was-admin.${TENANT_DOMAIN}
    PA_WAS_ENGINE_PUBLIC_HOSTNAME: pingaccess-was.${TENANT_DOMAIN}
    PA_ADMIN_PUBLIC_HOSTNAME: pingaccess-admin.${TENANT_DOMAIN}
    PA_ADMIN_API_PUBLIC_HOSTNAME: pingaccess-admin-api.${TENANT_DOMAIN}
    PA_ENGINE_PUBLIC_HOSTNAME: pingaccess.${TENANT_DOMAIN}
    PF_ADMIN_PUBLIC_HOSTNAME: pingfederate-admin.${TENANT_DOMAIN}
    PF_ADMIN_API_PUBLIC_HOSTNAME: pingfederate-admin-api.${TENANT_DOMAIN}
    PF_ENGINE_PUBLIC_HOSTNAME: pingfederate.${TENANT_DOMAIN}
    PD_DELEGATOR_PUBLIC_HOSTNAME: pingdelegator.${TENANT_DOMAIN}
    PD_HTTP_PUBLIC_HOSTNAME: pingdirectory.${TENANT_DOMAIN}
    REGION: ${REGION}
- |-
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: pingfederate-admin-environment-variables
  data:
    PING_IDENTITY_DEVOPS_USER: ${PING_IDENTITY_DEVOPS_USER}
    PING_IDENTITY_DEVOPS_KEY: ${PING_IDENTITY_DEVOPS_KEY}
    BACKUP_URL: ${BACKUP_URL}
    PA_WAS_ADMIN_PUBLIC_HOSTNAME: pingaccess-was-admin.${TENANT_DOMAIN}
    PA_WAS_ENGINE_PUBLIC_HOSTNAME: pingaccess-was.${TENANT_DOMAIN}
    PA_ADMIN_PUBLIC_HOSTNAME: pingaccess-admin.${TENANT_DOMAIN}
    PA_ADMIN_API_PUBLIC_HOSTNAME: pingaccess-admin-api.${TENANT_DOMAIN}
    PA_ENGINE_PUBLIC_HOSTNAME: pingaccess.${TENANT_DOMAIN}
    PF_ADMIN_PUBLIC_HOSTNAME: pingfederate-admin.${TENANT_DOMAIN}
    PF_ADMIN_API_PUBLIC_HOSTNAME: pingfederate-admin-api.${TENANT_DOMAIN}
    PF_ENGINE_PUBLIC_HOSTNAME: pingfederate.${TENANT_DOMAIN}
    PD_DELEGATOR_PUBLIC_HOSTNAME: pingdelegator.${TENANT_DOMAIN}
    PD_HTTP_PUBLIC_HOSTNAME: pingdirectory.${TENANT_DOMAIN}
    REGION: ${REGION}
    NEW_RELIC_LICENSE_KEY: ${NEW_RELIC_LICENSE_KEY}
- |-
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: pingfederate-environment-variables
  data:
    PING_IDENTITY_DEVOPS_USER: ${PING_IDENTITY_DEVOPS_USER}
    PING_IDENTITY_DEVOPS_KEY: ${PING_IDENTITY_DEVOPS_KEY}
    BACKUP_URL: ${BACKUP_URL}
    PA_WAS_ADMIN_PUBLIC_HOSTNAME: pingaccess-was-admin.${TENANT_DOMAIN}
    PA_WAS_ENGINE_PUBLIC_HOSTNAME: pingaccess-was.${TENANT_DOMAIN}
    PA_ADMIN_PUBLIC_HOSTNAME: pingaccess-admin.${TENANT_DOMAIN}
    PA_ADMIN_API_PUBLIC_HOSTNAME: pingaccess-admin-api.${TENANT_DOMAIN}
    PA_ENGINE_PUBLIC_HOSTNAME: pingaccess.${TENANT_DOMAIN}
    PF_ADMIN_PUBLIC_HOSTNAME: pingfederate-admin.${TENANT_DOMAIN}
    PF_ADMIN_API_PUBLIC_HOSTNAME: pingfederate-admin-api.${TENANT_DOMAIN}
    PF_ENGINE_PUBLIC_HOSTNAME: pingfederate.${TENANT_DOMAIN}
    PD_DELEGATOR_PUBLIC_HOSTNAME: pingdelegator.${TENANT_DOMAIN}
    PD_HTTP_PUBLIC_HOSTNAME: pingdirectory.${TENANT_DOMAIN}
    REGION: ${REGION}
    NEW_RELIC_LICENSE_KEY: ${NEW_RELIC_LICENSE_KEY}
- |-
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: pingdatasync-environment-variables
  data:
    PING_IDENTITY_DEVOPS_USER: ${PING_IDENTITY_DEVOPS_USER}
    PING_IDENTITY_DEVOPS_KEY: ${PING_IDENTITY_DEVOPS_KEY}
    BACKUP_URL: ${BACKUP_URL}
    PA_WAS_ADMIN_PUBLIC_HOSTNAME: pingaccess-was-admin.${TENANT_DOMAIN}
    PA_WAS_ENGINE_PUBLIC_HOSTNAME: pingaccess-was.${TENANT_DOMAIN}
    PA_ADMIN_PUBLIC_HOSTNAME: pingaccess-admin.${TENANT_DOMAIN}
    PA_ADMIN_API_PUBLIC_HOSTNAME: pingaccess-admin-api.${TENANT_DOMAIN}
    PA_ENGINE_PUBLIC_HOSTNAME: pingaccess.${TENANT_DOMAIN}
    PF_ADMIN_PUBLIC_HOSTNAME: pingfederate-admin.${TENANT_DOMAIN}
    PF_ADMIN_API_PUBLIC_HOSTNAME: pingfederate-admin-api.${TENANT_DOMAIN}
    PF_ENGINE_PUBLIC_HOSTNAME: pingfederate.${TENANT_DOMAIN}
    PD_DELEGATOR_PUBLIC_HOSTNAME: pingdelegator.${TENANT_DOMAIN}
    PD_HTTP_PUBLIC_HOSTNAME: pingdirectory.${TENANT_DOMAIN}
    REGION: ${REGION}
    NEW_RELIC_LICENSE_KEY: ${NEW_RELIC_LICENSE_KEY}

patchesJson6902:

- target:
    group: networking.k8s.io
    version: v1
    kind: Ingress
    name: metadata-ingress
  patch: |-
    - op: replace
      path: /spec/tls/0/hosts/0
      value: metadata.${TENANT_DOMAIN}
    - op: replace
      path: /spec/rules/0/host
      value: metadata.${TENANT_DOMAIN}

- target:
    group: networking.k8s.io
    version: v1
    kind: Ingress
    name: pingdirectory-http-ingress
  patch: |-
    - op: replace
      path: /spec/tls/0/hosts/0
      value: pingdirectory.${TENANT_DOMAIN}
    - op: replace
      path: /spec/rules/0/host
      value: pingdirectory.${TENANT_DOMAIN}

- target:
    group: networking.k8s.io
    version: v1
    kind: Ingress
    name: pingdelegator-ingress
  patch: |-
    - op: replace
      path: /spec/tls/0/hosts/0
      value: pingdelegator.${TENANT_DOMAIN}
    - op: replace
      path: /spec/rules/0/host
      value: pingdelegator.${TENANT_DOMAIN}

- target:
    group: networking.k8s.io
    version: v1
    kind: Ingress
    name: pingfederate-ingress
  patch: |-
    - op: replace
      path: /spec/tls/0/hosts/0
      value: pingfederate.${TENANT_DOMAIN}
    - op: replace
      path: /spec/rules/0/host
      value: pingfederate.${TENANT_DOMAIN}

- target:
    group: networking.k8s.io
    version: v1
    kind: Ingress
    name: pingfederate-admin-ingress
  patch: |-
    - op: replace
      path: /spec/tls/0/hosts/0
      value: pingfederate-admin-api.${TENANT_DOMAIN}
    - op: replace
      path: /spec/rules/0/host
      value: pingfederate-admin-api.${TENANT_DOMAIN}

- target:
    group: networking.k8s.io
    version: v1
    kind: Ingress
    name: pingaccess-ingress
  patch: |-
    - op: replace
      path: /spec/tls/0/hosts/0
      value: pingaccess.${TENANT_DOMAIN}
    - op: replace
      path: /spec/rules/0/host
      value: pingaccess.${TENANT_DOMAIN}

- target:
    group: networking.k8s.io
    version: v1
    kind: Ingress
    name: pingaccess-admin-ingress
  patch: |-
    - op: replace
      path: /spec/tls/0/hosts/0
      value: pingaccess-admin-api.${TENANT_DOMAIN}
    - op: replace
      path: /spec/rules/0/host
      value: pingaccess-admin-api.${TENANT_DOMAIN}

- target:
    group: networking.k8s.io
    version: v1
    kind: Ingress
    name: pingaccess-agent-ingress
  patch: |-
    - op: replace
      path: /spec/tls/0/hosts/0
      value: pingaccess-agent.${TENANT_DOMAIN}
    - op: replace
      path: /spec/rules/0/host
      value: pingaccess-agent.${TENANT_DOMAIN}

# Ingresses through PA-WAS engines
- target:
    group: networking.k8s.io
    version: v1
    kind: Ingress
    name: pingaccess-was-ingress
  patch: |-
    ### PingAccess Admin ###
    - op: replace
      path: /spec/tls/0/hosts/0
      value: pingaccess-admin.${TENANT_DOMAIN}
    - op: replace
      path: /spec/rules/0/host
      value: pingaccess-admin.${TENANT_DOMAIN}

    ### PingFederate Admin ###
    - op: replace
      path: /spec/tls/0/hosts/1
      value: pingfederate-admin.${TENANT_DOMAIN}
    - op: replace
      path: /spec/rules/1/host
      value: pingfederate-admin.${TENANT_DOMAIN}

    ### Grafana ###
    - op: replace
      path: /spec/tls/0/hosts/2
      value: monitoring.${TENANT_DOMAIN}
    - op: replace
      path: /spec/rules/2/host
      value: monitoring.${TENANT_DOMAIN}

    ### Prometheus ###
    - op: replace
      path: /spec/tls/0/hosts/3
      value: prometheus.${TENANT_DOMAIN}
    - op: replace
      path: /spec/rules/3/host
      value: prometheus.${TENANT_DOMAIN}

    ### Kibana ###
    - op: replace
      path: /spec/tls/0/hosts/4
      value: logs.${TENANT_DOMAIN}
    - op: replace
      path: /spec/rules/4/host
      value: logs.${TENANT_DOMAIN}

    ### Argo CD ###
    - op: replace
      path: /spec/tls/0/hosts/5
      value: argocd.${TENANT_DOMAIN}
    - op: replace
      path: /spec/rules/5/host
      value: argocd.${TENANT_DOMAIN}

    ### PingCentral ###
    - op: replace
      path: /spec/tls/0/hosts/6
      value: pingcentral-admin.${TENANT_DOMAIN}
    - op: replace
      path: /spec/rules/6/host
      value: pingcentral-admin.${TENANT_DOMAIN}

- target:
    group: networking.k8s.io
    version: v1
    kind: Ingress
    name: pingaccess-was-admin-ingress
  patch: |-
    - op: replace
      path: /spec/tls/0/hosts/0
      value: pingaccess-was-admin.${TENANT_DOMAIN}
    - op: replace
      path: /spec/rules/0/host
      value: pingaccess-was-admin.${TENANT_DOMAIN}

- target:
    group: networking.k8s.io
    version: v1
    kind: Ingress
    name: pingcentral-ingress
  patch: |-
    - op: replace
      path: /spec/tls/0/hosts/0
      value: pingcentral.${TENANT_DOMAIN}
    - op: replace
      path: /spec/rules/0/host
      value: pingcentral.${TENANT_DOMAIN}

# pingdirectory put ldaps on public and change the host
- target:
    version: v1
    kind: Service
    name: pingdirectory-admin
  patch: |-
    - op: replace
      path: /metadata/annotations/external-dns.alpha.kubernetes.io~1hostname
      value: pingdirectory-admin.${TENANT_DOMAIN}

# pingfederate engine radius ports
- target:
    version: v1
    kind: Service
    name: udp-loadbalancer
  patch: |-
    - op: replace
      path: /metadata/annotations/external-dns.alpha.kubernetes.io~1hostname
      value: pingfederate-radius.${TENANT_DOMAIN}

# Make the admin nodes available externally for test purposes. In general, they
# will be behind a VPN gateway on all CDEs so only admins have access to them.
- target:
    version: v1
    kind: Service
    name: ingress-nginx
    namespace: ingress-nginx-private
  patch: |-
    - op: remove
      path: /metadata/annotations/service.beta.kubernetes.io~1aws-load-balancer-internal

# Configure external-dns to only own the hosted zone for the tenant domain
- target:
    group: apps
    version: v1
    kind: Deployment
    name: external-dns
    namespace: external-dns
  patch: |-
    - op: add
      path: /spec/template/spec/containers/0/args/-
      value:
        --domain-filter=${TENANT_DOMAIN}.