argocd: simplify manifests apply

ArgoCD upstream manifests do not include namespace for the objects, so
there is no need to override it, and simply using kubectl flags allow to
set it.

Use the upstream file directly , considerably simplifying the argocd
install.

ansible-lint: the refactor apparently newly exposes the password hash
filter to ansible and this needs passlib, so add it to the pre-commit
dependencies.

.pre-commit-config.yaml

@@ -43,6 +43,7 @@ repos:
           - jmespath==1.0.1
           - netaddr==1.3.0
           - distlib
+          - passlib==1.7.4
 
   - repo: https://github.com/golangci/misspell
     rev: v0.7.0

README.md

@@ -128,7 +128,7 @@ Note:
 - Application
   - [cert-manager](https://github.com/jetstack/cert-manager) 1.15.3
   - [coredns](https://github.com/coredns/coredns) 1.14.6
-  - [argocd](https://argoproj.github.io/) 2.14.5
+  - [argocd](https://argoproj.github.io/) 2.14.21
   - [helm](https://helm.sh/) 3.22.0
   - [metallb](https://metallb.universe.tf/) 0.13.9
   - [registry](https://github.com/distribution/distribution) 2.8.1

roles/kubernetes-apps/argocd/defaults/main.yml

@@ -1,5 +0,0 @@
----
-argocd_enabled: false
-argocd_version: 2.14.5
-argocd_namespace: argocd
-# argocd_admin_password:

roles/kubernetes-apps/argocd/tasks/main.yml

@@ -1,95 +1,29 @@
 ---
-- name: Kubernetes Apps | Download yq
-  include_tasks: "../../../download/tasks/download_file.yml"
-  vars:
-    download: "{{ download_defaults | combine(downloads.yq) }}"
-
-- name: Kubernetes Apps | Copy yq binary from download dir
-  copy:
-    src: "{{ downloads.yq.dest }}"
-    dest: "{{ bin_dir }}/yq"
-    mode: "0755"
-    remote_src: true
-
-- name: Kubernetes Apps | Set ArgoCD template list
-  set_fact:
-    argocd_templates:
-      - name: namespace
-        file: argocd-namespace.yml
-      - name: install
-        file: "{{ downloads.argocd_install.dest | basename }}"
-        namespace: "{{ argocd_namespace }}"
-        download: "{{ downloads.argocd_install }}"
-  when:
-    - "inventory_hostname == groups['kube_control_plane'][0]"
-
-- name: Kubernetes Apps | Download ArgoCD remote manifests
-  include_tasks: "../../../download/tasks/download_file.yml"
-  vars:
-    download: "{{ download_defaults | combine(item.download) }}"
-  with_items: "{{ argocd_templates | selectattr('download', 'defined') | list }}"
-  loop_control:
-    label: "{{ item.file }}"
-  when:
-    - "inventory_hostname == groups['kube_control_plane'][0]"
-
-- name: Kubernetes Apps | Copy ArgoCD remote manifests from download dir
-  ansible.posix.synchronize:
-    src: "{{ local_release_dir }}/{{ item.file }}"
-    dest: "{{ kube_config_dir }}/{{ item.file }}"
-    compress: false
-    perms: true
-    owner: false
-    group: false
-  delegate_to: "{{ inventory_hostname }}"
-  with_items: "{{ argocd_templates | selectattr('download', 'defined') | list }}"
-  when:
-    - "inventory_hostname == groups['kube_control_plane'][0]"
-
-- name: Kubernetes Apps | Set ArgoCD namespace for remote manifests
-  become: true
-  command: |
-    {{ bin_dir }}/yq eval-all -i '.metadata.namespace="{{ argocd_namespace }}"' {{ kube_config_dir }}/{{ item.file }}
-  with_items: "{{ argocd_templates | selectattr('download', 'defined') | list }}"
-  loop_control:
-    label: "{{ item.file }}"
-  when:
-    - "inventory_hostname == groups['kube_control_plane'][0]"
-
-- name: Kubernetes Apps | Create ArgoCD manifests from templates
-  become: true
-  template:
-    src: "{{ item.file }}.j2"
-    dest: "{{ kube_config_dir }}/{{ item.file }}"
-    mode: "0644"
-  with_items: "{{ argocd_templates | selectattr('download', 'undefined') | list }}"
-  loop_control:
-    label: "{{ item.file }}"
-  when:
-    - "inventory_hostname == groups['kube_control_plane'][0]"
-
 - name: Kubernetes Apps | Install ArgoCD
-  become: true
-  kube:
-    name: ArgoCD
-    kubectl: "{{ bin_dir }}/kubectl"
-    filename: "{{ kube_config_dir }}/{{ item.file }}"
-    state: latest
-  with_items: "{{ argocd_templates }}"
-  when:
-    - "inventory_hostname == groups['kube_control_plane'][0]"
+  vars:
+    ns_object:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: "{{ argocd_namespace }}"
+        labels:
+          app: argocd
+  command:
+    cmd: >
+      {{ kubectl }} apply -n {{ argocd_namespace }}
+      --server-side=true --force-conflicts --field-manager=kubespray
+      -f - -f {{ downloads.argocd_install.dest }}
+    stdin: "{{ ns_object | to_json }}"
 
 # https://github.com/argoproj/argo-cd/blob/master/docs/faq.md#i-forgot-the-admin-password-how-do-i-reset-it
 - name: Kubernetes Apps | Set ArgoCD custom admin password
-  become: true
-  shell: |
-    {{ bin_dir }}/kubectl --kubeconfig /etc/kubernetes/admin.conf -n {{ argocd_namespace }} patch secret argocd-secret -p \
-      '{
-        "stringData": {
-          "admin.password": "{{ argocd_admin_password | password_hash('bcrypt') }}",
-          "admin.passwordMtime": "'$(date +%FT%T%Z)'"
-        }
-      }'
+  vars:
+    password_patch:
+      stringData:
+        'admin.password': "{{ argocd_admin_password | password_hash('bcrypt') }}"
+        'admin.passwordMtime': "{{ now(utc=true, fmt='%Y-%m-%dT%H:%M:%SZ') }}"
+  command:
+    cmd: "{{ kubectl }} -n {{ argocd_namespace }} patch secret argocd-secret --patch-file=/dev/stdin"
+    stdin: "{{ password_patch | to_json }}"
   when:
     - argocd_admin_password is defined
-    - "inventory_hostname == groups['kube_control_plane'][0]"

roles/kubernetes-apps/argocd/templates/argocd-namespace.yml.j2

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: {{ argocd_namespace }}
-  labels:
-    app: argocd

roles/kubernetes-apps/meta/main.yml

@@ -114,6 +114,7 @@ dependencies:
       - metallb
 
   - role: kubernetes-apps/argocd
+    become: true
     when:
       - argocd_enabled
       - inventory_hostname == groups['kube_control_plane'][0]

roles/kubespray_defaults/defaults/main/download.yml

@@ -925,8 +925,7 @@ downloads:
   argocd_install:
     enabled: "{{ argocd_enabled }}"
     file: true
-    version: "{{ argocd_version }}"
-    dest: "{{ local_release_dir }}/argocd-install.yml"
+    dest: "{{ local_release_dir }}/argocd-install-{{ argocd_version }}.yml"
     checksum: "{{ argocd_install_checksum }}"
     url: "{{ argocd_install_url }}"
     unarchive: false

roles/kubespray_defaults/defaults/main/main.yml

@@ -475,6 +475,7 @@ expand_persistent_volumes: false
 metallb_enabled: false
 metallb_speaker_enabled: "{{ metallb_enabled }}"
 argocd_enabled: false
+argocd_namespace: argocd
 gateway_api_enabled: false
 prometheus_operator_crds_enabled: false
 

scripts/propagate_ansible_variables.yml

@@ -14,7 +14,6 @@
     loop:
     - ../roles/container-engine/docker/defaults/main.yml
     - ../roles/kubernetes/node/defaults/main.yml
-    - ../roles/kubernetes-apps/argocd/defaults/main.yml
   - name: Render versions in README.md
     blockinfile:
       marker: '<!-- {mark} ANSIBLE MANAGED BLOCK -->'