Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: update config management plugin docs #11690

Merged
merged 7 commits into from
Feb 6, 2023
Merged
Show file tree
Hide file tree
Changes from 3 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion cmd/argocd/commands/app.go
Original file line number Diff line number Diff line change
Expand Up @@ -967,7 +967,7 @@ func NewApplicationDiffCommand(clientOpts *argocdclient.ClientOptions) *cobra.Co

diffOption.serversideRes = res
} else {
fmt.Fprintf(os.Stderr, "Warning: local diff without --server-side-generate is deprecated and does not work with plugins. Server-side generation will be the default in v2.6.")
fmt.Fprintf(os.Stderr, "Warning: local diff without --server-side-generate is deprecated and does not work with plugins. Server-side generation will be the default in v2.7.")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
fmt.Fprintf(os.Stderr, "Warning: local diff without --server-side-generate is deprecated and does not work with plugins. Server-side generation will be the default in v2.7.")
fmt.Fprintf(os.Stderr, "Warning: local diff without --server-side-generate is deprecated and does not work with plugins. Server-side generation will hopefully be the default in v2.7.")

conn, clusterIf := clientset.NewClusterClientOrDie()
defer argoio.Close(conn)
cluster, err := clusterIf.Get(ctx, &clusterpkg.ClusterQuery{Name: app.Spec.Destination.Name, Server: app.Spec.Destination.Server})
Expand Down
4 changes: 2 additions & 2 deletions common/common.go
Original file line number Diff line number Diff line change
Expand Up @@ -222,11 +222,11 @@ const (
// DefaultCMPWorkDirName defines the work directory name used by the cmp-server
DefaultCMPWorkDirName = "_cmp_server"

ConfigMapPluginDeprecationWarning = "argocd-cm plugins are deprecated, and support will be removed in v2.6. Upgrade your plugin to be installed via sidecar. https://argo-cd.readthedocs.io/en/stable/user-guide/config-management-plugins/"
ConfigMapPluginDeprecationWarning = "argocd-cm plugins are deprecated, and support will be removed in v2.7. Upgrade your plugin to be installed via sidecar. https://argo-cd.readthedocs.io/en/stable/user-guide/config-management-plugins/"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
ConfigMapPluginDeprecationWarning = "argocd-cm plugins are deprecated, and support will be removed in v2.7. Upgrade your plugin to be installed via sidecar. https://argo-cd.readthedocs.io/en/stable/user-guide/config-management-plugins/"
ConfigMapPluginDeprecationWarning = "argocd-cm plugins are deprecated, and support will hopefully be removed in v2.7. Upgrade your plugin to be installed via sidecar. https://argo-cd.readthedocs.io/en/stable/user-guide/config-management-plugins/"


ConfigMapPluginCLIDeprecationWarning = "spec.plugin.name is set, which means this Application uses a plugin installed in the " +
"argocd-cm ConfigMap. Installing plugins via that ConfigMap is deprecated in Argo CD v2.5. " +
"Starting in Argo CD v2.6, this Application will fail to sync. Contact your Argo CD admin " +
"Starting in Argo CD v2.7, this Application will fail to sync. Contact your Argo CD admin " +
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This form of the text should only have been used once 2.7 removed the feature.

Suggested change
"Starting in Argo CD v2.7, this Application will fail to sync. Contact your Argo CD admin " +
"It is expected that as of Argo CD v2.7, this Application will fail to sync. Contact your Argo CD admin " +

@crenshaw-dev note that these messages may have to be deleted anyway.

"to make sure an upgrade plan is in place. More info: " +
"https://argo-cd.readthedocs.io/en/latest/operator-manual/upgrading/2.4-2.5/"
)
Expand Down
8 changes: 5 additions & 3 deletions docs/operator-manual/upgrading/2.4-2.5.md
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ p, role:org-admin, exec, create, *, allow
## argocd-cm plugins (CMPs) are deprecated

Starting with Argo CD v2.5, installing config management plugins (CMPs) via the `argocd-cm` ConfigMap is deprecated.
Support will be removed in v2.6.
~~Support will be removed in v2.6.~~ Support will be removed in v2.7.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
~~Support will be removed in v2.6.~~ Support will be removed in v2.7.
~~Support will be removed in v2.6.~~ Support will probably be removed in v2.7.


You can continue to use the plugins by [installing them as sidecars](https://argo-cd.readthedocs.io/en/stable/user-guide/config-management-plugins/)
on the repo-server Deployment.
Expand All @@ -47,6 +47,8 @@ following message:

> argocd-cm plugins are deprecated, and support will be removed in v2.6. Upgrade your plugin to be installed via sidecar. https://argo-cd.readthedocs.io/en/stable/user-guide/config-management-plugins/

**NOTE:** removal of argocd-cm plugin support was delayed to v2.7. Update your logs scan to use `v2.7` instead of `v2.6`.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
**NOTE:** removal of argocd-cm plugin support was delayed to v2.7. Update your logs scan to use `v2.7` instead of `v2.6`.
**NOTE:** removal of argocd-cm plugin support is currently delayed to v2.7. Update your logs scan to look for `https://argo-cd.readthedocs.io/en/stable/user-guide/config-management-plugins/` instead.


If you run `argocd app list` as admin, the list of Applications using deprecated plugins will be logged as a warning.

## Dex server TLS configuration
Expand Down Expand Up @@ -97,14 +99,14 @@ When using `argocd app diff --local`, code from the repo server is run on the us

In order to support CMPs and reduce local requirements, we have implemented *server-side generation* of local manifests via the `--server-side-generate` argument. For example, `argocd app diff --local repoDir --server-side-generate` will upload the contents of `repoDir` to the repo server and run your manifest generation pipeline against it, the same as it would for a Git repo.

In v2.6, the `--server-side-generate` argument will become the default and client-side generation will be removed.
In ~~v2.6~~ v2.7, the `--server-side-generate` argument will become the default and client-side generation will be removed.
crenshaw-dev marked this conversation as resolved.
Show resolved Hide resolved

!!! warning
The semantics of *where* Argo will start generating manifests within a repo has changed between client-side and server-side generation. With client-side generation, the application's path (`spec.source.path`) was ignored and the value of `--local-repo-root` was effectively used (by default `/` relative to `--local`).

For example, given an application that has an application path of `/manifests`, you would have had to run `argocd app diff --local yourRepo/manifests`. This behavior did not match the repo server's process of downloading the full repo/chart and then beginning generation in the path specified in the application manifest.

When switching to server-side generation, `--local` should point to the root of your repo *without* including your `spec.source.path`. This is especially important to keep in mind when `--server-side-generate` becomes the default in v2.6. Existing scripts utilizing `diff --local` may break in v2.6 if `spec.source.path` was not `/`.
When switching to server-side generation, `--local` should point to the root of your repo *without* including your `spec.source.path`. This is especially important to keep in mind when `--server-side-generate` becomes the default in v2.7. Existing scripts utilizing `diff --local` may break in v2.7 if `spec.source.path` was not `/`.

## Upgraded Kustomize Version

Expand Down
8 changes: 8 additions & 0 deletions docs/operator-manual/upgrading/2.5-2.6.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,3 +6,11 @@ Argo CD 2.5 introduced [Go templating in ApplicationSets](https://argo-cd.readth
Argo CD 2.6 upgrades Sprig to v3. That upgrade includes an upgrade of [Masterminds/semver](https://github.com/Masterminds/semver/releases) to v3.

Masterminds/semver v3 changed the behavior of the `^` prefix in semantic version constraints. If you are using Go-templated ApplicationSets which include references to [Sprig's semver functions](https://masterminds.github.io/sprig/semver.html) and use the `^` prefix, read the [Masterminds/semver changelog](https://github.com/Masterminds/semver/releases/tag/v3.0.0) to understand how your ApplicationSets' behavior may change.

## Removal of argocd-cm plugin support delayed until 2.7
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
## Removal of argocd-cm plugin support delayed until 2.7
## Removal of argocd-cm plugin support delayed until at least v2.7


Support for argocd-cm plugins was previously scheduled for 2.6. At the time, sidecar plugins could not be specified by
name. Argo CD v2.6 introduces support for specifying sidecar plugins by name.
Comment on lines +27 to +28
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

At the time is ambiguous and should never be used in documentation.

Suggested change
Support for argocd-cm plugins was previously scheduled for 2.6. At the time, sidecar plugins could not be specified by
name. Argo CD v2.6 introduces support for specifying sidecar plugins by name.
Support for argocd-cm plugins was previously scheduled for 2.6. At the time, sidecar plugins could not be specified by
name. Argo CD v2.6 introduces support for specifying sidecar plugins by name.


Removal of argocd-cm plugin support has been delayed until 2.7 to provide a transition time for users who need to
specify plugins by name.
221 changes: 105 additions & 116 deletions docs/user-guide/config-management-plugins.md
Original file line number Diff line number Diff line change
Expand Up @@ -20,47 +20,15 @@ The following sections will describe how to create, install, and use plugins. Ch

There are two ways to install a Config Management Plugin:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
There are two ways to install a Config Management Plugin:
From v2.5 and going forward there are two ways to install a Config Management Plugin:


1. Add the plugin config to the Argo CD ConfigMap (**this method is deprecated and will be removed in a future
1. Add the plugin as a sidecar to the repo-server Pod.
This is a good option for a more complex plugin that would clutter the Argo CD ConfigMap. A copy of the repository is
sent to the sidecar container as a tarball and processed individually per application, which makes it a good option
for [concurrent processing of monorepos](../operator-manual/high_availability.md#enable-concurrent-processing).
2. Add the plugin config to the Argo CD ConfigMap (**this method is deprecated and will be removed in a future
version**). The repo-server container will run your plugin's commands. This is a good option for a simple plugin that
requires only a few lines of code that fit nicely in the Argo CD ConfigMap.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't rely on numbers, name the bullets and then use the same names for the section titles below.

Use a plugin not the plugin as users can have multiple (I have two) -- and it's quite possible for them to migrate incrementally (I'd recommend that...).

Suggested change
1. Add the plugin as a sidecar to the repo-server Pod.
This is a good option for a more complex plugin that would clutter the Argo CD ConfigMap. A copy of the repository is
sent to the sidecar container as a tarball and processed individually per application, which makes it a good option
for [concurrent processing of monorepos](../operator-manual/high_availability.md#enable-concurrent-processing).
2. Add the plugin config to the Argo CD ConfigMap (**this method is deprecated and will be removed in a future
version**). The repo-server container will run your plugin's commands. This is a good option for a simple plugin that
requires only a few lines of code that fit nicely in the Argo CD ConfigMap.
* Sidecar plugin
Add a plugin as a sidecar to the repo-server Pod.
This is recommended. A copy of the repository is
sent to the sidecar container as a tarball and processed individually per application, which makes it a good option
for [concurrent processing of monorepos](../operator-manual/high_availability.md#enable-concurrent-processing).
* ConfigMap plugin
(Deprecated)
Add a plugin config to the Argo CD ConfigMap (**this method is deprecated and will be removed in a future
version**). The repo-server container will run your plugin's commands. This is a good option for a simple plugin that
requires only a few lines of code that fit nicely in the Argo CD ConfigMap.

2. Add the plugin as a sidecar to the repo-server Pod.
This is a good option for a more complex plugin that would clutter the Argo CD ConfigMap. A copy of the repository is
sent to the sidecar container as a tarball and processed individually per application, which makes it a good option
for [concurrent processing of monorepos](../operator-manual/high_availability.md#enable-concurrent-processing).

### Option 1: Configure plugins via Argo CD configmap (deprecated)

The following changes are required to configure a new plugin:

1. Make sure required binaries are available in `argocd-repo-server` pod. The binaries can be added via volume mounts or
using a custom image (see [custom_tools](../operator-manual/custom_tools.md) for examples of both).
2. Register a new plugin in `argocd-cm` ConfigMap:

:::yaml
data:
configManagementPlugins: |
- name: pluginName
init: # Optional command to initialize application source directory
command: ["sample command"]
args: ["sample args"]
generate: # Command to generate manifests YAML
command: ["sample command"]
args: ["sample args"]
lockRepo: true # Defaults to false. See below.

The `generate` command must print a valid YAML or JSON stream to stdout. Both `init` and `generate` commands are executed inside the application source directory or in `path` when specified for the app.

3. [Create an Application which uses your new CMP](#using-a-cmp).

More CMP examples are available in [argocd-example-apps](https://github.com/argoproj/argocd-example-apps/tree/master/plugins).

!!!note "Repository locking"
If your plugin makes use of `git` (e.g. `git crypt`), it is advised to set
`lockRepo` to `true` so that your plugin will have exclusive access to the
repository at the time it is executed. Otherwise, two applications synced
at the same time may result in a race condition and sync failure.

### Option 2: Configure plugin via sidecar
### Option 1: Configure plugin via sidecar
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
### Option 1: Configure plugin via sidecar
### Sidecar plugin


An operator can configure a plugin tool via a sidecar to repo-server. The following changes are required to configure a new plugin:

Expand Down Expand Up @@ -241,90 +209,112 @@ volumes:
2. Make sure that sidecar container is running as user 999.
3. Make sure that plugin configuration file is present at `/home/argocd/cmp-server/config/plugin.yaml`. It can either be volume mapped via configmap or baked into image.

### Using environment variables in your plugin

Plugin commands have access to

1. The system environment variables (of the repo-server container for argocd-cm plugins or of the sidecar for sidecar plugins)
2. [Standard build environment variables](build-environment.md)
3. Variables in the Application spec (References to system and build variables will get interpolated in the variables' values):

```yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
spec:
source:
plugin:
env:
- name: FOO
value: bar
- name: REV
value: test-$ARGOCD_APP_REVISION
```
### Option 2: Configure plugins via Argo CD configmap (deprecated)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
### Option 2: Configure plugins via Argo CD configmap (deprecated)
### ConfigMap plugin


!!! note
The `discover.command` command only has access to the above environment starting with v2.4.
The following changes are required to configure a new plugin:

Before reaching the `init.command`, `generate.command`, and `discover.command` commands, Argo CD prefixes all
user-supplied environment variables (#3 above) with `ARGOCD_ENV_`. This prevents users from directly setting
potentially-sensitive environment variables.
1. Make sure required binaries are available in `argocd-repo-server` pod. The binaries can be added via volume mounts or
using a custom image (see [custom_tools](../operator-manual/custom_tools.md) for examples of both).
2. Register a new plugin in `argocd-cm` ConfigMap:

If your plugin was written before 2.4 and depends on user-supplied environment variables, then you will need to update
your plugin's behavior to work with 2.4. If you use a third-party plugin, make sure they explicitly advertise support
for 2.4.
data:
configManagementPlugins: |
- name: pluginName
init: # Optional command to initialize application source directory
command: ["sample command"]
args: ["sample args"]
generate: # Command to generate manifests YAML
command: ["sample command"]
args: ["sample args"]
lockRepo: true # Defaults to false. See below.

The `generate` command must print a valid YAML or JSON stream to stdout. Both `init` and `generate` commands are executed inside the application source directory or in `path` when specified for the app.

4. (Starting in v2.4) Parameters in the Application spec:
3. [Create an Application which uses your new CMP](#using-a-cmp).

```yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
spec:
source:
plugin:
parameters:
- name: values-files
array: [values-dev.yaml]
- name: helm-parameters
map:
image.tag: v1.2.3
```
More CMP examples are available in [argocd-example-apps](https://github.com/argoproj/argocd-example-apps/tree/master/plugins).

The parameters are available as JSON in the `ARGOCD_APP_PARAMETERS` environment variable. The example above would
produce this JSON:
!!!note "Repository locking"
If your plugin makes use of `git` (e.g. `git crypt`), it is advised to set
`lockRepo` to `true` so that your plugin will have exclusive access to the
repository at the time it is executed. Otherwise, two applications synced
at the same time may result in a race condition and sync failure.

```json
[{"name": "values-files", "array": ["values-dev.yaml"]}, {"name": "helm-parameters", "map": {"image.tag": "v1.2.3"}}]
```
### Using environment variables in your plugin

!!! note
Parameter announcements, even if they specify defaults, are _not_ sent to the plugin in `ARGOCD_APP_PARAMETERS`.
Only parameters explicitly set in the Application spec are sent to the plugin. It is up to the plugin to apply
the same defaults as the ones announced to the UI.
Plugin commands have access to

The same parameters are also available as individual environment variables. The names of the environment variables
follows this convention:
1. The system environment variables (of the repo-server container for argocd-cm plugins or of the sidecar for sidecar plugins)
2. [Standard build environment variables](build-environment.md)
3. Variables in the Application spec (References to system and build variables will get interpolated in the variables' values):

```yaml
- name: some-string-param
string: some-string-value
# PARAM_SOME_STRING_PARAM=some-string-value
apiVersion: argoproj.io/v1alpha1
kind: Application
spec:
source:
plugin:
env:
- name: FOO
value: bar
- name: REV
value: test-$ARGOCD_APP_REVISION

!!! note
The `discover.find.command` command only has access to the above environment starting with v2.4.

Before reaching the `init.command`, `generate.command`, and `discover.find.command` commands, Argo CD prefixes all
user-supplied environment variables (#3 above) with `ARGOCD_ENV_`. This prevents users from directly setting
potentially-sensitive environment variables.

If your plugin was written before 2.4 and depends on user-supplied environment variables, then you will need to update
your plugin's behavior to work with 2.4. If you use a third-party plugin, make sure they explicitly advertise support
for 2.4.

4. (Starting in v2.6) Parameters in the Application spec:

apiVersion: argoproj.io/v1alpha1
kind: Application
spec:
source:
plugin:
parameters:
- name: values-files
array: [values-dev.yaml]
- name: helm-parameters
map:
image.tag: v1.2.3

- name: some-array-param
value: [item1, item2]
# PARAM_SOME_ARRAY_PARAM_0=item1
# PARAM_SOME_ARRAY_PARAM_1=item2
The parameters are available as JSON in the `ARGOCD_APP_PARAMETERS` environment variable. The example above would
produce this JSON:

- name: some-map-param
map:
image.tag: v1.2.3
# PARAM_SOME_MAP_PARAM_IMAGE_TAG=v1.2.3
```

!!! warning
Sanitize/escape user input. As part of Argo CD's manifest generation system, config management plugins are treated with a level of trust. Be
[{"name": "values-files", "array": ["values-dev.yaml"]}, {"name": "helm-parameters", "map": {"image.tag": "v1.2.3"}}]

!!! note
Parameter announcements, even if they specify defaults, are _not_ sent to the plugin in `ARGOCD_APP_PARAMETERS`.
Only parameters explicitly set in the Application spec are sent to the plugin. It is up to the plugin to apply
the same defaults as the ones announced to the UI.

The same parameters are also available as individual environment variables. The names of the environment variables
follows this convention:

- name: some-string-param
string: some-string-value
# PARAM_SOME_STRING_PARAM=some-string-value

- name: some-array-param
value: [item1, item2]
# PARAM_SOME_ARRAY_PARAM_0=item1
# PARAM_SOME_ARRAY_PARAM_1=item2

- name: some-map-param
map:
image.tag: v1.2.3
# PARAM_SOME_MAP_PARAM_IMAGE_TAG=v1.2.3

!!! warning "Sanitize/escape user input"
As part of Argo CD's manifest generation system, config management plugins are treated with a level of trust. Be
sure to escape user input in your plugin to prevent malicious input from causing unwanted behavior.


## Using a config management plugin with an Application

If your CMP is defined in the `argocd-cm` ConfigMap, you can create a new Application using the CLI. Replace
Expand Down Expand Up @@ -450,17 +440,16 @@ spec:
The `lockRepo` key is not relevant for sidecar plugins, because sidecar plugins do not share a single source repo
directory when generating manifests.

### 2. Write discovery rules for your plugin
### 2. Write discovery rules for your plugin, or use the plugin name
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As noted above, don't include numbers or periods or colons in section headings in general as they're really painful for link / search purposes.

Use very short text items so that users can scan/click/etc.


Sidecar plugins use discovery rules instead of a plugin name to match Applications to plugins.
Sidecar plugins can use discovery rules instead of a plugin name to match Applications to plugins.

Write rules applicable to your plugin [using the instructions above](#1-write-the-plugin-configuration-file) and add
them to your configuration file.
If you want to use discovery instead of the plugin name to match applications to your plugin, write rules applicable to
your plugin [using the instructions above](#1-write-the-plugin-configuration-file) and add them to your configuration
file.

!!! note
After installing your sidecar plugin, you may remove the `name` field from the plugin config in your
Application specs for auto-discovery or update the name to `<metadata.name>-<spec.version>`
if version was mentioned in the `ConfigManagementPlugin` spec or else just use `<metadata.name>`. For example:
To use the name instead of discovery, update the name in your application manifest to `<metadata.name>-<spec.version>`
if version was mentioned in the `ConfigManagementPlugin` spec or else just use `<metadata.name>`. For example:

```yaml
apiVersion: argoproj.io/v1alpha1
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -458,8 +458,8 @@ export const ApplicationSummary = (props: ApplicationSummaryProps) => {
{source.plugin && typeof source.plugin.name === 'string' && source.plugin.name !== '' && (
<div className='white-box'>
<i className='fa fa-exclamation-triangle' style={{color: ARGO_WARNING_COLOR}} /> This Application uses a plugin which will no longer be supported starting with
Argo CD version 2.6. Contact your Argo CD administrator to make sure they upgrade the '{source.plugin.name}' plugin before upgrading to Argo CD 2.6. See the{' '}
<a href='https://argo-cd.readthedocs.io/en/latest/operator-manual/upgrading/2.4-2.5/'>2.4-to-2.5 upgrade notes</a> for details.
Argo CD version 2.7. Contact your Argo CD administrator to make sure they upgrade the '{app.spec.source.plugin.name}' plugin before upgrading to Argo CD 2.7.
See the <a href='https://argo-cd.readthedocs.io/en/latest/operator-manual/upgrading/2.4-2.5/'>2.4-to-2.5 upgrade notes</a> for details.
</div>
)}
<EditablePanel
Expand Down