Revert "argocd-agent: update addon with reverse proxy and redis proxy enable. use secrets instead of mounting ca,jwt,tls keys (open-cluster-management-io#53)" (open-cluster-management-io#66)

This reverts commit e88f330.

Signed-off-by: Mike Ng <ming@redhat.com>

Author: mikeshng

argocd-agent-addon/charts/argocd-agent-addon/templates/agent-addon/agent-redis-secret.yaml

@@ -127,71 +127,12 @@ spec:
                           name: argocd-agent-params
                           key: agent.creds
                           optional: true
-                    - name: ARGOCD_AGENT_TLS_SECRET_NAME
-                      valueFrom:
-                        configMapKeyRef:
-                          name: argocd-agent-params
-                          key: agent.tls.secret-name
-                          optional: true
-                    - name: ARGOCD_AGENT_TLS_ROOT_CA_SECRET_NAME
-                      valueFrom:
-                        configMapKeyRef:
-                          name: argocd-agent-params
-                          key: agent.tls.root-ca-secret-name
-                          optional: true
-                    - name: ARGOCD_AGENT_METRICS_PORT
-                      valueFrom:
-                        configMapKeyRef:
-                          name: argocd-agent-params
-                          key: agent.metrics.port
-                          optional: true
-                    - name: ARGOCD_AGENT_HEALTH_CHECK_PORT
-                      valueFrom:
-                        configMapKeyRef:
-                          name: argocd-agent-params
-                          key: agent.healthz.port
-                          optional: true
-                    - name: REDIS_ADDR
-                      valueFrom:
-                        configMapKeyRef:
-                          name: argocd-agent-params
-                          key: agent.redis.address
-                          optional: true
-                    {{- if .Values.agent.redis.secretName }}
-                    - name: REDIS_USERNAME
-                      valueFrom:
-                        secretKeyRef:
-                          name: {{ .Values.agent.redis.secretName }}
-                          key: username
-                          optional: true
-                    - name: REDIS_PASSWORD
-                      valueFrom:
-                        secretKeyRef:
-                          name: {{ .Values.agent.redis.secretName }}
-                          key: password
-                          optional: true
-                    {{- else }}
-                    - name: REDIS_USERNAME
-                      valueFrom:
-                        configMapKeyRef:
-                          name: argocd-agent-params
-                          key: agent.redis.username
-                          optional: true
-                    - name: REDIS_PASSWORD
-                      valueFrom:
-                        configMapKeyRef:
-                          name: argocd-agent-params
-                          key: agent.redis.password
-                          optional: true
-                    {{- end }}
                     image: {{ .Values.global.imageOverrides.argocdAgentImage }}
                     imagePullPolicy: {{ .Values.global.imagePullPolicy }}
                     name: argocd-agent-agent
                     ports:
-                      - containerPort: 8181
+                      - containerPort: 8000
                         name: metrics
-                      - containerPort: 8002
-                        name: healthz
                     securityContext:
                       capabilities:
                         drop:
@@ -221,7 +162,7 @@ spec:
                   secret:
                     secretName: argocd-agent-ca
                     items:
-                    - key: tls.crt
+                    - key: ca.crt
                       path: ca.crt
                     optional: true
         - apiVersion: v1
@@ -233,20 +174,13 @@ spec:
             agent.mode: {{ .Values.agent.mode | quote }}
             agent.creds: "mtls:open-cluster-management:cluster:([^:]+):addon:argocd-agent"
             agent.tls.client.insecure: "false"
-            agent.tls.secret-name: "argocd-agent-client-tls"
-            agent.tls.root-ca-secret-name: "argocd-agent-ca"
             agent.tls.root-ca-path: "/app/config/ca/ca.crt"
             agent.tls.client.cert-path: "/app/config/tls/tls.crt"
             agent.tls.client.key-path: "/app/config/tls/tls.key"
             agent.log.level: "info"
             agent.namespace: "argocd"
             agent.server.address: {{ .Values.agent.principal.server.address | quote }}
             agent.server.port: {{ .Values.agent.principal.server.port | quote }}
-            agent.metrics.port: "8181"
-            agent.healthz.port: "8002"
-            agent.redis.address: {{ .Values.agent.principal.redis.address | default "argocd-redis:6379" | quote }}
-            agent.redis.username: {{ .Values.agent.redis.username | default "" | quote }}
-            agent.redis.password: {{ .Values.agent.redis.password | default "" | quote }}
         - apiVersion: rbac.authorization.k8s.io/v1
           kind: RoleBinding
           metadata:

argocd-agent-addon/charts/argocd-agent-addon/templates/agent-addon/argocd-agent-addon-template.yaml

@@ -23,7 +23,7 @@ spec:
             - principal
           env:
           - name: ARGOCD_PRINCIPAL_ENABLE_RESOURCE_PROXY
-            value: "true"
+            value: "false"
           - name: ARGOCD_PRINCIPAL_LISTEN_HOST
             valueFrom:
               configMapKeyRef:
@@ -54,12 +54,6 @@ spec:
                 name: argocd-agent-params
                 key: principal.metrics.enabled
                 optional: true
-          - name: ARGOCD_PRINCIPAL_HEALTH_CHECK_PORT
-            valueFrom:
-              configMapKeyRef:
-                name: argocd-agent-params
-                key: principal.healthz.port
-                optional: true
           - name: ARGOCD_PRINCIPAL_NAMESPACE
             valueFrom:
               configMapKeyRef:
@@ -90,12 +84,6 @@ spec:
                 name: argocd-agent-params
                 key: principal.namespace-create.labels
                 optional: true
-          - name: ARGOCD_PRINCIPAL_TLS_SECRET_NAME
-            valueFrom:
-              configMapKeyRef:
-                name: argocd-agent-params
-                key: principal.tls.secret-name
-                optional: true
           - name: ARGOCD_PRINCIPAL_TLS_SERVER_CERT_PATH
             valueFrom:
               configMapKeyRef:
@@ -120,12 +108,6 @@ spec:
                 name: argocd-agent-params
                 key: principal.tls.client-cert.require
                 optional: true
-          - name: ARGOCD_PRINCIPAL_TLS_SERVER_ROOT_CA_SECRET_NAME
-            valueFrom:
-              configMapKeyRef:
-                name: argocd-agent-params
-                key: principal.tls.server.root-ca-secret-name
-                optional: true
           - name: ARGOCD_PRINCIPAL_TLS_SERVER_ROOT_CA_PATH
             valueFrom:
               configMapKeyRef:
@@ -138,48 +120,12 @@ spec:
                 name: argocd-agent-params
                 key: principal.tls.client-cert.match-subject
                 optional: true
-          - name: ARGOCD_PRINCIPAL_RESOURCE_PROXY_SECRET_NAME
-            valueFrom:
-              configMapKeyRef:
-                name: argocd-agent-params
-                key: principal.resource-proxy.secret-name
-                optional: true
-          - name: ARGOCD_PRINCIPAL_RESOURCE_PROXY_TLS_CERT_PATH
-            valueFrom:
-              configMapKeyRef:
-                name: argocd-agent-params
-                key: principal.resource-proxy.tls.cert-path
-                optional: true
-          - name: ARGOCD_PRINCIPAL_RESOURCE_PROXY_TLS_KEY_PATH
-            valueFrom:
-              configMapKeyRef:
-                name: argocd-agent-params
-                key: principal.resource-proxy.tls.key-path
-                optional: true
-          - name: ARGOCD_PRINCIPAL_RESOURCE_PROXY_CA_SECRET_NAME
-            valueFrom:
-              configMapKeyRef:
-                name: argocd-agent-params
-                key: principal.resource-proxy.ca.secret-name
-                optional: true
-          - name: ARGOCD_PRINCIPAL_RESOURCE_PROXY_CA_PATH
-            valueFrom:
-              configMapKeyRef:
-                name: argocd-agent-params
-                key: principal.resource-proxy.ca.path
-                optional: true
           - name: ARGOCD_PRINCIPAL_JWT_ALLOW_GENERATE
             valueFrom:
               configMapKeyRef:
                 name: argocd-agent-params
                 key: principal.jwt.allow-generate
                 optional: true
-          - name: ARGOCD_PRINCIPAL_JWT_SECRET_NAME
-            valueFrom:
-              configMapKeyRef:
-                name: argocd-agent-params
-                key: principal.jwt.secret-name
-                optional: true
           - name: ARGOCD_PRINCIPAL_JWT_KEY_PATH
             valueFrom:
               configMapKeyRef:
@@ -192,18 +138,6 @@ spec:
                 name: argocd-agent-params
                 key: principal.auth
                 optional: true
-          - name: ARGOCD_PRINCIPAL_REDIS_SERVER_ADDRESS
-            valueFrom:
-              configMapKeyRef:
-                name: argocd-agent-params
-                key: principal.redis.server.address
-                optional: true
-          - name: ARGOCD_PRINCIPAL_REDIS_COMPRESSION_TYPE
-            valueFrom:
-              configMapKeyRef:
-                name: argocd-agent-params
-                key: principal.redis.compression.type
-                optional: true
           image: {{ .Values.global.imageOverrides.argocdAgentImage }}
           imagePullPolicy: {{ .Values.global.imagePullPolicy }}
           name: argocd-agent-principal
@@ -212,8 +146,6 @@ spec:
               name: principal
             - containerPort: 8000
               name: metrics
-            - containerPort: 8003
-              name: healthz
           securityContext:
             capabilities:
               drop:
@@ -238,7 +170,6 @@ spec:
           items:
           - key: jwt.key
             path: jwt.key
-          optional: true
       - name: tls-secret
         secret:
           secretName: argocd-agent-tls
@@ -247,11 +178,9 @@ spec:
             path: tls.key
           - key: tls.crt
             path: tls.crt
-          optional: true
       - name: ca-secret
         secret:
           secretName: argocd-agent-ca
           items:
           - key: tls.crt
             path: ca.crt
-          optional: true

argocd-agent-addon/charts/argocd-agent-addon/templates/principal/principal-deployment.yaml

@@ -20,9 +20,6 @@ data:
   principal.metrics.port: "8000"
   # principal.metrics.enabled: Whether the metrics server should be started.
   principal.metrics.enabled: "true"
-  # principal.healthz.port: The port the health check server should listen on.
-  # Default: 8003
-  principal.healthz.port: "8003"
   # principal.namespace: The namespace the principal will operate in. If left
   # blank, the namespace where the pod is running in will be used.
   # Default: ""
@@ -46,9 +43,6 @@ data:
   # "key=value". Empty values are not allowed. Multiple labels can be given
   # as a comma separated list, e.g. "foo=bar,bar=baz"
   principal.namespace-create.labels: ""
-  # principal.tls.secret-name: The name of the secret containing the TLS certificate and key.
-  # Default: "argocd-agent-principal-tls"
-  principal.tls.secret-name: "argocd-agent-principal-tls"
   # principal.tls.server.cert-path: Path to the TLS certificate to be used by
   # the gRPC server.
   # Default: ""
@@ -62,49 +56,23 @@ data:
   # configured. This is insecure. Do only use for development.
   # Default: false
   principal.tls.server.allow-generate: "false"
-  # principal.tls.client-cert.require: Whether to require client certs from
-  # agents upon connection.
-  # Default: false
-  principal.tls.client-cert.require: "true"
-  # principal.tls.server.root-ca-secret-name: The name of the secret containing the root CA TLS certificate.
-  # Default: "argocd-agent-ca"
-  principal.tls.server.root-ca-secret-name: "argocd-agent-ca"
   # principal.tls.server.root-ca-path: Path to a TLS root certificate authority
   # to be used to validate agent's client certificates against.
   # Default: ""
   principal.tls.server.root-ca-path: "/app/config/ca/ca.crt"
+  # principal.tls.client-cert.require: Whether to require client certs from
+  # agents upon connection.
+  # Default: false
+  principal.tls.client-cert.require: "true"
   # principal.tls.client-cert.match-subject: Whether to match the subject field
   # in a client certificate presented by an agent to the agent's name.
   # Default: false
   principal.tls.client-cert.match-subject: "false"
-  # principal.resource-proxy.secret-name: The name of the secret containing
-  # the TLS certificate and key for the resource proxy.
-  # Default: "argocd-agent-resource-proxy-tls"
-  principal.resource-proxy.secret-name: "argocd-agent-resource-proxy-tls"
-  # principal.resource-proxy.tls.cert-path: Path to the TLS certificate to be used by
-  # the resource proxy.
-  # Default: ""
-  principal.resource-proxy.tls.cert-path: ""
-  # principal.resource-proxy.tls.key-path: Path to the TLS private key to be used by
-  # the resource proxy.
-  # Default: ""
-  principal.resource-proxy.tls.key-path: ""
-  # principal.resource-proxy.ca.secret-name: The name of the secret containing
-  # the CA certificate for the resource proxy.
-  # Default: "argocd-agent-ca"
-  principal.resource-proxy.ca.secret-name: "argocd-agent-ca"
-  # principal.resource-proxy.ca.path: Path to the CA certificate to be used by
-  # the resource proxy.
-  # Default: ""
-  principal.resource-proxy.ca.path: ""
   # principal.jwt.allow-generate: Whether to allow the principal to generate
   # its own private key for signing JWT tokens. This is insecure. Do only use
   # for development.
   # Default: false
   principal.jwt.allow-generate: "false"
-  # principal.jwt.secret-name: The name of the secret containing the JWT signing key.
-  # Default: "argocd-agent-jwt"
-  principal.jwt.secret-name: "argocd-agent-jwt"
   # principal.jwt.key-path: Path to the private key to be used for signing JWT
   # tokens.
   principal.jwt.key-path: "/app/config/jwt/jwt.key"
@@ -117,9 +85,3 @@ data:
   #   extracting the agent ID from client cert subject.
   # Default: userpass:_path_to_encrypted_creds_
   principal.auth: "mtls:open-cluster-management:cluster:([^:]+):addon:argocd-agent"
-  # principal.redis.server.address: Redis server hostname and port (e.g. argocd-redis:6379).
-  # Default: "argocd-redis:6379"
-  principal.redis.server.address: {{ .Values.agent.principal.redis.address | default "argocd-redis:6379" | quote }}
-  # principal.redis.compression.type: Compression algorithm required by Redis. (possible values: gzip, none. Default value: gzip)
-  # Default: "gzip"
-  principal.redis.compression.type: {{ .Values.agent.principal.redis.compressionType | default "gzip" | quote }}