argocd: simplify manifests apply

ArgoCD upstream manifests do not include namespace for the objects, so
there is no need to override it, and simply using kubectl flags allow to
set it.

Use the upstream file directly , considerably simplifying the argocd
install.

ansible-lint: the refactor apparently newly exposes the password hash
filter to ansible and this needs passlib, so add it to the pre-commit
dependencies.

roles/kubernetes-apps/argocd/tasks/main.yml

@@ -1,95 +1,29 @@
 ---
-- name: Kubernetes Apps | Download yq
-  include_tasks: "../../../download/tasks/download_file.yml"
-  vars:
-    download: "{{ download_defaults | combine(downloads.yq) }}"
-
-- name: Kubernetes Apps | Copy yq binary from download dir
-  copy:
-    src: "{{ downloads.yq.dest }}"
-    dest: "{{ bin_dir }}/yq"
-    mode: "0755"
-    remote_src: true
-
-- name: Kubernetes Apps | Set ArgoCD template list
-  set_fact:
-    argocd_templates:
-      - name: namespace
-        file: argocd-namespace.yml
-      - name: install
-        file: "{{ downloads.argocd_install.dest | basename }}"
-        namespace: "{{ argocd_namespace }}"
-        download: "{{ downloads.argocd_install }}"
-  when:
-    - "inventory_hostname == groups['kube_control_plane'][0]"
-
-- name: Kubernetes Apps | Download ArgoCD remote manifests
-  include_tasks: "../../../download/tasks/download_file.yml"
-  vars:
-    download: "{{ download_defaults | combine(item.download) }}"
-  with_items: "{{ argocd_templates | selectattr('download', 'defined') | list }}"
-  loop_control:
-    label: "{{ item.file }}"
-  when:
-    - "inventory_hostname == groups['kube_control_plane'][0]"
-
-- name: Kubernetes Apps | Copy ArgoCD remote manifests from download dir
-  ansible.posix.synchronize:
-    src: "{{ local_release_dir }}/{{ item.file }}"
-    dest: "{{ kube_config_dir }}/{{ item.file }}"
-    compress: false
-    perms: true
-    owner: false
-    group: false
-  delegate_to: "{{ inventory_hostname }}"
-  with_items: "{{ argocd_templates | selectattr('download', 'defined') | list }}"
-  when:
-    - "inventory_hostname == groups['kube_control_plane'][0]"
-
-- name: Kubernetes Apps | Set ArgoCD namespace for remote manifests
-  become: true
-  command: |
-    {{ bin_dir }}/yq eval-all -i '.metadata.namespace="{{ argocd_namespace }}"' {{ kube_config_dir }}/{{ item.file }}
-  with_items: "{{ argocd_templates | selectattr('download', 'defined') | list }}"
-  loop_control:
-    label: "{{ item.file }}"
-  when:
-    - "inventory_hostname == groups['kube_control_plane'][0]"
-
-- name: Kubernetes Apps | Create ArgoCD manifests from templates
-  become: true
-  template:
-    src: "{{ item.file }}.j2"
-    dest: "{{ kube_config_dir }}/{{ item.file }}"
-    mode: "0644"
-  with_items: "{{ argocd_templates | selectattr('download', 'undefined') | list }}"
-  loop_control:
-    label: "{{ item.file }}"
-  when:
-    - "inventory_hostname == groups['kube_control_plane'][0]"
-
 - name: Kubernetes Apps | Install ArgoCD
-  become: true
-  kube:
-    name: ArgoCD
-    kubectl: "{{ bin_dir }}/kubectl"
-    filename: "{{ kube_config_dir }}/{{ item.file }}"
-    state: latest
-  with_items: "{{ argocd_templates }}"
-  when:
-    - "inventory_hostname == groups['kube_control_plane'][0]"
+  vars:
+    ns_object:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: "{{ argocd_namespace }}"
+        labels:
+          app: argocd
+  command:
+    cmd: >
+      {{ kubectl }} apply -n {{ argocd_namespace }}
+      --server-side=true --force-conflicts --field-manager=kubespray
+      -f - -f {{ downloads.argocd_install.dest }}
+    stdin: "{{ ns_object | to_json }}"
 
 # https://github.com/argoproj/argo-cd/blob/master/docs/faq.md#i-forgot-the-admin-password-how-do-i-reset-it
 - name: Kubernetes Apps | Set ArgoCD custom admin password
-  become: true
-  shell: |
-    {{ bin_dir }}/kubectl --kubeconfig /etc/kubernetes/admin.conf -n {{ argocd_namespace }} patch secret argocd-secret -p \
-      '{
-        "stringData": {
-          "admin.password": "{{ argocd_admin_password | password_hash('bcrypt') }}",
-          "admin.passwordMtime": "'$(date +%FT%T%Z)'"
-        }
-      }'
+  vars:
+    password_patch:
+      stringData:
+        'admin.password': "{{ argocd_admin_password | password_hash('bcrypt') }}"
+        'admin.passwordMtime': "{{ now(utc=true, fmt='%Y-%m-%dT%H:%M:%SZ') }}"
+  command:
+    cmd: "{{ kubectl }} -n {{ argocd_namespace }} patch secret argocd-secret --patch-file=/dev/stdin"
+    stdin: "{{ password_patch | to_json }}"
   when:
     - argocd_admin_password is defined
-    - "inventory_hostname == groups['kube_control_plane'][0]"