{"id":50385074,"url":"https://github.com/stackhpc/waldur-fluxcd-gitops-demo","last_synced_at":"2026-05-30T14:30:57.443Z","repository":{"id":247586439,"uuid":"826218895","full_name":"stackhpc/waldur-fluxcd-gitops-demo","owner":"stackhpc","description":null,"archived":false,"fork":false,"pushed_at":"2024-10-24T10:05:27.000Z","size":124,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2024-10-25T04:51:50.882Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/stackhpc.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-07-09T09:40:38.000Z","updated_at":"2024-09-24T14:00:01.000Z","dependencies_parsed_at":"2024-07-09T15:15:52.253Z","dependency_job_id":"59e79229-31be-48c3-acdc-8674c34fdc95","html_url":"https://github.com/stackhpc/waldur-fluxcd-gitops-demo","commit_stats":null,"previous_names":["stackhpc/waldur-fluxcd-gitops-demo"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/stackhpc/waldur-fluxcd-gitops-demo","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stackhpc%2Fwaldur-fluxcd-gitops-demo","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stackhpc%2Fwaldur-fluxcd-gitops-demo/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stackhpc%2Fwaldur-fluxcd-gitops-demo/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stackhpc%2Fwaldur-fluxcd-gitops-demo/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/stackhpc","download_url":"https://codeload.github.com/stackhpc/waldur-fluxcd-gitops-demo/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stackhpc%2Fwaldur-fluxcd-gitops-demo/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33696681,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-05-30T02:00:06.278Z","response_time":92,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-05-30T14:30:56.713Z","updated_at":"2026-05-30T14:30:57.438Z","avatar_url":"https://github.com/stackhpc.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Waldur FluxCD Demo\n\nThis repository demonstrates how to deploy Waldur on top of a GitOps-managed Kubernetes cluster running on OpenStack.\n\nThe tooling is based on the [capi-helm-fluxcd-config](https://github.com/stackhpc/capi-helm-fluxcd-config)\nrepository as a template for GitOps-based Kubernetes clusters. See the base repo's README for a general\nintroduction.\n\nThis downstream repo adds some additional configuration for deploying an instance of Waldur on the provisioned\ncluster, which includes the required FluxCD Helm configuration for installing the\n[Waldur Helm Chart](https://artifacthub.io/packages/helm/waldur-charts/waldur) as well as some example Helm values\nfor customising the Waldur installation (see `components/waldur`).\n\nTo view all of the Waldur-specific additions made to the base capi-helm-fluxcd-config repo, you can check out this\ndownstream repo locally and run the following:\n\n```\ngit clone https://github.com/stackhpc/waldur-fluxcd-gitops-demo\ngit remote add upstream https://github.com/stackhpc/capi-helm-fluxcd-config\ngit fetch --all\ngit diff upstream/main\n```\n\n## Replicating this deployment example\n\nTo deploy your own Waldur instance based on this example you should make a copy (i.e. a detached fork) of this\nrepository:\n\n```\n# Clone the repository\ngit clone https://github.com/stackhpc/waldur-fluxcd-gitops-demo.git my-waldur-deployment\ncd my-waldur-deployment\n\n# Rename the origin remote to upstream so that we can pull changes in future\ngit remote rename origin upstream\n\n# Add the new origin remote and push the initial commit\ngit remote add origin \u003curl\u003e\ngit push -u origin main\n```\n\nYou should then replace the `clusters/waldur/credentials.yaml` file with your own OpenStack application\ncredential for your target cloud (see [here](https://github.com/stackhpc/capi-helm-fluxcd-config/tree/main?tab=readme-ov-file#usage)\nfor details). The credentials file will be encrypted as part of the initial deployment process before\nit is committed to git.\n\nOnce the appropriate credentials have been added, modify the following fields in\n`clusters/waldur/configmap.yaml` to match the desired flavours, images etc. for your target\ncloud:\n\n```\n    # Must match the name of the (sealed) secret in credentials.yaml\n    cloudCredentialsSecretName: waldur-cluster-config-credentials\n\n    kubernetesVersion: 1.29.5\n    machineImageId: f08b688e-645a-4444-a811-c181bd82cc50 # == ubuntu-jammy-kube-v1.29.5-240605-0529\n\n    clusterNetworking:\n      externalNetworkId: 57add367-d205-4030-a929-d75617a7c63e\n\n    controlPlane:\n      machineFlavor: vm.ska.cpu.general.small\n      machineCount: 3\n\n    # NOTE: Waldur is surprisingly resource hungry so it is easier\n    # to start with an initially oversized cluster and scale it down\n    # later once you have confirmed via the monitoring dashboards\n    # that a smaller cluster will suffice.\n    nodeGroups:\n      - name: group-1\n        machineFlavor: vm.ska.cpu.general.small\n        machineCount: 3\n      - name: group-2\n        machineFlavor: vm.ska.cpu.general.eighth\n        machineCount: 1\n```\n\nFor a full list of available configuration options for the Kubernetes cluster, consult the capi-helm-charts\n[documentation](https://github.com/stackhpc/capi-helm-charts/tree/main/charts/openstack-cluster) and\n[values.yaml](https://github.com/stackhpc/capi-helm-charts/blob/main/charts/openstack-cluster/values.yaml).\n\nOnce you are happy with your configuration, the Kubernetes cluster is ready to be deployed by following\nhttps://github.com/stackhpc/capi-helm-fluxcd-config/tree/main#usage. It is normal for this deployment\nto take a while (e.g. 30 minutes) since there are many steps involved in the bootstrapping process.\n\nAfter the initial deployment, the Waldur configuration can be modified to suit your needs. The main sources for this\nconfig can be found in the `components/waldur/{helmrelease,configmap}.yaml` files. The Flux controllers running\non the deployed cluster will automatically watch the target GitHub repository for changes to the main branch, so\nadding or modifying configuration options on your deployment should be done by proposing, reviewing and merging pull\nrequests in the repository.\n\n### Accessing the Waldur deployment\n\nBy default the Waldur UI and API endpoints are not exposed outside of the Kubernetes cluster. An example of\nthe required configuration for exposing the UI and API outside of the cluster using Kubernetes\n[Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) is included in\n`components/waldur/configmap.yaml`. The IP address in the example should be replaced by the\nexternal IP assigned to the OpenStack load balancer for the NGINX Ingress controller. This IP can be obtained\nwith `kubectl get svc -n ingress-nginx ingress-nginx-controller`.\n\n## Adding secrets to the Waldur deployment\n\nThe Waldur Helm chart configuration may need to contain some sensitive values such as OIDC client secrets,\nthis can pose a challenge when all of the required configuration is maintained in a remote Git repository.\nThe recommended solution is to use Kubernetes [Sealed Secrets](https://github.com/bitnami-labs/sealed-secrets).\nThe following is a 'worked example' of adding Keycloak login functionality to your Waldur deployment while\nfollowing recommended best practices for secure secret management.\n\nFirst, create a client in your Keycloak for Waldur to use - see [these](https://docs.waldur.com/admin-guide/identities/keycloak/)\nWaldur docs for detailed instructions but ignore the final section on 'Configuring Waldur', this will be done\nvia the Helm values instead.\n\nNext, run `cp components/waldur/{example-,}secret.yaml` to create a `secrets.yaml` file and then replace the\nKeycloak client name, secret and discovery URL variables with the values for your newly created Keycloak client.\n\nOverwrite the secret with a sealed secret using `kubeseal`:\n\n```\nkubeseal \\\n  --kubeconfig clusters/waldur/kubeconfig \\\n  --format yaml \\\n  --controller-name sealed-secrets \\\n  --controller-namespace sealed-secrets-system \\\n  --secret-file components/waldur/secret.yaml \\\n  --sealed-secret-file components/waldur/secret.yaml\n```\n\nInspecting the content of this file should now show that the secret values have been encrypted.\n\nNext, configure Flux to include this sealed secret in the list of files that it watches by adding `secret.yaml`\nto the resources list in `components/waldur/kustomization.yaml`.\n\nAdd the following content to the `valuesFrom` list in `components/waldur/helmrelease.yaml` to tell Flux that the new\nsecret should be used as a source of Helm chart values:\n\n```\n  - kind: Secret\n    name: waldur-keycloak-config\n    valuesKey: keycloakClientId\n    targetPath: waldur.socialAuthMethods[0].clientId\n  - kind: Secret\n    name: waldur-keycloak-config\n    valuesKey: keycloakClientSecret\n    targetPath: waldur.socialAuthMethods[0].clientSecret\n  - kind: Secret\n    name: waldur-keycloak-config\n    valuesKey: keycloakDiscoveryUrl\n    targetPath: waldur.socialAuthMethods[0].discoveryUrl\n```\n\nFinally, add the non-secret sections of the required Waldur config to the rest of the Helm chart values in\n`components/waldur/configmap.yaml`:\n\n```\n    waldur:\n      authMethods:\n      - LOCAL_SIGNIN\n      - SOCIAL_SIGNUP\n      socialAuthMethods:\n      - label: Keycloak\n        provider: keycloak\n        # clientId: \u003cstored-in-sealed-secret\u003e\n        # clientSecret: \u003cstored-in-sealed-secret\u003e\n        # discoveryUrl: \u003cstored-in-sealed-secret\u003e\n        managementUrl: \"\"\n        protectedFields:\n        - full_name\n        - email\n```\n\nWith all of these changes made, commit them to git and propose a pull request to the remote repository. Once\nthe PR has been reviewed and merged, Flux will notice the change to the GitHub main branch and apply the new\nconfig to the live deployment.\n\nOnce the PR has merged, you can check the status of the various Flux components on the remote cluster using\n`kubectl` and the kubeconfig for your cluster (which should have been written to `clusters/waldur/kubeconfig`\nas part of the initial cluster deployment). For example, by running\n\n```\nkubectl get -A gitrepositories.source.toolkit.fluxcd.io,kustomizations.kustomize.toolkit.fluxcd.io,helmreleases.helm.toolkit.fluxcd.io\n```\n\nor by using the Flux CLI:\n\n```\nflux get source git\nflux get kustomizations\nflux get helmrelease -n waldur\n```\n\nIf the changes have synced correctly from GitHub and the `helmrelease` object is up to date but the Waldur\nlogin UI is still not displaying a 'Login with Keycloak' option then you may need to restart the Waldur\npods using:\n\n```\nkubectl rollout restart deployment -n waldur\n```\n\nA similar process can be followed for adding any other secret/sensitive configuration options required by\nWaldur.\n\nAny general (i.e. non-secret) configuration should be added to the Waldur Helm chart values in\n`components/waldur/configmap.yaml`.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstackhpc%2Fwaldur-fluxcd-gitops-demo","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstackhpc%2Fwaldur-fluxcd-gitops-demo","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstackhpc%2Fwaldur-fluxcd-gitops-demo/lists"}