From 88b827e58d01c8928615e654b1661bcac10d6351 Mon Sep 17 00:00:00 2001 From: Max Gautier Date: Tue, 8 Jul 2025 13:55:31 +0200 Subject: [PATCH 1/2] argocd: simplify manifests apply ArgoCD upstream manifests do not include namespace for the objects, so there is no need to override it, and simply using kubectl flags allow to set it. Use the upstream file directly , considerably simplifying the argocd install. ansible-lint: the refactor apparently newly exposes the password hash filter to ansible and this needs passlib, so add it to the pre-commit dependencies. --- .pre-commit-config.yaml | 1 + README.md | 2 +- .../kubernetes-apps/argocd/defaults/main.yml | 5 - roles/kubernetes-apps/argocd/tasks/main.yml | 110 ++++-------------- .../argocd/templates/argocd-namespace.yml.j2 | 7 -- roles/kubernetes-apps/meta/main.yml | 1 + .../defaults/main/download.yml | 3 +- .../kubespray_defaults/defaults/main/main.yml | 1 + scripts/propagate_ansible_variables.yml | 1 - 9 files changed, 27 insertions(+), 104 deletions(-) delete mode 100644 roles/kubernetes-apps/argocd/defaults/main.yml delete mode 100644 roles/kubernetes-apps/argocd/templates/argocd-namespace.yml.j2 diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index e6d829c60..6a4dbd179 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -43,6 +43,7 @@ repos: - jmespath==1.0.1 - netaddr==1.3.0 - distlib + - passlib==1.7.4 - repo: https://github.com/golangci/misspell rev: v0.7.0 diff --git a/README.md b/README.md index 3c18d199c..8211ab27a 100644 --- a/README.md +++ b/README.md @@ -128,7 +128,7 @@ Note: - Application - [cert-manager](https://github.com/jetstack/cert-manager) 1.15.3 - [coredns](https://github.com/coredns/coredns) 1.14.6 - - [argocd](https://argoproj.github.io/) 2.14.5 + - [argocd](https://argoproj.github.io/) 2.14.21 - [helm](https://helm.sh/) 3.22.0 - [metallb](https://metallb.universe.tf/) 0.13.9 - [registry](https://github.com/distribution/distribution) 2.8.1 diff --git a/roles/kubernetes-apps/argocd/defaults/main.yml b/roles/kubernetes-apps/argocd/defaults/main.yml deleted file mode 100644 index c41b86f03..000000000 --- a/roles/kubernetes-apps/argocd/defaults/main.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -argocd_enabled: false -argocd_version: 2.14.5 -argocd_namespace: argocd -# argocd_admin_password: diff --git a/roles/kubernetes-apps/argocd/tasks/main.yml b/roles/kubernetes-apps/argocd/tasks/main.yml index f40228836..0cfc8d9cd 100644 --- a/roles/kubernetes-apps/argocd/tasks/main.yml +++ b/roles/kubernetes-apps/argocd/tasks/main.yml @@ -1,95 +1,29 @@ --- -- name: Kubernetes Apps | Download yq - include_tasks: "../../../download/tasks/download_file.yml" - vars: - download: "{{ download_defaults | combine(downloads.yq) }}" - -- name: Kubernetes Apps | Copy yq binary from download dir - copy: - src: "{{ downloads.yq.dest }}" - dest: "{{ bin_dir }}/yq" - mode: "0755" - remote_src: true - -- name: Kubernetes Apps | Set ArgoCD template list - set_fact: - argocd_templates: - - name: namespace - file: argocd-namespace.yml - - name: install - file: "{{ downloads.argocd_install.dest | basename }}" - namespace: "{{ argocd_namespace }}" - download: "{{ downloads.argocd_install }}" - when: - - "inventory_hostname == groups['kube_control_plane'][0]" - -- name: Kubernetes Apps | Download ArgoCD remote manifests - include_tasks: "../../../download/tasks/download_file.yml" - vars: - download: "{{ download_defaults | combine(item.download) }}" - with_items: "{{ argocd_templates | selectattr('download', 'defined') | list }}" - loop_control: - label: "{{ item.file }}" - when: - - "inventory_hostname == groups['kube_control_plane'][0]" - -- name: Kubernetes Apps | Copy ArgoCD remote manifests from download dir - ansible.posix.synchronize: - src: "{{ local_release_dir }}/{{ item.file }}" - dest: "{{ kube_config_dir }}/{{ item.file }}" - compress: false - perms: true - owner: false - group: false - delegate_to: "{{ inventory_hostname }}" - with_items: "{{ argocd_templates | selectattr('download', 'defined') | list }}" - when: - - "inventory_hostname == groups['kube_control_plane'][0]" - -- name: Kubernetes Apps | Set ArgoCD namespace for remote manifests - become: true - command: | - {{ bin_dir }}/yq eval-all -i '.metadata.namespace="{{ argocd_namespace }}"' {{ kube_config_dir }}/{{ item.file }} - with_items: "{{ argocd_templates | selectattr('download', 'defined') | list }}" - loop_control: - label: "{{ item.file }}" - when: - - "inventory_hostname == groups['kube_control_plane'][0]" - -- name: Kubernetes Apps | Create ArgoCD manifests from templates - become: true - template: - src: "{{ item.file }}.j2" - dest: "{{ kube_config_dir }}/{{ item.file }}" - mode: "0644" - with_items: "{{ argocd_templates | selectattr('download', 'undefined') | list }}" - loop_control: - label: "{{ item.file }}" - when: - - "inventory_hostname == groups['kube_control_plane'][0]" - - name: Kubernetes Apps | Install ArgoCD - become: true - kube: - name: ArgoCD - kubectl: "{{ bin_dir }}/kubectl" - filename: "{{ kube_config_dir }}/{{ item.file }}" - state: latest - with_items: "{{ argocd_templates }}" - when: - - "inventory_hostname == groups['kube_control_plane'][0]" + vars: + ns_object: + apiVersion: v1 + kind: Namespace + metadata: + name: "{{ argocd_namespace }}" + labels: + app: argocd + command: + cmd: > + {{ kubectl }} apply -n {{ argocd_namespace }} + --server-side=true --force-conflicts --field-manager=kubespray + -f - -f {{ downloads.argocd_install.dest }} + stdin: "{{ ns_object | to_json }}" # https://github.com/argoproj/argo-cd/blob/master/docs/faq.md#i-forgot-the-admin-password-how-do-i-reset-it - name: Kubernetes Apps | Set ArgoCD custom admin password - become: true - shell: | - {{ bin_dir }}/kubectl --kubeconfig /etc/kubernetes/admin.conf -n {{ argocd_namespace }} patch secret argocd-secret -p \ - '{ - "stringData": { - "admin.password": "{{ argocd_admin_password | password_hash('bcrypt') }}", - "admin.passwordMtime": "'$(date +%FT%T%Z)'" - } - }' + vars: + password_patch: + stringData: + 'admin.password': "{{ argocd_admin_password | password_hash('bcrypt') }}" + 'admin.passwordMtime': "{{ now(utc=true, fmt='%Y-%m-%dT%H:%M:%SZ') }}" + command: + cmd: "{{ kubectl }} -n {{ argocd_namespace }} patch secret argocd-secret --patch-file=/dev/stdin" + stdin: "{{ password_patch | to_json }}" when: - argocd_admin_password is defined - - "inventory_hostname == groups['kube_control_plane'][0]" diff --git a/roles/kubernetes-apps/argocd/templates/argocd-namespace.yml.j2 b/roles/kubernetes-apps/argocd/templates/argocd-namespace.yml.j2 deleted file mode 100644 index 5a3d40f8a..000000000 --- a/roles/kubernetes-apps/argocd/templates/argocd-namespace.yml.j2 +++ /dev/null @@ -1,7 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: {{ argocd_namespace }} - labels: - app: argocd diff --git a/roles/kubernetes-apps/meta/main.yml b/roles/kubernetes-apps/meta/main.yml index 0ae4cec9d..a2f1d745a 100644 --- a/roles/kubernetes-apps/meta/main.yml +++ b/roles/kubernetes-apps/meta/main.yml @@ -114,6 +114,7 @@ dependencies: - metallb - role: kubernetes-apps/argocd + become: true when: - argocd_enabled - inventory_hostname == groups['kube_control_plane'][0] diff --git a/roles/kubespray_defaults/defaults/main/download.yml b/roles/kubespray_defaults/defaults/main/download.yml index 05b3a15ba..2be0f0dbb 100644 --- a/roles/kubespray_defaults/defaults/main/download.yml +++ b/roles/kubespray_defaults/defaults/main/download.yml @@ -925,8 +925,7 @@ downloads: argocd_install: enabled: "{{ argocd_enabled }}" file: true - version: "{{ argocd_version }}" - dest: "{{ local_release_dir }}/argocd-install.yml" + dest: "{{ local_release_dir }}/argocd-install-{{ argocd_version }}.yml" checksum: "{{ argocd_install_checksum }}" url: "{{ argocd_install_url }}" unarchive: false diff --git a/roles/kubespray_defaults/defaults/main/main.yml b/roles/kubespray_defaults/defaults/main/main.yml index 7217d96ab..b38d6ae38 100644 --- a/roles/kubespray_defaults/defaults/main/main.yml +++ b/roles/kubespray_defaults/defaults/main/main.yml @@ -475,6 +475,7 @@ expand_persistent_volumes: false metallb_enabled: false metallb_speaker_enabled: "{{ metallb_enabled }}" argocd_enabled: false +argocd_namespace: argocd gateway_api_enabled: false prometheus_operator_crds_enabled: false diff --git a/scripts/propagate_ansible_variables.yml b/scripts/propagate_ansible_variables.yml index 6ef265cac..30a04ab65 100755 --- a/scripts/propagate_ansible_variables.yml +++ b/scripts/propagate_ansible_variables.yml @@ -14,7 +14,6 @@ loop: - ../roles/container-engine/docker/defaults/main.yml - ../roles/kubernetes/node/defaults/main.yml - - ../roles/kubernetes-apps/argocd/defaults/main.yml - name: Render versions in README.md blockinfile: marker: '' From 58be448c637a1a09201cff128029d694b5604bcb Mon Sep 17 00:00:00 2001 From: Max Gautier Date: Thu, 6 Nov 2025 10:45:20 +0100 Subject: [PATCH 2/2] Remove yq as it's no longer needed After removing it's use in argocd install, yq is no longer used anywhere. Remove it everywhere. --- .../defaults/main/download.yml | 11 ------- .../vars/main/checksums.yml | 29 ------------------- .../src/component_hash_update/components.py | 4 --- .../src/component_hash_update/download.py | 12 -------- 4 files changed, 56 deletions(-) diff --git a/roles/kubespray_defaults/defaults/main/download.yml b/roles/kubespray_defaults/defaults/main/download.yml index 2be0f0dbb..cacdfadcb 100644 --- a/roles/kubespray_defaults/defaults/main/download.yml +++ b/roles/kubespray_defaults/defaults/main/download.yml @@ -911,17 +911,6 @@ downloads: groups: - kube_control_plane - yq: - enabled: "{{ argocd_enabled }}" - file: true - version: "{{ yq_version }}" - dest: "{{ local_release_dir }}/yq-{{ yq_version }}-{{ image_arch }}" - checksum: "{{ yq_binary_checksum }}" - url: "{{ yq_download_url }}" - unarchive: false - groups: - - kube_control_plane - argocd_install: enabled: "{{ argocd_enabled }}" file: true diff --git a/roles/kubespray_defaults/vars/main/checksums.yml b/roles/kubespray_defaults/vars/main/checksums.yml index 8e92b8ce0..942c1c922 100644 --- a/roles/kubespray_defaults/vars/main/checksums.yml +++ b/roles/kubespray_defaults/vars/main/checksums.yml @@ -1697,35 +1697,6 @@ skopeo_binary_checksums: 1.14.5: sha256:4ed476c46fabb3b320aac9b88ddc1b7a2665cb151a93482db7cb98e5768a768f 1.14.4: sha256:f1b37ad1b83bd43bada6e49518165cf41d727d0662351dc5fcc9a46f0c3b4482 1.14.3: sha256:9028b7c4aafe235f1ba4efd57435b97ace341e544d3a6807440ac3b0f32d7d73 -yq_checksums: - arm: - 4.42.1: sha256:4e3fe0c37793d28e96d465d9958fbf679d8c616e1857d0faf7980ad087f32aee - 4.41.1: sha256:ccd50344652c02574ca7dd123c7d66a06b391838e8ca6088b688e6edf2e25d0c - 4.40.7: sha256:fb922bb1e3974fbd15957feafb5e9bbabe43f4192999cf9b3e0e470815f2e0da - 4.40.5: sha256:c587b2411e43d3fbcdd24c233fb558a362b5111a8446b23f9ce9a4a5665a7041 - 4.40.4: sha256:2ff3f17483f2172a20130b16328114bfe6abd7d3068d66d8194a5093079e8529 - 4.40.3: sha256:6a97856e8b4ef992ce08dcfdf97fec517cf612b1a89078406f401673f126c21c - arm64: - 4.42.1: sha256:16a57531a594b66c3e0981cd93f9e9cd4b684a347b86eaf5e3f409074ad67eb8 - 4.41.1: sha256:066aa930d74e39a25447b1900d8cbb3e1c7df72cd75bc203bc6ae5ee577a5b4a - 4.40.7: sha256:a84f2c8f105b70cd348c3bf14048aeb1665c2e7314cbe9aaff15479f268b8412 - 4.40.5: sha256:9431f0fa39a0af03a152d7fe19a86e42e9ff28d503ed4a70598f9261ec944a97 - 4.40.4: sha256:79c61a1ebfedb165ec8c4678777775b52e2c581801f5d4cd80f97300852fe0f0 - 4.40.3: sha256:44a5cca10d33019b8a46212882197be4f961dfe7deddde0af497065aa980a6a4 - amd64: - 4.42.1: sha256:1a95960dddd426321354d58d2beac457717f7c49a9ec0806749a5a9e400eb45e - 4.41.1: sha256:ce0d5a61c256a463fd32f67f133e0c2948bc2cf77d44c42ff335a40e6bef34bf - 4.40.7: sha256:4f13ee9303a49f7e8f61e7d9c87402e07cc920ae8dfaaa8c10d7ea1b8f9f48ed - 4.40.5: sha256:0d6aaf1cf44a8d18fbc7ed0ef14f735a8df8d2e314c4cc0f0242d35c0a440c95 - 4.40.4: sha256:f9163412d9aa2aa55e888fdcaf2b4053ada20074be35f701424caa7163100704 - 4.40.3: sha256:6e9a5ed9591dbf1d13aaec4efaaf0ecdaf4945ea393b9ce01f4c3dea22311470 - ppc64le: - 4.42.1: sha256:d0d1cdbd2c4a7e6995433baf879cadaa47f6f12290e1661ea11933ed90baccb6 - 4.41.1: sha256:eed2af79d0ad787878b2d5c7c592e43ac152208d9ed432b42a43663167e276e8 - 4.40.7: sha256:ac0e8d06a7ed9afc108b4e2e9d6900312b01757f61b75fcecb809f15c39b10e7 - 4.40.5: sha256:a1df9d2b872fbb30583526bf4f37f737dc1913b28606dfc1dafeaf56a8862b3d - 4.40.4: sha256:c67379085a44558825a60a8af3b59b400852b168356070829bc0f45c70553f45 - 4.40.3: sha256:2fe818a0b141913a41548e0e727267479d0f755221c73f9e304788c8e9139a45 gateway_api_standard_crds_checksums: no_arch: 1.6.2: sha256:faede450fa178126aba41337737b97d351ebe87d93c910237ce1e072d1ca40d9 diff --git a/scripts/component_hash_update/src/component_hash_update/components.py b/scripts/component_hash_update/src/component_hash_update/components.py index 576c40379..7cc1a43aa 100644 --- a/scripts/component_hash_update/src/component_hash_update/components.py +++ b/scripts/component_hash_update/src/component_hash_update/components.py @@ -100,10 +100,6 @@ infos = { "binary": True, "graphql_id": "R_kgDOFPvgPg", }, - "yq": { - "url": "https://github.com/mikefarah/yq/releases/download/v{version}/checksums-bsd", # see https://github.com/mikefarah/yq/pull/1691 for why we use this url - "graphql_id": "R_kgDOApOQGQ", - }, "argocd_install": { "url": "https://raw.githubusercontent.com/argoproj/argo-cd/v{version}/manifests/install.yaml", "graphql_id": "R_kgDOBzS60g", diff --git a/scripts/component_hash_update/src/component_hash_update/download.py b/scripts/component_hash_update/src/component_hash_update/download.py index 2e4a7e3c5..ece2049b8 100644 --- a/scripts/component_hash_update/src/component_hash_update/download.py +++ b/scripts/component_hash_update/src/component_hash_update/download.py @@ -78,18 +78,6 @@ def download_hash(downloads: {str: {str: Any}}) -> None: parts[1].split(".")[1]: parts[0] for parts in (line.split() for line in hashes.split("\n")[3:9]) }, - "yq": lambda rhashes_bsd: { - pair[0].split("_")[-1]: pair[1] - # pair = (yq__, ) - for pair in ( - (line.split()[1][1:-1], line.split()[3]) - for line in rhashes_bsd.splitlines() - if line.startswith("SHA256") - ) - if pair[0].startswith("yq") - and pair[0].split("_")[1] == "linux" - and not pair[0].endswith(".tar.gz") - }, } checksums_file = (