feat: argo-cd v2.10.11 (#68)

Signed-off-by: Justin Marquis <justin@akuity.io>
akuity · May 24, 2024 · 5466224 · 5466224
1 parent 60ea440
commit 5466224
Show file tree

Hide file tree

Showing 13 changed files with 322 additions and 206 deletions.
diff --git a/charts/argo-cd/Chart.yaml b/charts/argo-cd/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
-version: 2.10.9-ak.0.0
-appVersion: 2.10.9
+version: 2.10.11-ak.0.0
+appVersion: 2.10.11
 description: A Helm chart for ArgoCD, a declarative, GitOps continuous delivery tool for Kubernetes.
 name: argo-cd
 home: https://charts.akuity.io

diff --git a/charts/argo-cd/README.md b/charts/argo-cd/README.md
@@ -1,6 +1,6 @@
 # argo-cd
 
-![Version: 2.8.16-ak.0.0](https://img.shields.io/badge/Version-2.8.16--ak.0.0-informational?style=flat-square) ![AppVersion: 2.8.16](https://img.shields.io/badge/AppVersion-2.8.16-informational?style=flat-square)
+![Version: 2.10.11-ak.0.0](https://img.shields.io/badge/Version-2.10.11--ak.0.0-informational?style=flat-square) ![AppVersion: 2.8.16](https://img.shields.io/badge/AppVersion-2.8.16-informational?style=flat-square)
 
 A Helm chart for ArgoCD, a declarative, GitOps continuous delivery tool for Kubernetes.
 
@@ -60,7 +60,7 @@ A Helm chart for ArgoCD, a declarative, GitOps continuous delivery tool for Kube
 | imageUpdater.enabled | bool | `false` | Whether to enable image updater |
 | notificationsController | object | `{"enabled":true}` | Notifications Controller |
 | notificationsController.enabled | bool | `true` | Whether to enable Notifications Controller |
-| redis | object | `{"enabled":true,"haProxyImage":{"repository":"haproxy","tag":"2.6.14-alpine"},"image":{"pullPolicy":null,"repository":"quay.io/akuity/redis","tag":"7.0.14-alpine"},"resources":null}` | Redis configurations |
+| redis | object | `{"enabled":true,"haProxyImage":{"repository":"haproxy","tag":"2.6.14-alpine"},"image":{"pullPolicy":null,"repository":"quay.io/akuity/redis","tag":"7.0.15-alpine"},"resources":null}` | Redis configurations |
 | repoServer | object | `{"extraArgs":null,"image":{"pullPolicy":null,"repository":null,"tag":null},"replicas":2,"resources":null}` | Repo Server |
 | repoServer.extraArgs | string | `nil` | Additional command line arguments to pass to argocd-repo-server |
 | server | object | `{"enabled":true,"extraArgs":null,"image":{"pullPolicy":null,"repository":null,"tag":null},"ingress":{"annotations":{},"className":"","enabled":false,"host":"argocd.example.com","tls":{"enabled":false,"secretName":null}},"insecure":false,"replicas":2,"resources":null,"service":{"type":null}}` | Argo Server configuration |

diff --git a/charts/argo-cd/templates/application-controller/statefulset.yaml b/charts/argo-cd/templates/application-controller/statefulset.yaml
@@ -47,6 +47,11 @@ spec:
         {{- with .Values.controller.env }}
           {{- toYaml . | nindent 10 }}
         {{- end }}
+        - name: REDIS_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: auth
+              name: argocd-redis
         - name: ARGOCD_CONTROLLER_REPLICAS
           value: {{ .Values.controller.replicas | quote }}
         - name: ARGOCD_RECONCILIATION_TIMEOUT

diff --git a/charts/argo-cd/templates/argocd-server/deployment.yaml b/charts/argo-cd/templates/argocd-server/deployment.yaml
@@ -51,6 +51,11 @@ spec:
         {{- end }}
         - name: ARGOCD_API_SERVER_REPLICAS
           value: {{ .Values.server.replicas | quote }}
+        - name: REDIS_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: auth
+              name: argocd-redis
         - name: ARGOCD_SERVER_INSECURE
           valueFrom:
             configMapKeyRef:

diff --git a/charts/argo-cd/templates/redis-ha/haproxy-config.yaml b/charts/argo-cd/templates/redis-ha/haproxy-config.yaml
diff --git a/charts/argo-cd/templates/redis-ha/haproxy-networkpolicy.yaml b/charts/argo-cd/templates/redis-ha/haproxy-networkpolicy.yaml
@@ -4,21 +4,6 @@ metadata:
   name: argocd-redis-ha-proxy-network-policy
   namespace: {{ .Release.Namespace }}
 spec:
-  egress:
-  - ports:
-    - port: 6379
-      protocol: TCP
-    - port: 26379
-      protocol: TCP
-    to:
-    - podSelector:
-        matchLabels:
-          app.kubernetes.io/name: argocd-redis-ha
-  - ports:
-    - port: 53
-      protocol: UDP
-    - port: 53
-      protocol: TCP
   ingress:
   - from:
     - podSelector:
@@ -40,4 +25,3 @@ spec:
       app.kubernetes.io/name: argocd-redis-ha-haproxy
   policyTypes:
   - Ingress
-  - Egress
diff --git a/charts/argo-cd/templates/redis-ha/haproxy-rbac.yaml b/charts/argo-cd/templates/redis-ha/haproxy-rbac.yaml
@@ -19,6 +19,20 @@ metadata:
   name: argocd-redis-ha-haproxy
   namespace: {{ .Release.Namespace }}
 rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - create
+- apiGroups:
+  - ""
+  resourceNames:
+  - argocd-redis
+  resources:
+  - secrets
+  verbs:
+  - get
 - apiGroups:
   - ""
   resources:

diff --git a/charts/argo-cd/templates/redis-ha/haproxy.yaml b/charts/argo-cd/templates/redis-ha/haproxy.yaml
@@ -18,7 +18,7 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config: 492a6adabb741e0cee39be9aa5155c41a4456629f862d0006a2d892dbecfbcae
+        checksum/config: e34e8124c38bcfd2f16e75620bbde30158686692b13bc449eecc44c51b207d54
         prometheus.io/path: /metrics
         prometheus.io/port: "9101"
         prometheus.io/scrape: "true"
@@ -34,7 +34,13 @@ spec:
                 app.kubernetes.io/name: argocd-redis-ha-haproxy
             topologyKey: kubernetes.io/hostname
       containers:
-      - image: {{ .Values.redis.haProxyImage.repository }}:{{ .Values.redis.haProxyImage.tag }}
+      - env:
+        - name: AUTH
+          valueFrom:
+            secretKeyRef:
+              key: auth
+              name: argocd-redis
+        image: {{ .Values.redis.haProxyImage.repository }}:{{ .Values.redis.haProxyImage.tag }}
         imagePullPolicy: {{ default .Values.global.image.pullPolicy }}
         lifecycle: {}
         livenessProbe:
@@ -69,6 +75,22 @@ spec:
         - mountPath: /run/haproxy
           name: shared-socket
       initContainers:
+      - command:
+        - argocd
+        - admin
+        - redis-initial-password
+        image: quay.io/argoproj/argocd:v2.10.11
+        imagePullPolicy: IfNotPresent
+        name: secret-init
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          seccompProfile:
+            type: RuntimeDefault
       - args:
         - /readonly/haproxy_init.sh
         command:

diff --git a/charts/argo-cd/templates/redis-ha/redis-ha-announce-svcs.yaml b/charts/argo-cd/templates/redis-ha/redis-ha-announce-svcs.yaml
@@ -2,7 +2,6 @@ apiVersion: v1
 kind: Service
 metadata:
   annotations:
-    service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
   labels:
     app.kubernetes.io/component: redis
     app.kubernetes.io/name: argocd-redis-ha
@@ -29,7 +28,6 @@ apiVersion: v1
 kind: Service
 metadata:
   annotations:
-    service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
   labels:
     app.kubernetes.io/component: redis
     app.kubernetes.io/name: argocd-redis-ha
@@ -56,7 +54,6 @@ apiVersion: v1
 kind: Service
 metadata:
   annotations:
-    service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
   labels:
     app.kubernetes.io/component: redis
     app.kubernetes.io/name: argocd-redis-ha

diff --git a/charts/argo-cd/templates/redis-ha/redis-ha-config.yaml b/charts/argo-cd/templates/redis-ha/redis-ha-config.yaml
@@ -11,6 +11,7 @@ data:
   redis_liveness.sh: |
     response=$(
       redis-cli \
+        -a "${AUTH}" --no-auth-warning \
         -h localhost \
         -p 6379 \
         ping
@@ -23,6 +24,7 @@ data:
   redis_readiness.sh: |
     response=$(
       redis-cli \
+        -a "${AUTH}" --no-auth-warning \
         -h localhost \
         -p 6379 \
         ping

diff --git a/charts/argo-cd/templates/redis-ha/redis-ha-rbac.yaml b/charts/argo-cd/templates/redis-ha/redis-ha-rbac.yaml
@@ -7,7 +7,8 @@ metadata:
     app.kubernetes.io/part-of: argocd
   name: argocd-redis-ha
   namespace: {{ .Release.Namespace }}
-
+secrets:
+- name: argocd-redis
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -25,7 +26,6 @@ rules:
   - endpoints
   verbs:
   - get
-
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding

diff --git a/charts/argo-cd/templates/redis-ha/redis-ha-server.yaml b/charts/argo-cd/templates/redis-ha/redis-ha-server.yaml
@@ -17,7 +17,7 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/init-config: 69130412bda04eacad3530cb7bcf26cf121401e725e15d0959dd71a7380afe75
+        checksum/init-config: 9d3c019a5ea1fd98ab5cde397d8eecd351da884f15e6ba346c607cb2446c2198
       labels:
         app.kubernetes.io/name: argocd-redis-ha
     spec:
@@ -34,6 +34,12 @@ spec:
         - /data/conf/redis.conf
         command:
         - redis-server
+        env:
+        - name: AUTH
+          valueFrom:
+            secretKeyRef:
+              name: argocd-redis
+              key: auth
         image: {{ .Values.redis.image.repository }}:{{ .Values.redis.image.tag }}
         imagePullPolicy: {{ default .Values.global.image.pullPolicy }}
         {{- with .Values.redis.resources }}
@@ -92,6 +98,12 @@ spec:
         - /data/conf/sentinel.conf
         command:
         - redis-sentinel
+        env:
+        - name: AUTH
+          valueFrom:
+            secretKeyRef:
+              name: argocd-redis
+              key: auth
         image: {{ .Values.redis.image.repository }}:{{ .Values.redis.image.tag }}
         imagePullPolicy: {{ default .Values.global.image.pullPolicy }}
         lifecycle: {}
@@ -145,6 +157,11 @@ spec:
           value: 40000915ab58c3fa8fd888fb8b24711944e6cbb4
         - name: SENTINEL_ID_2
           value: 2bbec7894d954a8af3bb54d13eaec53cb024e2ca
+        - name: AUTH
+          valueFrom:
+            secretKeyRef:
+              name: argocd-redis
+              key: auth
         image: {{ .Values.redis.image.repository }}:{{ .Values.redis.image.tag }}
         imagePullPolicy: {{ default .Values.global.image.pullPolicy }}
         name: split-brain-fix
@@ -175,6 +192,11 @@ spec:
           value: 40000915ab58c3fa8fd888fb8b24711944e6cbb4
         - name: SENTINEL_ID_2
           value: 2bbec7894d954a8af3bb54d13eaec53cb024e2ca
+        - name: AUTH
+          valueFrom:
+            secretKeyRef:
+              name: argocd-redis
+              key: auth
         image: {{ .Values.redis.image.repository }}:{{ .Values.redis.image.tag }}
         imagePullPolicy: {{ default .Values.global.image.pullPolicy }}
         name: config-init

diff --git a/charts/argo-cd/templates/repo-server/deployment.yaml b/charts/argo-cd/templates/repo-server/deployment.yaml
@@ -46,6 +46,11 @@ spec:
         {{- with .Values.repoServer.env }}
           {{- toYaml . | nindent 10 }}
         {{- end }}
+        - name: REDIS_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: auth
+              name: argocd-redis
         - name: ARGOCD_RECONCILIATION_TIMEOUT
           valueFrom:
             configMapKeyRef: