From 88b827e58d01c8928615e654b1661bcac10d6351 Mon Sep 17 00:00:00 2001 From: Max Gautier Date: Tue, 8 Jul 2025 13:55:31 +0200 Subject: [PATCH] argocd: simplify manifests apply ArgoCD upstream manifests do not include namespace for the objects, so there is no need to override it, and simply using kubectl flags allow to set it. Use the upstream file directly , considerably simplifying the argocd install. ansible-lint: the refactor apparently newly exposes the password hash filter to ansible and this needs passlib, so add it to the pre-commit dependencies. --- .pre-commit-config.yaml | 1 + README.md | 2 +- .../kubernetes-apps/argocd/defaults/main.yml | 5 - roles/kubernetes-apps/argocd/tasks/main.yml | 110 ++++-------------- .../argocd/templates/argocd-namespace.yml.j2 | 7 -- roles/kubernetes-apps/meta/main.yml | 1 + .../defaults/main/download.yml | 3 +- .../kubespray_defaults/defaults/main/main.yml | 1 + scripts/propagate_ansible_variables.yml | 1 - 9 files changed, 27 insertions(+), 104 deletions(-) delete mode 100644 roles/kubernetes-apps/argocd/defaults/main.yml delete mode 100644 roles/kubernetes-apps/argocd/templates/argocd-namespace.yml.j2 diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index e6d829c60..6a4dbd179 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -43,6 +43,7 @@ repos: - jmespath==1.0.1 - netaddr==1.3.0 - distlib + - passlib==1.7.4 - repo: https://github.com/golangci/misspell rev: v0.7.0 diff --git a/README.md b/README.md index 3c18d199c..8211ab27a 100644 --- a/README.md +++ b/README.md @@ -128,7 +128,7 @@ Note: - Application - [cert-manager](https://github.com/jetstack/cert-manager) 1.15.3 - [coredns](https://github.com/coredns/coredns) 1.14.6 - - [argocd](https://argoproj.github.io/) 2.14.5 + - [argocd](https://argoproj.github.io/) 2.14.21 - [helm](https://helm.sh/) 3.22.0 - [metallb](https://metallb.universe.tf/) 0.13.9 - [registry](https://github.com/distribution/distribution) 2.8.1 diff --git a/roles/kubernetes-apps/argocd/defaults/main.yml b/roles/kubernetes-apps/argocd/defaults/main.yml deleted file mode 100644 index c41b86f03..000000000 --- a/roles/kubernetes-apps/argocd/defaults/main.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -argocd_enabled: false -argocd_version: 2.14.5 -argocd_namespace: argocd -# argocd_admin_password: diff --git a/roles/kubernetes-apps/argocd/tasks/main.yml b/roles/kubernetes-apps/argocd/tasks/main.yml index f40228836..0cfc8d9cd 100644 --- a/roles/kubernetes-apps/argocd/tasks/main.yml +++ b/roles/kubernetes-apps/argocd/tasks/main.yml @@ -1,95 +1,29 @@ --- -- name: Kubernetes Apps | Download yq - include_tasks: "../../../download/tasks/download_file.yml" - vars: - download: "{{ download_defaults | combine(downloads.yq) }}" - -- name: Kubernetes Apps | Copy yq binary from download dir - copy: - src: "{{ downloads.yq.dest }}" - dest: "{{ bin_dir }}/yq" - mode: "0755" - remote_src: true - -- name: Kubernetes Apps | Set ArgoCD template list - set_fact: - argocd_templates: - - name: namespace - file: argocd-namespace.yml - - name: install - file: "{{ downloads.argocd_install.dest | basename }}" - namespace: "{{ argocd_namespace }}" - download: "{{ downloads.argocd_install }}" - when: - - "inventory_hostname == groups['kube_control_plane'][0]" - -- name: Kubernetes Apps | Download ArgoCD remote manifests - include_tasks: "../../../download/tasks/download_file.yml" - vars: - download: "{{ download_defaults | combine(item.download) }}" - with_items: "{{ argocd_templates | selectattr('download', 'defined') | list }}" - loop_control: - label: "{{ item.file }}" - when: - - "inventory_hostname == groups['kube_control_plane'][0]" - -- name: Kubernetes Apps | Copy ArgoCD remote manifests from download dir - ansible.posix.synchronize: - src: "{{ local_release_dir }}/{{ item.file }}" - dest: "{{ kube_config_dir }}/{{ item.file }}" - compress: false - perms: true - owner: false - group: false - delegate_to: "{{ inventory_hostname }}" - with_items: "{{ argocd_templates | selectattr('download', 'defined') | list }}" - when: - - "inventory_hostname == groups['kube_control_plane'][0]" - -- name: Kubernetes Apps | Set ArgoCD namespace for remote manifests - become: true - command: | - {{ bin_dir }}/yq eval-all -i '.metadata.namespace="{{ argocd_namespace }}"' {{ kube_config_dir }}/{{ item.file }} - with_items: "{{ argocd_templates | selectattr('download', 'defined') | list }}" - loop_control: - label: "{{ item.file }}" - when: - - "inventory_hostname == groups['kube_control_plane'][0]" - -- name: Kubernetes Apps | Create ArgoCD manifests from templates - become: true - template: - src: "{{ item.file }}.j2" - dest: "{{ kube_config_dir }}/{{ item.file }}" - mode: "0644" - with_items: "{{ argocd_templates | selectattr('download', 'undefined') | list }}" - loop_control: - label: "{{ item.file }}" - when: - - "inventory_hostname == groups['kube_control_plane'][0]" - - name: Kubernetes Apps | Install ArgoCD - become: true - kube: - name: ArgoCD - kubectl: "{{ bin_dir }}/kubectl" - filename: "{{ kube_config_dir }}/{{ item.file }}" - state: latest - with_items: "{{ argocd_templates }}" - when: - - "inventory_hostname == groups['kube_control_plane'][0]" + vars: + ns_object: + apiVersion: v1 + kind: Namespace + metadata: + name: "{{ argocd_namespace }}" + labels: + app: argocd + command: + cmd: > + {{ kubectl }} apply -n {{ argocd_namespace }} + --server-side=true --force-conflicts --field-manager=kubespray + -f - -f {{ downloads.argocd_install.dest }} + stdin: "{{ ns_object | to_json }}" # https://github.com/argoproj/argo-cd/blob/master/docs/faq.md#i-forgot-the-admin-password-how-do-i-reset-it - name: Kubernetes Apps | Set ArgoCD custom admin password - become: true - shell: | - {{ bin_dir }}/kubectl --kubeconfig /etc/kubernetes/admin.conf -n {{ argocd_namespace }} patch secret argocd-secret -p \ - '{ - "stringData": { - "admin.password": "{{ argocd_admin_password | password_hash('bcrypt') }}", - "admin.passwordMtime": "'$(date +%FT%T%Z)'" - } - }' + vars: + password_patch: + stringData: + 'admin.password': "{{ argocd_admin_password | password_hash('bcrypt') }}" + 'admin.passwordMtime': "{{ now(utc=true, fmt='%Y-%m-%dT%H:%M:%SZ') }}" + command: + cmd: "{{ kubectl }} -n {{ argocd_namespace }} patch secret argocd-secret --patch-file=/dev/stdin" + stdin: "{{ password_patch | to_json }}" when: - argocd_admin_password is defined - - "inventory_hostname == groups['kube_control_plane'][0]" diff --git a/roles/kubernetes-apps/argocd/templates/argocd-namespace.yml.j2 b/roles/kubernetes-apps/argocd/templates/argocd-namespace.yml.j2 deleted file mode 100644 index 5a3d40f8a..000000000 --- a/roles/kubernetes-apps/argocd/templates/argocd-namespace.yml.j2 +++ /dev/null @@ -1,7 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: {{ argocd_namespace }} - labels: - app: argocd diff --git a/roles/kubernetes-apps/meta/main.yml b/roles/kubernetes-apps/meta/main.yml index 0ae4cec9d..a2f1d745a 100644 --- a/roles/kubernetes-apps/meta/main.yml +++ b/roles/kubernetes-apps/meta/main.yml @@ -114,6 +114,7 @@ dependencies: - metallb - role: kubernetes-apps/argocd + become: true when: - argocd_enabled - inventory_hostname == groups['kube_control_plane'][0] diff --git a/roles/kubespray_defaults/defaults/main/download.yml b/roles/kubespray_defaults/defaults/main/download.yml index 05b3a15ba..2be0f0dbb 100644 --- a/roles/kubespray_defaults/defaults/main/download.yml +++ b/roles/kubespray_defaults/defaults/main/download.yml @@ -925,8 +925,7 @@ downloads: argocd_install: enabled: "{{ argocd_enabled }}" file: true - version: "{{ argocd_version }}" - dest: "{{ local_release_dir }}/argocd-install.yml" + dest: "{{ local_release_dir }}/argocd-install-{{ argocd_version }}.yml" checksum: "{{ argocd_install_checksum }}" url: "{{ argocd_install_url }}" unarchive: false diff --git a/roles/kubespray_defaults/defaults/main/main.yml b/roles/kubespray_defaults/defaults/main/main.yml index 7217d96ab..b38d6ae38 100644 --- a/roles/kubespray_defaults/defaults/main/main.yml +++ b/roles/kubespray_defaults/defaults/main/main.yml @@ -475,6 +475,7 @@ expand_persistent_volumes: false metallb_enabled: false metallb_speaker_enabled: "{{ metallb_enabled }}" argocd_enabled: false +argocd_namespace: argocd gateway_api_enabled: false prometheus_operator_crds_enabled: false diff --git a/scripts/propagate_ansible_variables.yml b/scripts/propagate_ansible_variables.yml index 6ef265cac..30a04ab65 100755 --- a/scripts/propagate_ansible_variables.yml +++ b/scripts/propagate_ansible_variables.yml @@ -14,7 +14,6 @@ loop: - ../roles/container-engine/docker/defaults/main.yml - ../roles/kubernetes/node/defaults/main.yml - - ../roles/kubernetes-apps/argocd/defaults/main.yml - name: Render versions in README.md blockinfile: marker: ''