Skip to content

Commit e8a7411

Browse files
olivergondzaolivergondza
authored
feat(redis): Inject creds to agent via volume (argoproj-labs#2113)
* feat(redis): Inject admin password to Redis components through volume mount Signed-off-by: Oliver Gondža <ogondza@gmail.com> * feat(redis): pass redis creds to argo-cd components via volume, not envvar Signed-off-by: Oliver Gondža <ogondza@gmail.com> * chore(redis): Collect shared redis building blocks in the same file Signed-off-by: Oliver Gondža <ogondza@gmail.com> * tests(redis): Verify credentials are correctly distributed to redis Signed-off-by: Oliver Gondža <ogondza@gmail.com> * core(redis): Address review comments Signed-off-by: Oliver Gondža <ogondza@gmail.com> * feat(redis): Pass credentials to redis using aclfile Signed-off-by: Oliver Gondža <ogondza@gmail.com> * fix: Tests Signed-off-by: Oliver Gondža <ogondza@gmail.com> * chore(agent): Bring back REDIS_PASSWORD distribution via envvar Agent is not ready yet. Ref.: https://issues.redhat.com/browse/GITOPS-9070 Signed-off-by: Oliver Gondža <ogondza@gmail.com> * feat(redis): Fix channel config in users.acl Signed-off-by: Oliver Gondža <ogondza@gmail.com> * fix(tests): Defend against random failures caused by sentinel.conf rewrites Signed-off-by: Oliver Gondža <ogondza@gmail.com> * fix(tests): Tune the tests to updated volume passing some more Signed-off-by: Oliver Gondža <ogondza@gmail.com> * feat(redis): Check password injection before every use Signed-off-by: Oliver Gondža <ogondza@gmail.com> * chore(deps): Pull latest argocd-agent for the REDIS_CREDS_DIR_PATH support Signed-off-by: Oliver Gondža <ogondza@gmail.com> * feat(agent): configure redis credentials using REDIS_CREDS_DIR_PATH Signed-off-by: Oliver Gondža <ogondza@gmail.com> * Make sure the agent/principal redis volumes and their mounts get reconciled Signed-off-by: Oliver Gondža <ogondza@gmail.com> * chore(deps): Bump agent version to 0.8 Signed-off-by: Oliver Gondža <ogondza@gmail.com> * chore(deps): Bump agent version to 0.8.1 Signed-off-by: Oliver Gondža <ogondza@gmail.com> --------- Signed-off-by: Oliver Gondža <ogondza@gmail.com>
1 parent 8bda8b1 commit e8a7411

9 files changed

Lines changed: 42 additions & 49 deletions

‎controllers/argocdagent/agent/deployment.go‎

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -345,18 +345,6 @@ func buildAgentContainerEnv(cr *argoproj.ArgoCD) []corev1.EnvVar {
345345
{
346346
Name: EnvArgoCDAgentEnableResourceProxy,
347347
Value: "true",
348-
}, {
349-
// TODO: Convert to volume mount once possible: https://issues.redhat.com/browse/GITOPS-9070
350-
Name: "REDIS_PASSWORD",
351-
ValueFrom: &corev1.EnvVarSource{
352-
SecretKeyRef: &corev1.SecretKeySelector{
353-
Key: "auth",
354-
LocalObjectReference: corev1.LocalObjectReference{
355-
Name: fmt.Sprintf("%s-%s", cr.Name, "redis-initial-password"),
356-
},
357-
Optional: ptr.To(true),
358-
},
359-
},
360348
},
361349
{
362350
Name: EnvArgoCDAgentDestinationBasedMap,
@@ -372,6 +360,8 @@ func buildAgentContainerEnv(cr *argoproj.ArgoCD) []corev1.EnvVar {
372360
},
373361
}
374362

363+
env = append(env, argoutil.GetRedisAuthEnv()...)
364+
375365
// Add custom environment variables if specified in the CR
376366
if hasAgent(cr) && cr.Spec.ArgoCDAgent.Agent.Env != nil {
377367
env = append(env, cr.Spec.ArgoCDAgent.Agent.Env...)

‎controllers/argocdagent/agent/deployment_test.go‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -379,11 +379,6 @@ func TestReconcileAgentDeployment_VerifyDeploymentSpec(t *testing.T) {
379379
// Verify some expected environment variables are present
380380
envNames := make(map[string]bool)
381381
for _, env := range container.Env {
382-
// TODO: Convert to volume mount once possible: https://issues.redhat.com/browse/GITOPS-9070
383-
if env.Name == "REDIS_PASSWORD" {
384-
continue
385-
}
386-
387382
envNames[env.Name] = true
388383
// All environment variables should have direct values, not references
389384
assert.Nil(t, env.ValueFrom, "Environment variable %s should have direct value, not reference", env.Name)

‎controllers/argocdagent/deployment.go‎

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -374,21 +374,11 @@ func buildPrincipalContainerEnv(cr *argoproj.ArgoCD) []corev1.EnvVar {
374374
}, {
375375
Name: EnvArgoCDPrincipalDestinationBasedMapping,
376376
Value: getPrincipalDestinationBasedMapping(cr),
377-
}, {
378-
// TODO: Convert to volume mount once possible: https://issues.redhat.com/browse/GITOPS-9070
379-
Name: "REDIS_PASSWORD",
380-
ValueFrom: &corev1.EnvVarSource{
381-
SecretKeyRef: &corev1.SecretKeySelector{
382-
Key: "auth",
383-
LocalObjectReference: corev1.LocalObjectReference{
384-
Name: fmt.Sprintf("%s-%s", cr.Name, "redis-initial-password"),
385-
},
386-
Optional: ptr.To(true),
387-
},
388-
},
389377
},
390378
}
391379

380+
env = append(env, argoutil.GetRedisAuthEnv()...)
381+
392382
// Add custom environment variables if specified in the CR
393383
if hasPrincipal(cr) && cr.Spec.ArgoCDAgent.Principal.Env != nil {
394384
env = append(env, cr.Spec.ArgoCDAgent.Principal.Env...)

‎controllers/argocdagent/deployment_test.go‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -383,18 +383,12 @@ func TestReconcilePrincipalDeployment_VerifyDeploymentSpec(t *testing.T) {
383383
// Verify some expected environment variables are present
384384
envNames := make(map[string]bool)
385385
for _, env := range container.Env {
386-
// TODO: Convert to volume mount once possible: https://issues.redhat.com/browse/GITOPS-9070
387-
if env.Name == "REDIS_PASSWORD" {
388-
continue
389-
}
390-
391386
envNames[env.Name] = true
392387
// All environment variables should have direct values, not references
393388
assert.Nil(t, env.ValueFrom, "Environment variable %s should have direct value, not reference", env.Name)
394389
}
395390
// Check for some environment variables
396391
assert.True(t, envNames["ARGOCD_PRINCIPAL_NAMESPACE"], "ARGOCD_PRINCIPAL_NAMESPACE should be set")
397-
// TODO: Convert to volume mount once possible: https://issues.redhat.com/browse/GITOPS-9070
398392
assert.False(t, envNames["REDIS_PASSWORD"], "REDIS_PASSWORD should not be set")
399393

400394
// Verify volume mounts

‎go.mod‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ require (
3434
require (
3535
cel.dev/expr v0.25.1 // indirect
3636
cyphar.com/go-pathrs v0.2.1 // indirect
37+
github.com/alicebob/miniredis/v2 v2.36.1 // indirect
3738
github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
3839
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
3940
github.com/chainguard-dev/git-urls v1.0.2 // indirect
@@ -59,6 +60,7 @@ require (
5960
go.opentelemetry.io/otel/metric v1.40.0 // indirect
6061
go.opentelemetry.io/otel/sdk v1.40.0 // indirect
6162
go.opentelemetry.io/proto/otlp v1.7.1 // indirect
63+
go.uber.org/atomic v1.11.0 // indirect
6264
golang.org/x/exp v0.0.0-20250718183923-645b1fa84792 // indirect
6365
google.golang.org/genproto v0.0.0-20240401170217-c3f982113cda // indirect
6466
google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect
@@ -160,7 +162,7 @@ require (
160162
github.com/prometheus/client_model v0.6.2 // indirect
161163
github.com/prometheus/common v0.66.1 // indirect
162164
github.com/prometheus/procfs v0.17.0 // indirect
163-
github.com/redis/go-redis/v9 v9.8.0 // indirect
165+
github.com/redis/go-redis/v9 v9.18.0 // indirect
164166
github.com/robfig/cron/v3 v3.0.2-0.20210106135023-bc59245fe10e // indirect
165167
github.com/russross/blackfriday/v2 v2.1.0 // indirect
166168
github.com/sergi/go-diff v1.4.0 // indirect

‎go.sum‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@ github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERo
3232
github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
3333
github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNxpLfdw=
3434
github.com/ProtonMail/go-crypto v1.1.6/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
35-
github.com/alicebob/miniredis/v2 v2.35.0 h1:QwLphYqCEAo1eu1TqPRN2jgVMPBweeQcR21jeqDCONI=
36-
github.com/alicebob/miniredis/v2 v2.35.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
35+
github.com/alicebob/miniredis/v2 v2.36.1 h1:Dvc5oAnNOr7BIfPn7tF269U8DvRW1dBG2D5n0WrfYMI=
36+
github.com/alicebob/miniredis/v2 v2.36.1/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
3737
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
3838
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
3939
github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
@@ -275,6 +275,8 @@ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+o
275275
github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
276276
github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
277277
github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
278+
github.com/klauspost/cpuid/v2 v2.2.9 h1:66ze0taIn2H33fBvCkXuv9BmCwDfafmiIVpKV9kKGuY=
279+
github.com/klauspost/cpuid/v2 v2.2.9/go.mod h1:rqkxqrZ1EhYM9G+hXH7YdowN5R5RGN6NK4QwQ3WMXF8=
278280
github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
279281
github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
280282
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -385,8 +387,8 @@ github.com/prometheus/procfs v0.17.0/go.mod h1:oPQLaDAMRbA+u8H5Pbfq+dl3VDAvHxMUO
385387
github.com/r3labs/diff/v3 v3.0.2 h1:yVuxAY1V6MeM4+HNur92xkS39kB/N+cFi2hMkY06BbA=
386388
github.com/r3labs/diff/v3 v3.0.2/go.mod h1:Cy542hv0BAEmhDYWtGxXRQ4kqRsVIcEjG9gChUlTmkw=
387389
github.com/redis/go-redis/v9 v9.0.0-rc.4/go.mod h1:Vo3EsyWnicKnSKCA7HhgnvnyA74wOA69Cd2Meli5mmA=
388-
github.com/redis/go-redis/v9 v9.8.0 h1:q3nRvjrlge/6UD7eTu/DSg2uYiU2mCL0G/uzBWqhicI=
389-
github.com/redis/go-redis/v9 v9.8.0/go.mod h1:huWgSWd8mW6+m0VPhJjSSQ+d6Nh1VICQ6Q5lHuCH/Iw=
390+
github.com/redis/go-redis/v9 v9.18.0 h1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=
391+
github.com/redis/go-redis/v9 v9.18.0/go.mod h1:k3ufPphLU5YXwNTUcCRXGxUoF1fqxnhFQmscfkCoDA0=
390392
github.com/robfig/cron/v3 v3.0.2-0.20210106135023-bc59245fe10e h1:0xChnl3lhHiXbgSJKgChye0D+DvoItkOdkGcwelDXH0=
391393
github.com/robfig/cron/v3 v3.0.2-0.20210106135023-bc59245fe10e/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
392394
github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
@@ -451,6 +453,8 @@ github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd
451453
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
452454
github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=
453455
github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
456+
github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=
457+
github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=
454458
go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
455459
go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
456460
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 h1:YH4g8lQroajqUwWbq/tr2QX1JFmEXaDLgG+ew9bLMWo=
@@ -471,6 +475,8 @@ go.opentelemetry.io/otel/sdk/metric v1.40.0 h1:mtmdVqgQkeRxHgRv4qhyJduP3fYJRMX4A
471475
go.opentelemetry.io/otel/sdk/metric v1.40.0/go.mod h1:4Z2bGMf0KSK3uRjlczMOeMhKU2rhUqdWNoKcYrtcBPg=
472476
go.opentelemetry.io/otel/trace v1.40.0 h1:WA4etStDttCSYuhwvEa8OP8I5EWu24lkOzp+ZYblVjw=
473477
go.opentelemetry.io/otel/trace v1.40.0/go.mod h1:zeAhriXecNGP/s2SEG3+Y8X9ujcJOTqQ5RgdEJcawiA=
478+
go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
479+
go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
474480
go.opentelemetry.io/proto/otlp v1.7.1 h1:gTOMpGDb0WTBOP8JaO72iL3auEZhVmAQg4ipjOVAtj4=
475481
go.opentelemetry.io/proto/otlp v1.7.1/go.mod h1:b2rVh6rfI/s2pHWNlB7ILJcRALpcNDzKhACevjI+ZnE=
476482
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=

‎tests/ginkgo/sequential/1-051_validate_argocd_agent_principal_test.go‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -382,10 +382,9 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
382382
Expect(container.Env).To(ContainElement(corev1.EnvVar{Name: key, Value: value}), "Environment variable %s should be set to %s", key, value)
383383
}
384384

385-
// TODO: Convert to volume mount once possible: https://issues.redhat.com/browse/GITOPS-9070
386-
//Expect(container.Env).NotTo(ContainElement(
387-
// HaveField("Name", "REDIS_PASSWORD"),
388-
//), "REDIS_PASSWORD should not be set")
385+
Expect(container.Env).NotTo(ContainElement(
386+
HaveField("Name", "REDIS_PASSWORD"),
387+
), "REDIS_PASSWORD should not be set")
389388

390389
By("Disable principal")
391390

‎tests/ginkgo/sequential/1-052_validate_argocd_agent_agent_test.go‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -344,10 +344,9 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
344344
Expect(container.Env).To(ContainElement(corev1.EnvVar{Name: key, Value: value}), "Environment variable %s should be set to %s", key, value)
345345
}
346346

347-
// TODO: Convert to volume mount once possible: https://issues.redhat.com/browse/GITOPS-9070
348-
//Expect(container.Env).NotTo(ContainElement(
349-
// HaveField("Name", "REDIS_PASSWORD"),
350-
//), "REDIS_PASSWORD should not be set")
347+
Expect(container.Env).NotTo(ContainElement(
348+
HaveField("Name", "REDIS_PASSWORD"),
349+
), "REDIS_PASSWORD should not be set")
351350

352351
By("Verify custom environment variable is present")
353352

‎tests/ginkgo/sequential/1-053_validate_argocd_agent_principal_connected_test.go‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ import (
3939
"k8s.io/utils/ptr"
4040
"sigs.k8s.io/controller-runtime/pkg/client"
4141

42+
osFixture "github.com/argoproj-labs/argocd-operator/tests/ginkgo/fixture/os"
43+
4244
"github.com/argoproj/argo-cd/v3/pkg/apiclient/application"
4345
argocdv1alpha1 "github.com/argoproj/argo-cd/v3/pkg/apis/application/v1alpha1"
4446
"github.com/argoproj/gitops-engine/pkg/health"
@@ -302,6 +304,23 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
302304
cancellableContext, cancelFunc := context.WithCancel(context.Background())
303305
defer cancelFunc()
304306

307+
injectedRedisPwd, err := osFixture.ExecCommandWithOutputParam(
308+
false, false,
309+
"kubectl", "exec", "deployment/argocd-hub-agent-principal", "-n", namespaceAgentPrincipal,
310+
"--", "cat", "/app/config/redis-auth/auth",
311+
)
312+
Expect(err).NotTo(HaveOccurred())
313+
Expect(strings.TrimSpace(injectedRedisPwd)).ToNot(BeEmpty())
314+
315+
principalEnv, err := osFixture.ExecCommandWithOutputParam(
316+
false, false,
317+
"kubectl", "exec", "deployment/argocd-hub-agent-principal", "-n", namespaceAgentPrincipal,
318+
"--", "cat", "/proc/1/environ",
319+
)
320+
Expect(err).NotTo(HaveOccurred())
321+
Expect(principalEnv).To(ContainSubstring("REDIS_CREDS_DIR_PATH=/app/config/redis-auth/"))
322+
Expect(principalEnv).NotTo(ContainSubstring("REDIS_PASSWORD"))
323+
305324
resourceTreeURL := "https://" + argoEndpoint + "/api/v1/stream/applications/" + appOnPrincipal.Name + "/resource-tree?appNamespace=" + appOnPrincipal.Namespace
306325

307326
// Wait for successful connection to resource tree event source API, on principal Argo CD
@@ -439,7 +458,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
439458
}
440459
}
441460
Expect(matchFound).To(BeTrue())
442-
443461
}
444462

445463
// This test verifies that:

0 commit comments

Comments
 (0)