Skip to content

Commit e88f330

Browse files
mikeshngmikeshng
authored
argocd-agent: update addon with reverse proxy and redis proxy enable. use secrets instead of mounting ca,jwt,tls keys (#53)
Signed-off-by: Mike Ng <ming@redhat.com>
1 parent 7abf564 commit e88f330

7 files changed

Lines changed: 243 additions & 7 deletions

File tree

‎argocd-agent-addon/charts/argocd-agent-addon/templates/agent-addon/agent-redis-secret.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{{- if .Values.agent.redis.secretName }}
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: {{ .Values.agent.redis.secretName }}
6+
namespace: argocd
7+
type: Opaque
8+
data:
9+
{{- if .Values.agent.redis.username }}
10+
username: {{ .Values.agent.redis.username | b64enc | quote }}
11+
{{- end }}
12+
{{- if .Values.agent.redis.password }}
13+
password: {{ .Values.agent.redis.password | b64enc | quote }}
14+
{{- end }}
15+
{{- end }}

‎argocd-agent-addon/charts/argocd-agent-addon/templates/agent-addon/argocd-agent-addon-template.yaml‎

Lines changed: 68 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -127,12 +127,71 @@ spec:
127127
name: argocd-agent-params
128128
key: agent.creds
129129
optional: true
130+
- name: ARGOCD_AGENT_TLS_SECRET_NAME
131+
valueFrom:
132+
configMapKeyRef:
133+
name: argocd-agent-params
134+
key: agent.tls.secret-name
135+
optional: true
136+
- name: ARGOCD_AGENT_TLS_ROOT_CA_SECRET_NAME
137+
valueFrom:
138+
configMapKeyRef:
139+
name: argocd-agent-params
140+
key: agent.tls.root-ca-secret-name
141+
optional: true
142+
- name: ARGOCD_AGENT_METRICS_PORT
143+
valueFrom:
144+
configMapKeyRef:
145+
name: argocd-agent-params
146+
key: agent.metrics.port
147+
optional: true
148+
- name: ARGOCD_AGENT_HEALTH_CHECK_PORT
149+
valueFrom:
150+
configMapKeyRef:
151+
name: argocd-agent-params
152+
key: agent.healthz.port
153+
optional: true
154+
- name: REDIS_ADDR
155+
valueFrom:
156+
configMapKeyRef:
157+
name: argocd-agent-params
158+
key: agent.redis.address
159+
optional: true
160+
{{- if .Values.agent.redis.secretName }}
161+
- name: REDIS_USERNAME
162+
valueFrom:
163+
secretKeyRef:
164+
name: {{ .Values.agent.redis.secretName }}
165+
key: username
166+
optional: true
167+
- name: REDIS_PASSWORD
168+
valueFrom:
169+
secretKeyRef:
170+
name: {{ .Values.agent.redis.secretName }}
171+
key: password
172+
optional: true
173+
{{- else }}
174+
- name: REDIS_USERNAME
175+
valueFrom:
176+
configMapKeyRef:
177+
name: argocd-agent-params
178+
key: agent.redis.username
179+
optional: true
180+
- name: REDIS_PASSWORD
181+
valueFrom:
182+
configMapKeyRef:
183+
name: argocd-agent-params
184+
key: agent.redis.password
185+
optional: true
186+
{{- end }}
130187
image: {{ .Values.global.imageOverrides.argocdAgentImage }}
131188
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
132189
name: argocd-agent-agent
133190
ports:
134-
- containerPort: 8000
191+
- containerPort: 8181
135192
name: metrics
193+
- containerPort: 8002
194+
name: healthz
136195
securityContext:
137196
capabilities:
138197
drop:
@@ -162,7 +221,7 @@ spec:
162221
secret:
163222
secretName: argocd-agent-ca
164223
items:
165-
- key: ca.crt
224+
- key: tls.crt
166225
path: ca.crt
167226
optional: true
168227
- apiVersion: v1
@@ -174,13 +233,20 @@ spec:
174233
agent.mode: {{ .Values.agent.mode | quote }}
175234
agent.creds: "mtls:open-cluster-management:cluster:([^:]+):addon:argocd-agent"
176235
agent.tls.client.insecure: "false"
236+
agent.tls.secret-name: "argocd-agent-client-tls"
237+
agent.tls.root-ca-secret-name: "argocd-agent-ca"
177238
agent.tls.root-ca-path: "/app/config/ca/ca.crt"
178239
agent.tls.client.cert-path: "/app/config/tls/tls.crt"
179240
agent.tls.client.key-path: "/app/config/tls/tls.key"
180241
agent.log.level: "info"
181242
agent.namespace: "argocd"
182243
agent.server.address: {{ .Values.agent.principal.server.address | quote }}
183244
agent.server.port: {{ .Values.agent.principal.server.port | quote }}
245+
agent.metrics.port: "8181"
246+
agent.healthz.port: "8002"
247+
agent.redis.address: {{ .Values.agent.principal.redis.address | default "argocd-redis:6379" | quote }}
248+
agent.redis.username: {{ .Values.agent.redis.username | default "" | quote }}
249+
agent.redis.password: {{ .Values.agent.redis.password | default "" | quote }}
184250
- apiVersion: rbac.authorization.k8s.io/v1
185251
kind: RoleBinding
186252
metadata:

‎argocd-agent-addon/charts/argocd-agent-addon/templates/principal/principal-deployment.yaml‎

Lines changed: 72 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ spec:
2323
- principal
2424
env:
2525
- name: ARGOCD_PRINCIPAL_ENABLE_RESOURCE_PROXY
26-
value: "false"
26+
value: "true"
2727
- name: ARGOCD_PRINCIPAL_LISTEN_HOST
2828
valueFrom:
2929
configMapKeyRef:
@@ -54,6 +54,12 @@ spec:
5454
name: argocd-agent-params
5555
key: principal.metrics.enabled
5656
optional: true
57+
- name: ARGOCD_PRINCIPAL_HEALTH_CHECK_PORT
58+
valueFrom:
59+
configMapKeyRef:
60+
name: argocd-agent-params
61+
key: principal.healthz.port
62+
optional: true
5763
- name: ARGOCD_PRINCIPAL_NAMESPACE
5864
valueFrom:
5965
configMapKeyRef:
@@ -84,6 +90,12 @@ spec:
8490
name: argocd-agent-params
8591
key: principal.namespace-create.labels
8692
optional: true
93+
- name: ARGOCD_PRINCIPAL_TLS_SECRET_NAME
94+
valueFrom:
95+
configMapKeyRef:
96+
name: argocd-agent-params
97+
key: principal.tls.secret-name
98+
optional: true
8799
- name: ARGOCD_PRINCIPAL_TLS_SERVER_CERT_PATH
88100
valueFrom:
89101
configMapKeyRef:
@@ -108,6 +120,12 @@ spec:
108120
name: argocd-agent-params
109121
key: principal.tls.client-cert.require
110122
optional: true
123+
- name: ARGOCD_PRINCIPAL_TLS_SERVER_ROOT_CA_SECRET_NAME
124+
valueFrom:
125+
configMapKeyRef:
126+
name: argocd-agent-params
127+
key: principal.tls.server.root-ca-secret-name
128+
optional: true
111129
- name: ARGOCD_PRINCIPAL_TLS_SERVER_ROOT_CA_PATH
112130
valueFrom:
113131
configMapKeyRef:
@@ -120,12 +138,48 @@ spec:
120138
name: argocd-agent-params
121139
key: principal.tls.client-cert.match-subject
122140
optional: true
141+
- name: ARGOCD_PRINCIPAL_RESOURCE_PROXY_SECRET_NAME
142+
valueFrom:
143+
configMapKeyRef:
144+
name: argocd-agent-params
145+
key: principal.resource-proxy.secret-name
146+
optional: true
147+
- name: ARGOCD_PRINCIPAL_RESOURCE_PROXY_TLS_CERT_PATH
148+
valueFrom:
149+
configMapKeyRef:
150+
name: argocd-agent-params
151+
key: principal.resource-proxy.tls.cert-path
152+
optional: true
153+
- name: ARGOCD_PRINCIPAL_RESOURCE_PROXY_TLS_KEY_PATH
154+
valueFrom:
155+
configMapKeyRef:
156+
name: argocd-agent-params
157+
key: principal.resource-proxy.tls.key-path
158+
optional: true
159+
- name: ARGOCD_PRINCIPAL_RESOURCE_PROXY_CA_SECRET_NAME
160+
valueFrom:
161+
configMapKeyRef:
162+
name: argocd-agent-params
163+
key: principal.resource-proxy.ca.secret-name
164+
optional: true
165+
- name: ARGOCD_PRINCIPAL_RESOURCE_PROXY_CA_PATH
166+
valueFrom:
167+
configMapKeyRef:
168+
name: argocd-agent-params
169+
key: principal.resource-proxy.ca.path
170+
optional: true
123171
- name: ARGOCD_PRINCIPAL_JWT_ALLOW_GENERATE
124172
valueFrom:
125173
configMapKeyRef:
126174
name: argocd-agent-params
127175
key: principal.jwt.allow-generate
128176
optional: true
177+
- name: ARGOCD_PRINCIPAL_JWT_SECRET_NAME
178+
valueFrom:
179+
configMapKeyRef:
180+
name: argocd-agent-params
181+
key: principal.jwt.secret-name
182+
optional: true
129183
- name: ARGOCD_PRINCIPAL_JWT_KEY_PATH
130184
valueFrom:
131185
configMapKeyRef:
@@ -138,6 +192,18 @@ spec:
138192
name: argocd-agent-params
139193
key: principal.auth
140194
optional: true
195+
- name: ARGOCD_PRINCIPAL_REDIS_SERVER_ADDRESS
196+
valueFrom:
197+
configMapKeyRef:
198+
name: argocd-agent-params
199+
key: principal.redis.server.address
200+
optional: true
201+
- name: ARGOCD_PRINCIPAL_REDIS_COMPRESSION_TYPE
202+
valueFrom:
203+
configMapKeyRef:
204+
name: argocd-agent-params
205+
key: principal.redis.compression.type
206+
optional: true
141207
image: {{ .Values.global.imageOverrides.argocdAgentImage }}
142208
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
143209
name: argocd-agent-principal
@@ -146,6 +212,8 @@ spec:
146212
name: principal
147213
- containerPort: 8000
148214
name: metrics
215+
- containerPort: 8003
216+
name: healthz
149217
securityContext:
150218
capabilities:
151219
drop:
@@ -170,6 +238,7 @@ spec:
170238
items:
171239
- key: jwt.key
172240
path: jwt.key
241+
optional: true
173242
- name: tls-secret
174243
secret:
175244
secretName: argocd-agent-tls
@@ -178,9 +247,11 @@ spec:
178247
path: tls.key
179248
- key: tls.crt
180249
path: tls.crt
250+
optional: true
181251
- name: ca-secret
182252
secret:
183253
secretName: argocd-agent-ca
184254
items:
185255
- key: tls.crt
186256
path: ca.crt
257+
optional: true

‎argocd-agent-addon/charts/argocd-agent-addon/templates/principal/principal-healthz-service.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
labels:
5+
app.kubernetes.io/name: argocd-agent-principal
6+
app.kubernetes.io/part-of: argocd-agent
7+
app.kubernetes.io/component: principal
8+
name: argocd-agent-principal-healthz
9+
namespace: argocd
10+
spec:
11+
ports:
12+
- name: healthz
13+
protocol: TCP
14+
port: 8003
15+
targetPort: 8003
16+
selector:
17+
app.kubernetes.io/name: argocd-agent-principal

‎argocd-agent-addon/charts/argocd-agent-addon/templates/principal/principal-metrics-service.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
labels:
5+
app.kubernetes.io/name: argocd-agent-principal
6+
app.kubernetes.io/part-of: argocd-agent
7+
app.kubernetes.io/component: principal
8+
name: argocd-agent-principal-metrics
9+
namespace: argocd
10+
spec:
11+
ports:
12+
- name: metrics
13+
protocol: TCP
14+
port: 8000
15+
targetPort: 8000
16+
selector:
17+
app.kubernetes.io/name: argocd-agent-principal

‎argocd-agent-addon/charts/argocd-agent-addon/templates/principal/principal-params-cm.yaml‎

Lines changed: 42 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@ data:
2020
principal.metrics.port: "8000"
2121
# principal.metrics.enabled: Whether the metrics server should be started.
2222
principal.metrics.enabled: "true"
23+
# principal.healthz.port: The port the health check server should listen on.
24+
# Default: 8003
25+
principal.healthz.port: "8003"
2326
# principal.namespace: The namespace the principal will operate in. If left
2427
# blank, the namespace where the pod is running in will be used.
2528
# Default: ""
@@ -43,6 +46,9 @@ data:
4346
# "key=value". Empty values are not allowed. Multiple labels can be given
4447
# as a comma separated list, e.g. "foo=bar,bar=baz"
4548
principal.namespace-create.labels: ""
49+
# principal.tls.secret-name: The name of the secret containing the TLS certificate and key.
50+
# Default: "argocd-agent-principal-tls"
51+
principal.tls.secret-name: "argocd-agent-principal-tls"
4652
# principal.tls.server.cert-path: Path to the TLS certificate to be used by
4753
# the gRPC server.
4854
# Default: ""
@@ -56,23 +62,49 @@ data:
5662
# configured. This is insecure. Do only use for development.
5763
# Default: false
5864
principal.tls.server.allow-generate: "false"
59-
# principal.tls.server.root-ca-path: Path to a TLS root certificate authority
60-
# to be used to validate agent's client certificates against.
61-
# Default: ""
62-
principal.tls.server.root-ca-path: "/app/config/ca/ca.crt"
6365
# principal.tls.client-cert.require: Whether to require client certs from
6466
# agents upon connection.
6567
# Default: false
6668
principal.tls.client-cert.require: "true"
69+
# principal.tls.server.root-ca-secret-name: The name of the secret containing the root CA TLS certificate.
70+
# Default: "argocd-agent-ca"
71+
principal.tls.server.root-ca-secret-name: "argocd-agent-ca"
72+
# principal.tls.server.root-ca-path: Path to a TLS root certificate authority
73+
# to be used to validate agent's client certificates against.
74+
# Default: ""
75+
principal.tls.server.root-ca-path: "/app/config/ca/ca.crt"
6776
# principal.tls.client-cert.match-subject: Whether to match the subject field
6877
# in a client certificate presented by an agent to the agent's name.
6978
# Default: false
7079
principal.tls.client-cert.match-subject: "false"
80+
# principal.resource-proxy.secret-name: The name of the secret containing
81+
# the TLS certificate and key for the resource proxy.
82+
# Default: "argocd-agent-resource-proxy-tls"
83+
principal.resource-proxy.secret-name: "argocd-agent-resource-proxy-tls"
84+
# principal.resource-proxy.tls.cert-path: Path to the TLS certificate to be used by
85+
# the resource proxy.
86+
# Default: ""
87+
principal.resource-proxy.tls.cert-path: ""
88+
# principal.resource-proxy.tls.key-path: Path to the TLS private key to be used by
89+
# the resource proxy.
90+
# Default: ""
91+
principal.resource-proxy.tls.key-path: ""
92+
# principal.resource-proxy.ca.secret-name: The name of the secret containing
93+
# the CA certificate for the resource proxy.
94+
# Default: "argocd-agent-ca"
95+
principal.resource-proxy.ca.secret-name: "argocd-agent-ca"
96+
# principal.resource-proxy.ca.path: Path to the CA certificate to be used by
97+
# the resource proxy.
98+
# Default: ""
99+
principal.resource-proxy.ca.path: ""
71100
# principal.jwt.allow-generate: Whether to allow the principal to generate
72101
# its own private key for signing JWT tokens. This is insecure. Do only use
73102
# for development.
74103
# Default: false
75104
principal.jwt.allow-generate: "false"
105+
# principal.jwt.secret-name: The name of the secret containing the JWT signing key.
106+
# Default: "argocd-agent-jwt"
107+
principal.jwt.secret-name: "argocd-agent-jwt"
76108
# principal.jwt.key-path: Path to the private key to be used for signing JWT
77109
# tokens.
78110
principal.jwt.key-path: "/app/config/jwt/jwt.key"
@@ -85,3 +117,9 @@ data:
85117
# extracting the agent ID from client cert subject.
86118
# Default: userpass:_path_to_encrypted_creds_
87119
principal.auth: "mtls:open-cluster-management:cluster:([^:]+):addon:argocd-agent"
120+
# principal.redis.server.address: Redis server hostname and port (e.g. argocd-redis:6379).
121+
# Default: "argocd-redis:6379"
122+
principal.redis.server.address: {{ .Values.agent.principal.redis.address | default "argocd-redis:6379" | quote }}
123+
# principal.redis.compression.type: Compression algorithm required by Redis. (possible values: gzip, none. Default value: gzip)
124+
# Default: "gzip"
125+
principal.redis.compression.type: {{ .Values.agent.principal.redis.compressionType | default "gzip" | quote }}

0 commit comments

Comments
 (0)