Kustomize build fails pulling remote resource on GitHub with 404

[dlowrey]

Describe the bug
A few days ago our automated builds started failing with the following error:

Error: accumulating resources: accumulating resources from 'https://github.com/argoproj/argo-cd/manifests/ha/cluster-install?ref=v2.1.0': HTTP Error: status code 404 (Not Found)

After some investigation I discovered that the builds start working again if I pin the installation of Kustomize in our CI/CD environment to v4.4.1. It appears that v4.5.0 and v4.5.1 have some changes that break our use of remote resources in our kustomization.yaml files.

Files that can reproduce the issue

Running kustomize build with Kustomize v4.5.0+ on a kustomization.yaml with the following contents will reproduce the issue:

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
bases:
  - https://github.com/argoproj/argo-cd/manifests/ha/cluster-install?ref=v2.1.0

Expected output
The expected output can be obtained by running the example above with Kustomize v4.4.1.

Expected output (warning, long)

apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: labels: app.kubernetes.io/name: applications.argoproj.io app.kubernetes.io/part-of: argocd name: applications.argoproj.io spec: group: argoproj.io names: kind: Application listKind: ApplicationList plural: applications shortNames: - app - apps singular: application scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.sync.status name: Sync Status type: string - jsonPath: .status.health.status name: Health Status type: string - jsonPath: .status.sync.revision name: Revision priority: 10 type: string name: v1alpha1 schema: openAPIV3Schema: description: Application is a definition of Application resource. properties: apiVersion: description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object operation: description: Operation contains information about a requested or running operation properties: info: description: Info is a list of informational items for this operation items: properties: name: type: string value: type: string required: - name - value type: object type: array initiatedBy: description: InitiatedBy contains information about who initiated the operations properties: automated: description: Automated is set to true if operation was initiated automatically by the application controller. type: boolean username: description: Username contains the name of a user who started operation type: string type: object retry: description: Retry controls the strategy to apply if a sync fails properties: backoff: description: Backoff controls how to backoff on subsequent retries of failed syncs properties: duration: description: Duration is the amount to back off. Default unit is seconds, but could also be a duration (e.g. "2m", "1h") type: string factor: description: Factor is a factor to multiply the base duration after each failed retry format: int64 type: integer maxDuration: description: MaxDuration is the maximum amount of time allowed for the backoff strategy type: string type: object limit: description: Limit is the maximum number of attempts for retrying a failed sync. If set to 0, no retries will be performed. format: int64 type: integer type: object sync: description: Sync contains parameters for the operation properties: dryRun: description: DryRun specifies to perform a `kubectl apply --dry-run` without actually performing the sync type: boolean manifests: description: Manifests is an optional field that overrides sync source with a local directory for development items: type: string type: array prune: description: Prune specifies to delete resources from the cluster that are no longer tracked in git type: boolean resources: description: Resources describes which resources shall be part of the sync items: description: SyncOperationResource contains resources to sync. properties: group: type: string kind: type: string name: type: string namespace: type: string required: - kind - name type: object type: array revision: description: Revision is the revision (Git) or chart version (Helm) which to sync the application to If omitted, will use the revision specified in app spec. type: string source: description: Source overrides the source definition set in the application. This is typically set in a Rollback operation and is nil during a Sync operation properties: chart: description: Chart is a Helm chart name, and must be specified for applications sourced from a Helm repo. type: string directory: description: Directory holds path/directory specific options properties: exclude: description: Exclude contains a glob pattern to match paths against that should be explicitly excluded from being used during manifest generation type: string include: description: Include contains a glob pattern to match paths against that should be explicitly included during manifest generation type: string jsonnet: description: Jsonnet holds options specific to Jsonnet properties: extVars: description: ExtVars is a list of Jsonnet External Variables items: description: JsonnetVar represents a variable to be passed to jsonnet during manifest generation properties: code: type: boolean name: type: string value: type: string required: - name - value type: object type: array libs: description: Additional library search dirs items: type: string type: array tlas: description: TLAS is a list of Jsonnet Top-level Arguments items: description: JsonnetVar represents a variable to be passed to jsonnet during manifest generation properties: code: type: boolean name: type: string value: type: string required: - name - value type: object type: array type: object recurse: description: Recurse specifies whether to scan a directory recursively for manifests type: boolean type: object helm: description: Helm holds helm specific options properties: fileParameters: description: FileParameters are file parameters to the helm template items: description: HelmFileParameter is a file parameter that's passed to helm template during manifest generation properties: name: description: Name is the name of the Helm parameter type: string path: description: Path is the path to the file containing the values for the Helm parameter type: string type: object type: array parameters: description: Parameters is a list of Helm parameters which are passed to the helm template command upon manifest generation items: description: HelmParameter is a parameter that's passed to helm template during manifest generation properties: forceString: description: ForceString determines whether to tell Helm to interpret booleans and numbers as strings type: boolean name: description: Name is the name of the Helm parameter type: string value: description: Value is the value for the Helm parameter type: string type: object type: array releaseName: description: ReleaseName is the Helm release name to use. If omitted it will use the application name type: string valueFiles: description: ValuesFiles is a list of Helm value files to use when generating a template items: type: string type: array values: description: Values specifies Helm values to be passed to helm template, typically defined as a block type: string version: description: Version is the Helm version to use for templating (either "2" or "3") type: string type: object ksonnet: description: Ksonnet holds ksonnet specific options properties: environment: description: Environment is a ksonnet application environment name type: string parameters: description: Parameters are a list of ksonnet component parameter override values items: description: KsonnetParameter is a ksonnet component parameter properties: component: type: string name: type: string value: type: string required: - name - value type: object type: array type: object kustomize: description: Kustomize holds kustomize specific options properties: commonAnnotations: additionalProperties: type: string description: CommonAnnotations is a list of additional annotations to add to rendered manifests type: object commonLabels: additionalProperties: type: string description: CommonLabels is a list of additional labels to add to rendered manifests type: object forceCommonAnnotations: description: ForceCommonAnnotations specifies whether to force applying common annotations to resources for Kustomize apps type: boolean forceCommonLabels: description: ForceCommonLabels specifies whether to force applying common labels to resources for Kustomize apps type: boolean images: description: Images is a list of Kustomize image override specifications items: description: KustomizeImage represents a Kustomize image definition in the format [old_image_name=]: type: string type: array namePrefix: description: NamePrefix is a prefix appended to resources for Kustomize apps type: string nameSuffix: description: NameSuffix is a suffix appended to resources for Kustomize apps type: string version: description: Version controls which version of Kustomize to use for rendering manifests type: string type: object path: description: Path is a directory path within the Git repository, and is only valid for applications sourced from Git. type: string plugin: description: ConfigManagementPlugin holds config management plugin specific options properties: env: description: Env is a list of environment variable entries items: description: EnvEntry represents an entry in the application's environment properties: name: description: Name is the name of the variable, usually expressed in uppercase type: string value: description: Value is the value of the variable type: string required: - name - value type: object type: array name: type: string type: object repoURL: description: RepoURL is the URL to the repository (Git or Helm) that contains the application manifests type: string targetRevision: description: TargetRevision defines the revision of the source to sync the application to. In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. In case of Helm, this is a semver tag for the Chart's version. type: string required: - repoURL type: object syncOptions: description: SyncOptions provide per-sync sync-options, e.g. Validate=false items: type: string type: array syncStrategy: description: SyncStrategy describes how to perform the sync properties: apply: description: Apply will perform a `kubectl apply` to perform the sync. properties: force: description: Force indicates whether or not to supply the --force flag to `kubectl apply`. The --force flag deletes and re-create the resource, when PATCH encounters conflict and has retried for 5 times. type: boolean type: object hook: description: Hook will submit any referenced resources to perform the sync. This is the default strategy properties: force: description: Force indicates whether or not to supply the --force flag to `kubectl apply`. The --force flag deletes and re-create the resource, when PATCH encounters conflict and has retried for 5 times. type: boolean type: object type: object type: object type: object spec: description: ApplicationSpec represents desired application state. Contains link to repository with application definition and additional parameters link definition revision. properties: destination: description: Destination is a reference to the target Kubernetes server and namespace properties: name: description: Name is an alternate way of specifying the target cluster by its symbolic name type: string namespace: description: Namespace specifies the target namespace for the application's resources. The namespace will only be set for namespace-scoped resources that have not set a value for .metadata.namespace type: string server: description: Server specifies the URL of the target cluster and must be set to the Kubernetes control plane API type: string type: object ignoreDifferences: description: IgnoreDifferences is a list of resources and their fields which should be ignored during comparison items: description: ResourceIgnoreDifferences contains resource filter and list of json paths which should be ignored during comparison with live state. properties: group: type: string jqPathExpressions: items: type: string type: array jsonPointers: items: type: string type: array kind: type: string name: type: string namespace: type: string required: - kind type: object type: array info: description: Info contains a list of information (URLs, email addresses, and plain text) that relates to the application items: properties: name: type: string value: type: string required: - name - value type: object type: array project: description: Project is a reference to the project this application belongs to. The empty string means that application belongs to the 'default' project. type: string revisionHistoryLimit: description: RevisionHistoryLimit limits the number of items kept in the application's revision history, which is used for informational purposes as well as for rollbacks to previous versions. This should only be changed in exceptional circumstances. Setting to zero will store no history. This will reduce storage used. Increasing will increase the space used to store the history, so we do not recommend increasing it. Default is 10. format: int64 type: integer source: description: Source is a reference to the location of the application's manifests or chart properties: chart: description: Chart is a Helm chart name, and must be specified for applications sourced from a Helm repo. type: string directory: description: Directory holds path/directory specific options properties: exclude: description: Exclude contains a glob pattern to match paths against that should be explicitly excluded from being used during manifest generation type: string include: description: Include contains a glob pattern to match paths against that should be explicitly included during manifest generation type: string jsonnet: description: Jsonnet holds options specific to Jsonnet properties: extVars: description: ExtVars is a list of Jsonnet External Variables items: description: JsonnetVar represents a variable to be passed to jsonnet during manifest generation properties: code: type: boolean name: type: string value: type: string required: - name - value type: object type: array libs: description: Additional library search dirs items: type: string type: array tlas: description: TLAS is a list of Jsonnet Top-level Arguments items: description: JsonnetVar represents a variable to be passed to jsonnet during manifest generation properties: code: type: boolean name: type: string value: type: string required: - name - value type: object type: array type: object recurse: description: Recurse specifies whether to scan a directory recursively for manifests type: boolean type: object helm: description: Helm holds helm specific options properties: fileParameters: description: FileParameters are file parameters to the helm template items: description: HelmFileParameter is a file parameter that's passed to helm template during manifest generation properties: name: description: Name is the name of the Helm parameter type: string path: description: Path is the path to the file containing the values for the Helm parameter type: string type: object type: array parameters: description: Parameters is a list of Helm parameters which are passed to the helm template command upon manifest generation items: description: HelmParameter is a parameter that's passed to helm template during manifest generation properties: forceString: description: ForceString determines whether to tell Helm to interpret booleans and numbers as strings type: boolean name: description: Name is the name of the Helm parameter type: string value: description: Value is the value for the Helm parameter type: string type: object type: array releaseName: description: ReleaseName is the Helm release name to use. If omitted it will use the application name type: string valueFiles: description: ValuesFiles is a list of Helm value files to use when generating a template items: type: string type: array values: description: Values specifies Helm values to be passed to helm template, typically defined as a block type: string version: description: Version is the Helm version to use for templating (either "2" or "3") type: string type: object ksonnet: description: Ksonnet holds ksonnet specific options properties: environment: description: Environment is a ksonnet application environment name type: string parameters: description: Parameters are a list of ksonnet component parameter override values items: description: KsonnetParameter is a ksonnet component parameter properties: component: type: string name: type: string value: type: string required: - name - value type: object type: array type: object kustomize: description: Kustomize holds kustomize specific options properties: commonAnnotations: additionalProperties: type: string description: CommonAnnotations is a list of additional annotations to add to rendered manifests type: object commonLabels: additionalProperties: type: string description: CommonLabels is a list of additional labels to add to rendered manifests type: object forceCommonAnnotations: description: ForceCommonAnnotations specifies whether to force applying common annotations to resources for Kustomize apps type: boolean forceCommonLabels: description: ForceCommonLabels specifies whether to force applying common labels to resources for Kustomize apps type: boolean images: description: Images is a list of Kustomize image override specifications items: description: KustomizeImage represents a Kustomize image definition in the format [old_image_name=]: type: string type: array namePrefix: description: NamePrefix is a prefix appended to resources for Kustomize apps type: string nameSuffix: description: NameSuffix is a suffix appended to resources for Kustomize apps type: string version: description: Version controls which version of Kustomize to use for rendering manifests type: string type: object path: description: Path is a directory path within the Git repository, and is only valid for applications sourced from Git. type: string plugin: description: ConfigManagementPlugin holds config management plugin specific options properties: env: description: Env is a list of environment variable entries items: description: EnvEntry represents an entry in the application's environment properties: name: description: Name is the name of the variable, usually expressed in uppercase type: string value: description: Value is the value of the variable type: string required: - name - value type: object type: array name: type: string type: object repoURL: description: RepoURL is the URL to the repository (Git or Helm) that contains the application manifests type: string targetRevision: description: TargetRevision defines the revision of the source to sync the application to. In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. In case of Helm, this is a semver tag for the Chart's version. type: string required: - repoURL type: object syncPolicy: description: SyncPolicy controls when and how a sync will be performed properties: automated: description: Automated will keep an application synced to the target revision properties: allowEmpty: description: 'AllowEmpty allows apps have zero live resources (default: false)' type: boolean prune: description: 'Prune specifies whether to delete resources from the cluster that are not found in the sources anymore as part of automated sync (default: false)' type: boolean selfHeal: description: 'SelfHeal specifes whether to revert resources back to their desired state upon modification in the cluster (default: false)' type: boolean type: object retry: description: Retry controls failed sync retry behavior properties: backoff: description: Backoff controls how to backoff on subsequent retries of failed syncs properties: duration: description: Duration is the amount to back off. Default unit is seconds, but could also be a duration (e.g. "2m", "1h") type: string factor: description: Factor is a factor to multiply the base duration after each failed retry format: int64 type: integer maxDuration: description: MaxDuration is the maximum amount of time allowed for the backoff strategy type: string type: object limit: description: Limit is the maximum number of attempts for retrying a failed sync. If set to 0, no retries will be performed. format: int64 type: integer type: object syncOptions: description: Options allow you to specify whole app sync-options items: type: string type: array type: object required: - destination - project - source type: object status: description: ApplicationStatus contains status information for the application properties: conditions: description: Conditions is a list of currently observed application conditions items: description: ApplicationCondition contains details about an application condition, which is usally an error or warning properties: lastTransitionTime: description: LastTransitionTime is the time the condition was last observed format: date-time type: string message: description: Message contains human-readable message indicating details about condition type: string type: description: Type is an application condition type type: string required: - message - type type: object type: array health: description: Health contains information about the application's current health status properties: message: description: Message is a human-readable informational message describing the health status type: string status: description: Status holds the status code of the application or resource type: string type: object history: description: History contains information about the application's sync history items: description: RevisionHistory contains history information about a previous sync properties: deployStartedAt: description: DeployStartedAt holds the time the sync operation started format: date-time type: string deployedAt: description: DeployedAt holds the time the sync operation completed format: date-time type: string id: description: ID is an auto incrementing identifier of the RevisionHistory format: int64 type: integer revision: description: Revision holds the revision the sync was performed against type: string source: description: Source is a reference to the application source used for the sync operation properties: chart: description: Chart is a Helm chart name, and must be specified for applications sourced from a Helm repo. type: string directory: description: Directory holds path/directory specific options properties: exclude: description: Exclude contains a glob pattern to match paths against that should be explicitly excluded from being used during manifest generation type: string include: description: Include contains a glob pattern to match paths against that should be explicitly included during manifest generation type: string jsonnet: description: Jsonnet holds options specific to Jsonnet properties: extVars: description: ExtVars is a list of Jsonnet External Variables items: description: JsonnetVar represents a variable to be passed to jsonnet during manifest generation properties: code: type: boolean name: type: string value: type: string required: - name - value type: object type: array libs: description: Additional library search dirs items: type: string type: array tlas: description: TLAS is a list of Jsonnet Top-level Arguments items: description: JsonnetVar represents a variable to be passed to jsonnet during manifest generation properties: code: type: boolean name: type: string value: type: string required: - name - value type: object type: array type: object recurse: description: Recurse specifies whether to scan a directory recursively for manifests type: boolean type: object helm: description: Helm holds helm specific options properties: fileParameters: description: FileParameters are file parameters to the helm template items: description: HelmFileParameter is a file parameter that's passed to helm template during manifest generation properties: name: description: Name is the name of the Helm parameter type: string path: description: Path is the path to the file containing the values for the Helm parameter type: string type: object type: array parameters: description: Parameters is a list of Helm parameters which are passed to the helm template command upon manifest generation items: description: HelmParameter is a parameter that's passed to helm template during manifest generation properties: forceString: description: ForceString determines whether to tell Helm to interpret booleans and numbers as strings type: boolean name: description: Name is the name of the Helm parameter type: string value: description: Value is the value for the Helm parameter type: string type: object type: array releaseName: description: ReleaseName is the Helm release name to use. If omitted it will use the application name type: string valueFiles: description: ValuesFiles is a list of Helm value files to use when generating a template items: type: string type: array values: description: Values specifies Helm values to be passed to helm template, typically defined as a block type: string version: description: Version is the Helm version to use for templating (either "2" or "3") type: string type: object ksonnet: description: Ksonnet holds ksonnet specific options properties: environment: description: Environment is a ksonnet application environment name type: string parameters: description: Parameters are a list of ksonnet component parameter override values items: description: KsonnetParameter is a ksonnet component parameter properties: component: type: string name: type: string value: type: string required: - name - value type: object type: array type: object kustomize: description: Kustomize holds kustomize specific options properties: commonAnnotations: additionalProperties: type: string description: CommonAnnotations is a list of additional annotations to add to rendered manifests type: object commonLabels: additionalProperties: type: string description: CommonLabels is a list of additional labels to add to rendered manifests type: object forceCommonAnnotations: description: ForceCommonAnnotations specifies whether to force applying common annotations to resources for Kustomize apps type: boolean forceCommonLabels: description: ForceCommonLabels specifies whether to force applying common labels to resources for Kustomize apps type: boolean images: description: Images is a list of Kustomize image override specifications items: description: KustomizeImage represents a Kustomize image definition in the format [old_image_name=]: type: string type: array namePrefix: description: NamePrefix is a prefix appended to resources for Kustomize apps type: string nameSuffix: description: NameSuffix is a suffix appended to resources for Kustomize apps type: string version: description: Version controls which version of Kustomize to use for rendering manifests type: string type: object path: description: Path is a directory path within the Git repository, and is only valid for applications sourced from Git. type: string plugin: description: ConfigManagementPlugin holds config management plugin specific options properties: env: description: Env is a list of environment variable entries items: description: EnvEntry represents an entry in the application's environment properties: name: description: Name is the name of the variable, usually expressed in uppercase type: string value: description: Value is the value of the variable type: string required: - name - value type: object type: array name: type: string type: object repoURL: description: RepoURL is the URL to the repository (Git or Helm) that contains the application manifests type: string targetRevision: description: TargetRevision defines the revision of the source to sync the application to. In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. In case of Helm, this is a semver tag for the Chart's version. type: string required: - repoURL type: object required: - deployedAt - id - revision type: object type: array observedAt: description: 'ObservedAt indicates when the application state was updated without querying latest git state Deprecated: controller no longer updates ObservedAt field' format: date-time type: string operationState: description: OperationState contains information about any ongoing operations, such as a sync properties: finishedAt: description: FinishedAt contains time of operation completion format: date-time type: string message: description: Message holds any pertinent messages when attempting to perform operation (typically errors). type: string operation: description: Operation is the original requested operation properties: info: description: Info is a list of informational items for this operation items: properties: name: type: string value: type: string required: - name - value type: object type: array initiatedBy: description: InitiatedBy contains information about who initiated the operations properties: automated: description: Automated is set to true if operation was initiated automatically by the application controller. type: boolean username: description: Username contains the name of a user who started operation type: string type: object retry: description: Retry controls the strategy to apply if a sync fails properties: backoff: description: Backoff controls how to backoff on subsequent retries of failed syncs properties: duration: description: Duration is the amount to back off. Default unit is seconds, but could also be a duration (e.g. "2m", "1h") type: string factor: description: Factor is a factor to multiply the base duration after each failed retry format: int64 type: integer maxDuration: description: MaxDuration is the maximum amount of time allowed for the backoff strategy type: string type: object limit: description: Limit is the maximum number of attempts for retrying a failed sync. If set to 0, no retries will be performed. format: int64 type: integer type: object sync: description: Sync contains parameters for the operation properties: dryRun: description: DryRun specifies to perform a `kubectl apply --dry-run` without actually performing the sync type: boolean manifests: description: Manifests is an optional field that overrides sync source with a local directory for development items: type: string type: array prune: description: Prune specifies to delete resources from the cluster that are no longer tracked in git type: boolean resources: description: Resources describes which resources shall be part of the sync items: description: SyncOperationResource contains resources to sync. properties: group: type: string kind: type: string name: type: string namespace: type: string required: - kind - name type: object type: array revision: description: Revision is the revision (Git) or chart version (Helm) which to sync the application to If omitted, will use the revision specified in app spec. type: string source: description: Source overrides the source definition set in the application. This is typically set in a Rollback operation and is nil during a Sync operation properties: chart: description: Chart is a Helm chart name, and must be specified for applications sourced from a Helm repo. type: string directory: description: Directory holds path/directory specific options properties: exclude: description: Exclude contains a glob pattern to match paths against that should be explicitly excluded from being used during manifest generation type: string include: description: Include contains a glob pattern to match paths against that should be explicitly included during manifest generation type: string jsonnet: description: Jsonnet holds options specific to Jsonnet properties: extVars: description: ExtVars is a list of Jsonnet External Variables items: description: JsonnetVar represents a variable to be passed to jsonnet during manifest generation properties: code: type: boolean name: type: string value: type: string required: - name - value type: object type: array libs: description: Additional library search dirs items: type: string type: array tlas: description: TLAS is a list of Jsonnet Top-level Arguments items: description: JsonnetVar represents a variable to be passed to jsonnet during manifest generation properties: code: type: boolean name: type: string value: type: string required: - name - value type: object type: array type: object recurse: description: Recurse specifies whether to scan a directory recursively for manifests type: boolean type: object helm: description: Helm holds helm specific options properties: fileParameters: description: FileParameters are file parameters to the helm template items: description: HelmFileParameter is a file parameter that's passed to helm template during manifest generation properties: name: description: Name is the name of the Helm parameter type: string path: description: Path is the path to the file containing the values for the Helm parameter type: string type: object type: array parameters: description: Parameters is a list of Helm parameters which are passed to the helm template command upon manifest generation items: description: HelmParameter is a parameter that's passed to helm template during manifest generation properties: forceString: description: ForceString determines whether to tell Helm to interpret booleans and numbers as strings type: boolean name: description: Name is the name of the Helm parameter type: string value: description: Value is the value for the Helm parameter type: string type: object type: array releaseName: description: ReleaseName is the Helm release name to use. If omitted it will use the application name type: string valueFiles: description: ValuesFiles is a list of Helm value files to use when generating a template items: type: string type: array values: description: Values specifies Helm values to be passed to helm template, typically defined as a block type: string version: description: Version is the Helm version to use for templating (either "2" or "3") type: string type: object ksonnet: description: Ksonnet holds ksonnet specific options properties: environment: description: Environment is a ksonnet application environment name type: string parameters: description: Parameters are a list of ksonnet component parameter override values items: description: KsonnetParameter is a ksonnet component parameter properties: component: type: string name: type: string value: type: string required: - name - value type: object type: array type: object kustomize: description: Kustomize holds kustomize specific options properties: commonAnnotations: additionalProperties: type: string description: CommonAnnotations is a list of additional annotations to add to rendered manifests type: object commonLabels: additionalProperties: type: string description: CommonLabels is a list of additional labels to add to rendered manifests type: object forceCommonAnnotations: description: ForceCommonAnnotations specifies whether to force applying common annotations to resources for Kustomize apps type: boolean forceCommonLabels: description: ForceCommonLabels specifies whether to force applying common labels to resources for Kustomize apps type: boolean images: description: Images is a list of Kustomize image override specifications items: description: KustomizeImage represents a Kustomize image definition in the format [old_image_name=]: type: string type: array namePrefix: description: NamePrefix is a prefix appended to resources for Kustomize apps type: string nameSuffix: description: NameSuffix is a suffix appended to resources for Kustomize apps type: string version: description: Version controls which version of Kustomize to use for rendering manifests type: string type: object path: description: Path is a directory path within the Git repository, and is only valid for applications sourced from Git. type: string plugin: description: ConfigManagementPlugin holds config management plugin specific options properties: env: description: Env is a list of environment variable entries items: description: EnvEntry represents an entry in the application's environment properties: name: description: Name is the name of the variable, usually expressed in uppercase type: string value: description: Value is the value of the variable type: string required: - name - value type: object type: array name: type: string type: object repoURL: description: RepoURL is the URL to the repository (Git or Helm) that contains the application manifests type: string targetRevision: description: TargetRevision defines the revision of the source to sync the application to. In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. In case of Helm, this is a semver tag for the Chart's version. type: string required: - repoURL type: object syncOptions: description: SyncOptions provide per-sync sync-options, e.g. Validate=false items: type: string type: array syncStrategy: description: SyncStrategy describes how to perform the sync properties: apply: description: Apply will perform a `kubectl apply` to perform the sync. properties: force: description: Force indicates whether or not to supply the --force flag to `kubectl apply`. The --force flag deletes and re-create the resource, when PATCH encounters conflict and has retried for 5 times. type: boolean type: object hook: description: Hook will submit any referenced resources to perform the sync. This is the default strategy properties: force: description: Force indicates whether or not to supply the --force flag to `kubectl apply`. The --force flag deletes and re-create the resource, when PATCH encounters conflict and has retried for 5 times. type: boolean type: object type: object type: object type: object phase: description: Phase is the current phase of the operation type: string retryCount: description: RetryCount contains time of operation retries format: int64 type: integer startedAt: description: StartedAt contains time of operation start format: date-time type: string syncResult: description: SyncResult is the result of a Sync operation properties: resources: description: Resources contains a list of sync result items for each individual resource in a sync operation items: description: ResourceResult holds the operation result details of a specific resource properties: group: description: Group specifies the API group of the resource type: string hookPhase: description: HookPhase contains the state of any operation associated with this resource OR hook This can also contain values for non-hook resources. type: string hookType: description: HookType specifies the type of the hook. Empty for non-hook resources type: string kind: description: Kind specifies the API kind of the resource type: string message: description: Message contains an informational or error message for the last sync OR operation type: string name: description: Name specifies the name of the resource type: string namespace: description: Namespace specifies the target namespace of the resource type: string status: description: Status holds the final result of the sync. Will be empty if the resources is yet to be applied/pruned and is always zero-value for hooks type: string syncPhase: description: SyncPhase indicates the particular phase of the sync that this result was acquired in type: string version: description: Version specifies the API version of the resource type: string required: - group - kind - name - namespace - version type: object type: array revision: description: Revision holds the revision this sync operation was performed to type: string source: description: Source records the application source information of the sync, used for comparing auto-sync properties: chart: description: Chart is a Helm chart name, and must be specified for applications sourced from a Helm repo. type: string directory: description: Directory holds path/directory specific options properties: exclude: description: Exclude contains a glob pattern to match paths against that should be explicitly excluded from being used during manifest generation type: string include: description: Include contains a glob pattern to match paths against that should be explicitly included during manifest generation type: string jsonnet: description: Jsonnet holds options specific to Jsonnet properties: extVars: description: ExtVars is a list of Jsonnet External Variables items: description: JsonnetVar represents a variable to be passed to jsonnet during manifest generation properties: code: type: boolean name: type: string value: type: string required: - name - value type: object type: array libs: description: Additional library search dirs items: type: string type: array tlas: description: TLAS is a list of Jsonnet Top-level Arguments items: description: JsonnetVar represents a variable to be passed to jsonnet during manifest generation properties: code: type: boolean name: type: string value: type: string required: - name - value type: object type: array type: object recurse: description: Recurse specifies whether to scan a directory recursively for manifests type: boolean type: object helm: description: Helm holds helm specific options properties: fileParameters: description: FileParameters are file parameters to the helm template items: description: HelmFileParameter is a file parameter that's passed to helm template during manifest generation properties: name: description: Name is the name of the Helm parameter type: string path: description: Path is the path to the file containing the values for the Helm parameter type: string type: object type: array parameters: description: Parameters is a list of Helm parameters which are passed to the helm template command upon manifest generation items: description: HelmParameter is a parameter that's passed to helm template during manifest generation properties: forceString: description: ForceString determines whether to tell Helm to interpret booleans and numbers as strings type: boolean name: description: Name is the name of the Helm parameter type: string value: description: Value is the value for the Helm parameter type: string type: object type: array releaseName: description: ReleaseName is the Helm release name to use. If omitted it will use the application name type: string valueFiles: description: ValuesFiles is a list of Helm value files to use when generating a template items: type: string type: array values: description: Values specifies Helm values to be passed to helm template, typically defined as a block type: string version: description: Version is the Helm version to use for templating (either "2" or "3") type: string type: object ksonnet: description: Ksonnet holds ksonnet specific options properties: environment: description: Environment is a ksonnet application environment name type: string parameters: description: Parameters are a list of ksonnet component parameter override values items: description: KsonnetParameter is a ksonnet component parameter properties: component: type: string name: type: string value: type: string required: - name - value type: object type: array type: object kustomize: description: Kustomize holds kustomize specific options properties: commonAnnotations: additionalProperties: type: string description: CommonAnnotations is a list of additional annotations to add to rendered manifests type: object commonLabels: additionalProperties: type: string description: CommonLabels is a list of additional labels to add to rendered manifests type: object forceCommonAnnotations: description: ForceCommonAnnotations specifies whether to force applying common annotations to resources for Kustomize apps type: boolean forceCommonLabels: description: ForceCommonLabels specifies whether to force applying common labels to resources for Kustomize apps type: boolean images: description: Images is a list of Kustomize image override specifications items: description: KustomizeImage represents a Kustomize image definition in the format [old_image_name=]: type: string type: array namePrefix: description: NamePrefix is a prefix appended to resources for Kustomize apps type: string nameSuffix: description: NameSuffix is a suffix appended to resources for Kustomize apps type: string version: description: Version controls which version of Kustomize to use for rendering manifests type: string type: object path: description: Path is a directory path within the Git repository, and is only valid for applications sourced from Git. type: string plugin: description: ConfigManagementPlugin holds config management plugin specific options properties: env: description: Env is a list of environment variable entries items: description: EnvEntry represents an entry in the application's environment properties: name: description: Name is the name of the variable, usually expressed in uppercase type: string value: description: Value is the value of the variable type: string required: - name - value type: object type: array name: type: string type: object repoURL: description: RepoURL is the URL to the repository (Git or Helm) that contains the application manifests type: string targetRevision: description: TargetRevision defines the revision of the source to sync the application to. In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. In case of Helm, this is a semver tag for the Chart's version. type: string required: - repoURL type: object required: - revision type: object required: - operation - phase - startedAt type: object reconciledAt: description: ReconciledAt indicates when the application state was reconciled using the latest git version format: date-time type: string resources: description: Resources is a list of Kubernetes resources managed by this application items: description: 'ResourceStatus holds the current sync and health status of a resource TODO: describe members of this type' properties: group: type: string health: description: HealthStatus contains information about the currently observed health state of an application or resource properties: message: description: Message is a human-readable informational message describing the health status type: string status: description: Status holds the status code of the application or resource type: string type: object hook: type: boolean kind: type: string name: type: string namespace: type: string requiresPruning: type: boolean status: description: SyncStatusCode is a type which represents possible comparison results type: string version: type: string type: object type: array sourceType: description: SourceType specifies the type of this application type: string summary: description: Summary contains a list of URLs and container images used by this application properties: externalURLs: description: ExternalURLs holds all external URLs of application child resources. items: type: string type: array images: description: Images holds all images of application child resources. items: type: string type: array type: object sync: description: Sync contains information about the application's current sync status properties: comparedTo: description: ComparedTo contains information about what has been compared properties: destination: description: Destination is a reference to the application's destination used for comparison properties: name: description: Name is an alternate way of specifying the target cluster by its symbolic name type: string namespace: description: Namespace specifies the target namespace for the application's resources. The namespace will only be set for namespace-scoped resources that have not set a value for .metadata.namespace type: string server: description: Server specifies the URL of the target cluster and must be set to the Kubernetes control plane API type: string type: object source: description: Source is a reference to the application's source used for comparison properties: chart: description: Chart is a Helm chart name, and must be specified for applications sourced from a Helm repo. type: string directory: description: Directory holds path/directory specific options properties: exclude: description: Exclude contains a glob pattern to match paths against that should be explicitly excluded from being used during manifest generation type: string include: description: Include contains a glob pattern to match paths against that should be explicitly included during manifest generation type: string jsonnet: description: Jsonnet holds options specific to Jsonnet properties: extVars: description: ExtVars is a list of Jsonnet External Variables items: description: JsonnetVar represents a variable to be passed to jsonnet during manifest generation properties: code: type: boolean name: type: string value: type: string required: - name - value type: object type: array libs: description: Additional library search dirs items: type: string type: array tlas: description: TLAS is a list of Jsonnet Top-level Arguments items: description: JsonnetVar represents a variable to be passed to jsonnet during manifest generation properties: code: type: boolean name: type: string value: type: string required: - name - value type: object type: array type: object recurse: description: Recurse specifies whether to scan a directory recursively for manifests type: boolean type: object helm: description: Helm holds helm specific options properties: fileParameters: description: FileParameters are file parameters to the helm template items: description: HelmFileParameter is a file parameter that's passed to helm template during manifest generation properties: name: description: Name is the name of the Helm parameter type: string path: description: Path is the path to the file containing the values for the Helm parameter type: string type: object type: array parameters: description: Parameters is a list of Helm parameters which are passed to the helm template command upon manifest generation items: description: HelmParameter is a parameter that's passed to helm template during manifest generation properties: forceString: description: ForceString determines whether to tell Helm to interpret booleans and numbers as strings type: boolean name: description: Name is the name of the Helm parameter type: string value: description: Value is the value for the Helm parameter type: string type: object type: array releaseName: description: ReleaseName is the Helm release name to use. If omitted it will use the application name type: string valueFiles: description: ValuesFiles is a list of Helm value files to use when generating a template items: type: string type: array values: description: Values specifies Helm values to be passed to helm template, typically defined as a block type: string version: description: Version is the Helm version to use for templating (either "2" or "3") type: string type: object ksonnet: description: Ksonnet holds ksonnet specific options properties: environment: description: Environment is a ksonnet application environment name type: string parameters: description: Parameters are a list of ksonnet component parameter override values items: description: KsonnetParameter is a ksonnet component parameter properties: component: type: string name: type: string value: type: string required: - name - value type: object type: array type: object kustomize: description: Kustomize holds kustomize specific options properties: commonAnnotations: additionalProperties: type: string description: CommonAnnotations is a list of additional annotations to add to rendered manifests type: object commonLabels: additionalProperties: type: string description: CommonLabels is a list of additional labels to add to rendered manifests type: object forceCommonAnnotations: description: ForceCommonAnnotations specifies whether to force applying common annotations to resources for Kustomize apps type: boolean forceCommonLabels: description: ForceCommonLabels specifies whether to force applying common labels to resources for Kustomize apps type: boolean images: description: Images is a list of Kustomize image override specifications items: description: KustomizeImage represents a Kustomize image definition in the format [old_image_name=]: type: string type: array namePrefix: description: NamePrefix is a prefix appended to resources for Kustomize apps type: string nameSuffix: description: NameSuffix is a suffix appended to resources for Kustomize apps type: string version: description: Version controls which version of Kustomize to use for rendering manifests type: string type: object path: description: Path is a directory path within the Git repository, and is only valid for applications sourced from Git. type: string plugin: description: ConfigManagementPlugin holds config management plugin specific options properties: env: description: Env is a list of environment variable entries items: description: EnvEntry represents an entry in the application's environment properties: name: description: Name is the name of the variable, usually expressed in uppercase type: string value: description: Value is the value of the variable type: string required: - name - value type: object type: array name: type: string type: object repoURL: description: RepoURL is the URL to the repository (Git or Helm) that contains the application manifests type: string targetRevision: description: TargetRevision defines the revision of the source to sync the application to. In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. In case of Helm, this is a semver tag for the Chart's version. type: string required: - repoURL type: object required: - destination - source type: object revision: description: Revision contains information about the revision the comparison has been performed to type: string status: description: Status is the sync state of the comparison type: string required: - status type: object type: object required: - metadata - spec type: object served: true storage: true subresources: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: labels: app.kubernetes.io/name: appprojects.argoproj.io app.kubernetes.io/part-of: argocd name: appprojects.argoproj.io spec: group: argoproj.io names: kind: AppProject listKind: AppProjectList plural: appprojects shortNames: - appproj - appprojs singular: appproject scope: Namespaced versions: - name: v1alpha1 schema: openAPIV3Schema: description: 'AppProject provides a logical grouping of applications, providing controls for: * where the apps may deploy to (cluster whitelist) * what may be deployed (repository whitelist, resource whitelist/blacklist) * who can access these applications (roles, OIDC group claims bindings) * and what they can do (RBAC policies) * automation access to these roles (JWT tokens)' properties: apiVersion: description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: description: AppProjectSpec is the specification of an AppProject properties: clusterResourceBlacklist: description: ClusterResourceBlacklist contains list of blacklisted cluster level resources items: description: GroupKind specifies a Group and a Kind, but does not force a version. This is useful for identifying concepts during lookup stages without having partially valid types properties: group: type: string kind: type: string required: - group - kind type: object type: array clusterResourceWhitelist: description: ClusterResourceWhitelist contains list of whitelisted cluster level resources items: description: GroupKind specifies a Group and a Kind, but does not force a version. This is useful for identifying concepts during lookup stages without having partially valid types properties: group: type: string kind: type: string required: - group - kind type: object type: array description: description: Description contains optional project description type: string destinations: description: Destinations contains list of destinations available for deployment items: description: ApplicationDestination holds information about the application's destination properties: name: description: Name is an alternate way of specifying the target cluster by its symbolic name type: string namespace: description: Namespace specifies the target namespace for the application's resources. The namespace will only be set for namespace-scoped resources that have not set a value for .metadata.namespace type: string server: description: Server specifies the URL of the target cluster and must be set to the Kubernetes control plane API type: string type: object type: array namespaceResourceBlacklist: description: NamespaceResourceBlacklist contains list of blacklisted namespace level resources items: description: GroupKind specifies a Group and a Kind, but does not force a version. This is useful for identifying concepts during lookup stages without having partially valid types properties: group: type: string kind: type: string required: - group - kind type: object type: array namespaceResourceWhitelist: description: NamespaceResourceWhitelist contains list of whitelisted namespace level resources items: description: GroupKind specifies a Group and a Kind, but does not force a version. This is useful for identifying concepts during lookup stages without having partially valid types properties: group: type: string kind: type: string required: - group - kind type: object type: array orphanedResources: description: OrphanedResources specifies if controller should monitor orphaned resources of apps in this project properties: ignore: description: Ignore contains a list of resources that are to be excluded from orphaned resources monitoring items: description: OrphanedResourceKey is a reference to a resource to be ignored from properties: group: type: string kind: type: string name: type: string type: object type: array warn: description: Warn indicates if warning condition should be created for apps which have orphaned resources type: boolean type: object roles: description: Roles are user defined RBAC roles associated with this project items: description: ProjectRole represents a role that has access to a project properties: description: description: Description is a description of the role type: string groups: description: Groups are a list of OIDC group claims bound to this role items: type: string type: array jwtTokens: description: JWTTokens are a list of generated JWT tokens bound to this role items: description: JWTToken holds the issuedAt and expiresAt values of a token properties: exp: format: int64 type: integer iat: format: int64 type: integer id: type: string required: - iat type: object type: array name: description: Name is a name for this role type: string policies: description: Policies Stores a list of casbin formatted strings that define access policies for the role in the project items: type: string type: array required: - name type: object type: array signatureKeys: description: SignatureKeys contains a list of PGP key IDs that commits in Git must be signed with in order to be allowed for sync items: description: SignatureKey is the specification of a key required to verify commit signatures with properties: keyID: description: The ID of the key in hexadecimal notation type: string required: - keyID type: object type: array sourceRepos: description: SourceRepos contains list of repository URLs which can be used for deployment items: type: string type: array syncWindows: description: SyncWindows controls when syncs can be run for apps in this project items: description: SyncWindow contains the kind, time, duration and attributes that are used to assign the syncWindows to apps properties: applications: description: Applications contains a list of applications that the window will apply to items: type: string type: array clusters: description: Clusters contains a list of clusters that the window will apply to items: type: string type: array duration: description: Duration is the amount of time the sync window will be open type: string kind: description: Kind defines if the window allows or blocks syncs type: string manualSync: description: ManualSync enables manual syncs when they would otherwise be blocked type: boolean namespaces: description: Namespaces contains a list of namespaces that the window will apply to items: type: string type: array schedule: description: Schedule is the time the window will begin, specified in cron format type: string type: object type: array type: object status: description: AppProjectStatus contains status information for AppProject CRs properties: jwtTokensByRole: additionalProperties: description: JWTTokens represents a list of JWT tokens properties: items: items: description: JWTToken holds the issuedAt and expiresAt values of a token properties: exp: format: int64 type: integer iat: format: int64 type: integer id: type: string required: - iat type: object type: array type: object description: JWTTokensByRole contains a list of JWT tokens issued for a given role type: object type: object required: - metadata - spec type: object served: true storage: true --- apiVersion: v1 kind: ServiceAccount metadata: labels: app.kubernetes.io/component: application-controller app.kubernetes.io/name: argocd-application-controller app.kubernetes.io/part-of: argocd name: argocd-application-controller --- apiVersion: v1 kind: ServiceAccount metadata: labels: app.kubernetes.io/component: dex-server app.kubernetes.io/name: argocd-dex-server app.kubernetes.io/part-of: argocd name: argocd-dex-server --- apiVersion: v1 kind: ServiceAccount metadata: labels: app.kubernetes.io/component: redis app.kubernetes.io/name: argocd-redis-ha app.kubernetes.io/part-of: argocd name: argocd-redis-ha --- apiVersion: v1 kind: ServiceAccount metadata: labels: app.kubernetes.io/component: redis app.kubernetes.io/name: argocd-redis-ha-haproxy app.kubernetes.io/part-of: argocd name: argocd-redis-ha-haproxy --- apiVersion: v1 kind: ServiceAccount metadata: labels: app.kubernetes.io/component: server app.kubernetes.io/name: argocd-server app.kubernetes.io/part-of: argocd name: argocd-server --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: labels: app.kubernetes.io/component: application-controller app.kubernetes.io/name: argocd-application-controller app.kubernetes.io/part-of: argocd name: argocd-application-controller rules: - apiGroups: - "" resources: - secrets - configmaps verbs: - get - list - watch - apiGroups: - argoproj.io resources: - applications - appprojects verbs: - create - get - list - watch - update - patch - delete - apiGroups: - "" resources: - events verbs: - create - list --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: labels: app.kubernetes.io/component: dex-server app.kubernetes.io/name: argocd-dex-server app.kubernetes.io/part-of: argocd name: argocd-dex-server rules: - apiGroups: - "" resources: - secrets - configmaps verbs: - get - list - watch --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: labels: app.kubernetes.io/component: redis app.kubernetes.io/name: argocd-redis-ha app.kubernetes.io/part-of: argocd name: argocd-redis-ha rules: - apiGroups: - "" resources: - endpoints verbs: - get --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: labels: app: redis-ha chart: redis-ha-4.12.15 component: argocd-redis-ha-haproxy heritage: Helm release: argocd name: argocd-redis-ha-haproxy rules: - apiGroups: - "" resources: - endpoints verbs: - get --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: labels: app.kubernetes.io/component: server app.kubernetes.io/name: argocd-server app.kubernetes.io/part-of: argocd name: argocd-server rules: - apiGroups: - "" resources: - secrets - configmaps verbs: - create - get - list - watch - update - patch - delete - apiGroups: - argoproj.io resources: - applications - appprojects verbs: - create - get - list - watch - update - delete - patch - apiGroups: - "" resources: - events verbs: - create - list --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: labels: app.kubernetes.io/component: application-controller app.kubernetes.io/name: argocd-application-controller app.kubernetes.io/part-of: argocd name: argocd-application-controller rules: - apiGroups: - '*' resources: - '*' verbs: - '*' - nonResourceURLs: - '*' verbs: - '*' --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: labels: app.kubernetes.io/component: server app.kubernetes.io/name: argocd-server app.kubernetes.io/part-of: argocd name: argocd-server rules: - apiGroups: - '*' resources: - '*' verbs: - delete - get - patch - apiGroups: - "" resources: - events verbs: - list - apiGroups: - "" resources: - pods - pods/log verbs: - get --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: labels: app.kubernetes.io/component: application-controller app.kubernetes.io/name: argocd-application-controller app.kubernetes.io/part-of: argocd name: argocd-application-controller roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: argocd-application-controller subjects: - kind: ServiceAccount name: argocd-application-controller --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: labels: app.kubernetes.io/component: dex-server app.kubernetes.io/name: argocd-dex-server app.kubernetes.io/part-of: argocd name: argocd-dex-server roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: argocd-dex-server subjects: - kind: ServiceAccount name: argocd-dex-server --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: labels: app.kubernetes.io/component: redis app.kubernetes.io/name: argocd-redis-ha app.kubernetes.io/part-of: argocd name: argocd-redis-ha roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: argocd-redis-ha subjects: - kind: ServiceAccount name: argocd-redis-ha --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: labels: app: redis-ha chart: redis-ha-4.12.15 component: argocd-redis-ha-haproxy heritage: Helm release: argocd name: argocd-redis-ha-haproxy roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: argocd-redis-ha-haproxy subjects: - kind: ServiceAccount name: argocd-redis-ha-haproxy --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: labels: app.kubernetes.io/component: server app.kubernetes.io/name: argocd-server app.kubernetes.io/part-of: argocd name: argocd-server roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: argocd-server subjects: - kind: ServiceAccount name: argocd-server --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: labels: app.kubernetes.io/component: application-controller app.kubernetes.io/name: argocd-application-controller app.kubernetes.io/part-of: argocd name: argocd-application-controller roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: argocd-application-controller subjects: - kind: ServiceAccount name: argocd-application-controller namespace: argocd --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: labels: app.kubernetes.io/component: server app.kubernetes.io/name: argocd-server app.kubernetes.io/part-of: argocd name: argocd-server roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: argocd-server subjects: - kind: ServiceAccount name: argocd-server namespace: argocd --- apiVersion: v1 kind: ConfigMap metadata: labels: app.kubernetes.io/name: argocd-cm app.kubernetes.io/part-of: argocd name: argocd-cm --- apiVersion: v1 kind: ConfigMap metadata: labels: app.kubernetes.io/name: argocd-cmd-params-cm app.kubernetes.io/part-of: argocd name: argocd-cmd-params-cm --- apiVersion: v1 kind: ConfigMap metadata: labels: app.kubernetes.io/name: argocd-gpg-keys-cm app.kubernetes.io/part-of: argocd name: argocd-gpg-keys-cm --- apiVersion: v1 kind: ConfigMap metadata: labels: app.kubernetes.io/name: argocd-rbac-cm app.kubernetes.io/part-of: argocd name: argocd-rbac-cm --- apiVersion: v1 data: haproxy.cfg: | defaults REDIS mode tcp timeout connect 4s timeout server 6m timeout client 6m timeout check 2s

listen health_check_http_url
  bind :8888
  mode http
  monitor-uri /healthz
  option      dontlognull
# Check Sentinel and whether they are nominated master
backend check_if_redis_is_master_0
  mode tcp
  option tcp-check
  tcp-check connect
  tcp-check send PING\r\n
  tcp-check expect string +PONG
  tcp-check send SENTINEL\ get-master-addr-by-name\ argocd\r\n
  tcp-check expect string REPLACE_ANNOUNCE0
  tcp-check send QUIT\r\n
  tcp-check expect string +OK
  server R0 argocd-redis-ha-announce-0:26379 check inter 3s
  server R1 argocd-redis-ha-announce-1:26379 check inter 3s
  server R2 argocd-redis-ha-announce-2:26379 check inter 3s
# Check Sentinel and whether they are nominated master
backend check_if_redis_is_master_1
  mode tcp
  option tcp-check
  tcp-check connect
  tcp-check send PING\r\n
  tcp-check expect string +PONG
  tcp-check send SENTINEL\ get-master-addr-by-name\ argocd\r\n
  tcp-check expect string REPLACE_ANNOUNCE1
  tcp-check send QUIT\r\n
  tcp-check expect string +OK
  server R0 argocd-redis-ha-announce-0:26379 check inter 3s
  server R1 argocd-redis-ha-announce-1:26379 check inter 3s
  server R2 argocd-redis-ha-announce-2:26379 check inter 3s
# Check Sentinel and whether they are nominated master
backend check_if_redis_is_master_2
  mode tcp
  option tcp-check
  tcp-check connect
  tcp-check send PING\r\n
  tcp-check expect string +PONG
  tcp-check send SENTINEL\ get-master-addr-by-name\ argocd\r\n
  tcp-check expect string REPLACE_ANNOUNCE2
  tcp-check send QUIT\r\n
  tcp-check expect string +OK
  server R0 argocd-redis-ha-announce-0:26379 check inter 3s
  server R1 argocd-redis-ha-announce-1:26379 check inter 3s
  server R2 argocd-redis-ha-announce-2:26379 check inter 3s

# decide redis backend to use
#master
frontend ft_redis_master
  bind *:6379
  use_backend bk_redis_master
# Check all redis servers to see if they think they are master
backend bk_redis_master
  mode tcp
  option tcp-check
  tcp-check connect
  tcp-check send PING\r\n
  tcp-check expect string +PONG
  tcp-check send info\ replication\r\n
  tcp-check expect string role:master
  tcp-check send QUIT\r\n
  tcp-check expect string +OK
  use-server R0 if { srv_is_up(R0) } { nbsrv(check_if_redis_is_master_0) ge 2 }
  server R0 argocd-redis-ha-announce-0:6379 check inter 3s fall 1 rise 1
  use-server R1 if { srv_is_up(R1) } { nbsrv(check_if_redis_is_master_1) ge 2 }
  server R1 argocd-redis-ha-announce-1:6379 check inter 3s fall 1 rise 1
  use-server R2 if { srv_is_up(R2) } { nbsrv(check_if_redis_is_master_2) ge 2 }
  server R2 argocd-redis-ha-announce-2:6379 check inter 3s fall 1 rise 1

haproxy_init.sh: |
HAPROXY_CONF=/data/haproxy.cfg
cp /readonly/haproxy.cfg "$HAPROXY_CONF"
for loop in $(seq 1 10); do
getent hosts argocd-redis-ha-announce-0 && break
echo "Waiting for service argocd-redis-ha-announce-0 to be ready ($loop) ..." && sleep 1
done
ANNOUNCE_IP0=$(getent hosts "argocd-redis-ha-announce-0" | awk '{ print $1 }')
if [ -z "$ANNOUNCE_IP0" ]; then
echo "Could not resolve the announce ip for argocd-redis-ha-announce-0"
exit 1
fi
sed -i "s/REPLACE_ANNOUNCE0/$ANNOUNCE_IP0/" "$HAPROXY_CONF"

if [ "${AUTH:-}" ]; then
    echo "Setting auth values"
    ESCAPED_AUTH=$(echo "$AUTH" | sed -e 's/[\/&]/\\&/g');
    sed -i "s/REPLACE_AUTH_SECRET/${ESCAPED_AUTH}/" "$HAPROXY_CONF"
fi
for loop in $(seq 1 10); do
  getent hosts argocd-redis-ha-announce-1 && break
  echo "Waiting for service argocd-redis-ha-announce-1 to be ready ($loop) ..." && sleep 1
done
ANNOUNCE_IP1=$(getent hosts "argocd-redis-ha-announce-1" | awk '{ print $1 }')
if [ -z "$ANNOUNCE_IP1" ]; then
  echo "Could not resolve the announce ip for argocd-redis-ha-announce-1"
  exit 1
fi
sed -i "s/REPLACE_ANNOUNCE1/$ANNOUNCE_IP1/" "$HAPROXY_CONF"

if [ "${AUTH:-}" ]; then
    echo "Setting auth values"
    ESCAPED_AUTH=$(echo "$AUTH" | sed -e 's/[\/&]/\\&/g');
    sed -i "s/REPLACE_AUTH_SECRET/${ESCAPED_AUTH}/" "$HAPROXY_CONF"
fi
for loop in $(seq 1 10); do
  getent hosts argocd-redis-ha-announce-2 && break
  echo "Waiting for service argocd-redis-ha-announce-2 to be ready ($loop) ..." && sleep 1
done
ANNOUNCE_IP2=$(getent hosts "argocd-redis-ha-announce-2" | awk '{ print $1 }')
if [ -z "$ANNOUNCE_IP2" ]; then
  echo "Could not resolve the announce ip for argocd-redis-ha-announce-2"
  exit 1
fi
sed -i "s/REPLACE_ANNOUNCE2/$ANNOUNCE_IP2/" "$HAPROXY_CONF"

if [ "${AUTH:-}" ]; then
    echo "Setting auth values"
    ESCAPED_AUTH=$(echo "$AUTH" | sed -e 's/[\/&]/\\&/g');
    sed -i "s/REPLACE_AUTH_SECRET/${ESCAPED_AUTH}/" "$HAPROXY_CONF"
fi

init.sh: |
echo "$(date) Start..."
HOSTNAME="$(hostname)"
INDEX="${HOSTNAME##*-}"
SENTINEL_PORT=26379
MASTER=''
MASTER_GROUP="argocd"
QUORUM="2"
REDIS_CONF=/data/conf/redis.conf
REDIS_PORT=6379
REDIS_TLS_PORT=
SENTINEL_CONF=/data/conf/sentinel.conf
SENTINEL_TLS_PORT=
SERVICE=argocd-redis-ha
SENTINEL_TLS_REPLICATION_ENABLED=false
REDIS_TLS_REPLICATION_ENABLED=false
set -eu

sentinel_get_master() {
set +e
    if [ "$SENTINEL_PORT" -eq 0 ]; then
        redis-cli -h "${SERVICE}" -p "${SENTINEL_TLS_PORT}"   --tls --cacert /tls-certs/ca.crt --cert /tls-certs/redis.crt --key /tls-certs/redis.key sentinel get-master-addr-by-name "${MASTER_GROUP}" |\
        grep -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
    else
        redis-cli -h "${SERVICE}" -p "${SENTINEL_PORT}"  sentinel get-master-addr-by-name "${MASTER_GROUP}" |\
        grep -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
    fi
set -e
}

sentinel_get_master_retry() {
    master=''
    retry=${1}
    sleep=3
    for i in $(seq 1 "${retry}"); do
        master=$(sentinel_get_master)
        if [ -n "${master}" ]; then
            break
        fi
        sleep $((sleep + i))
    done
    echo "${master}"
}

identify_master() {
    echo "Identifying redis master (get-master-addr-by-name).."
    echo "  using sentinel (argocd-redis-ha), sentinel group name (argocd)"
    echo "  $(date).."
    MASTER="$(sentinel_get_master_retry 3)"
    if [ -n "${MASTER}" ]; then
        echo "  $(date) Found redis master (${MASTER})"
    else
        echo "  $(date) Did not find redis master (${MASTER})"
    fi
}

sentinel_update() {
    echo "Updating sentinel config.."
    echo "  evaluating sentinel id (\${SENTINEL_ID_${INDEX}})"
    eval MY_SENTINEL_ID="\$SENTINEL_ID_${INDEX}"
    echo "  sentinel id (${MY_SENTINEL_ID}), sentinel grp (${MASTER_GROUP}), quorum (${QUORUM})"
    sed -i "1s/^/sentinel myid ${MY_SENTINEL_ID}\\n/" "${SENTINEL_CONF}"
    if [ "$SENTINEL_TLS_REPLICATION_ENABLED" = true ]; then
        echo "  redis master (${1}:${REDIS_TLS_PORT})"
        sed -i "2s/^/sentinel monitor ${MASTER_GROUP} ${1} ${REDIS_TLS_PORT} ${QUORUM} \\n/" "${SENTINEL_CONF}"
    else
        echo "  redis master (${1}:${REDIS_PORT})"
        sed -i "2s/^/sentinel monitor ${MASTER_GROUP} ${1} ${REDIS_PORT} ${QUORUM} \\n/" "${SENTINEL_CONF}"
    fi
    echo "sentinel announce-ip ${ANNOUNCE_IP}" >> ${SENTINEL_CONF}
    if [ "$SENTINEL_PORT" -eq 0 ]; then
        echo "  announce (${ANNOUNCE_IP}:${SENTINEL_TLS_PORT})"
        echo "sentinel announce-port ${SENTINEL_TLS_PORT}" >> ${SENTINEL_CONF}
    else
        echo "  announce (${ANNOUNCE_IP}:${SENTINEL_PORT})"
        echo "sentinel announce-port ${SENTINEL_PORT}" >> ${SENTINEL_CONF}
    fi
}

redis_update() {
    echo "Updating redis config.."
    if [ "$REDIS_TLS_REPLICATION_ENABLED" = true ]; then
        echo "  we are slave of redis master (${1}:${REDIS_TLS_PORT})"
        echo "slaveof ${1} ${REDIS_TLS_PORT}" >> "${REDIS_CONF}"
        echo "slave-announce-port ${REDIS_TLS_PORT}" >> ${REDIS_CONF}
    else
        echo "  we are slave of redis master (${1}:${REDIS_PORT})"
        echo "slaveof ${1} ${REDIS_PORT}" >> "${REDIS_CONF}"
        echo "slave-announce-port ${REDIS_PORT}" >> ${REDIS_CONF}
    fi
    echo "slave-announce-ip ${ANNOUNCE_IP}" >> ${REDIS_CONF}
}

copy_config() {
    echo "Copying default redis config.."
    echo "  to '${REDIS_CONF}'"
    cp /readonly-config/redis.conf "${REDIS_CONF}"
    echo "Copying default sentinel config.."
    echo "  to '${SENTINEL_CONF}'"
    cp /readonly-config/sentinel.conf "${SENTINEL_CONF}"
}

setup_defaults() {
    echo "Setting up defaults.."
    echo "  using statefulset index (${INDEX})"
    if [ "${INDEX}" = "0" ]; then
        echo "Setting this pod as master for redis and sentinel.."
        echo "  using announce (${ANNOUNCE_IP})"
        redis_update "${ANNOUNCE_IP}"
        sentinel_update "${ANNOUNCE_IP}"
        echo "  make sure ${ANNOUNCE_IP} is not a slave (slaveof no one)"
        sed -i "s/^.*slaveof.*//" "${REDIS_CONF}"
    else
        echo "Getting redis master ip.."
        echo "  blindly assuming (${SERVICE}-announce-0) or (${SERVICE}-server-0) are master"
        DEFAULT_MASTER="$(getent_hosts 0 | awk '{ print $1 }')"
        echo "  identified redis (may be redis master) ip (${DEFAULT_MASTER})"
        if [ -z "${DEFAULT_MASTER}" ]; then
            echo "Error: Unable to resolve redis master (getent hosts)."
            exit 1
        fi
        echo "Setting default slave config for redis and sentinel.."
        echo "  using master ip (${DEFAULT_MASTER})"
        redis_update "${DEFAULT_MASTER}"
        sentinel_update "${DEFAULT_MASTER}"
    fi
}

redis_ping() {
set +e
    if [ "$REDIS_PORT" -eq 0 ]; then
        redis-cli -h "${MASTER}" -p "${REDIS_TLS_PORT}"  --tls --cacert /tls-certs/ca.crt --cert /tls-certs/redis.crt --key /tls-certs/redis.key ping
    else
        redis-cli -h "${MASTER}" -p "${REDIS_PORT}" ping
    fi
set -e
}

redis_ping_retry() {
    ping=''
    retry=${1}
    sleep=3
    for i in $(seq 1 "${retry}"); do
        if [ "$(redis_ping)" = "PONG" ]; then
           ping='PONG'
           break
        fi
        sleep $((sleep + i))
        MASTER=$(sentinel_get_master)
    done
    echo "${ping}"
}

find_master() {
    echo "Verifying redis master.."
    if [ "$REDIS_PORT" -eq 0 ]; then
        echo "  ping (${MASTER}:${REDIS_TLS_PORT})"
    else
        echo "  ping (${MASTER}:${REDIS_PORT})"
    fi
    echo "  $(date).."
    if [ "$(redis_ping_retry 3)" != "PONG" ]; then
        echo "  $(date) Can't ping redis master (${MASTER})"
        echo "Attempting to force failover (sentinel failover).."

        if [ "$SENTINEL_PORT" -eq 0 ]; then
            echo "  on sentinel (${SERVICE}:${SENTINEL_TLS_PORT}), sentinel grp (${MASTER_GROUP})"
            echo "  $(date).."
            if redis-cli -h "${SERVICE}" -p "${SENTINEL_TLS_PORT}"   --tls --cacert /tls-certs/ca.crt --cert /tls-certs/redis.crt --key /tls-certs/redis.key sentinel failover "${MASTER_GROUP}" | grep -q 'NOGOODSLAVE' ; then
                echo "  $(date) Failover returned with 'NOGOODSLAVE'"
                echo "Setting defaults for this pod.."
                setup_defaults
                return 0
            fi
        else
            echo "  on sentinel (${SERVICE}:${SENTINEL_PORT}), sentinel grp (${MASTER_GROUP})"
            echo "  $(date).."
            if redis-cli -h "${SERVICE}" -p "${SENTINEL_PORT}"  sentinel failover "${MASTER_GROUP}" | grep -q 'NOGOODSLAVE' ; then
                echo "  $(date) Failover returned with 'NOGOODSLAVE'"
                echo "Setting defaults for this pod.."
                setup_defaults
                return 0
            fi
        fi

        echo "Hold on for 10sec"
        sleep 10
        echo "We should get redis master's ip now. Asking (get-master-addr-by-name).."
        if [ "$SENTINEL_PORT" -eq 0 ]; then
            echo "  sentinel (${SERVICE}:${SENTINEL_TLS_PORT}), sentinel grp (${MASTER_GROUP})"
        else
            echo "  sentinel (${SERVICE}:${SENTINEL_PORT}), sentinel grp (${MASTER_GROUP})"
        fi
        echo "  $(date).."
        MASTER="$(sentinel_get_master)"
        if [ "${MASTER}" ]; then
            echo "  $(date) Found redis master (${MASTER})"
            echo "Updating redis and sentinel config.."
            sentinel_update "${MASTER}"
            redis_update "${MASTER}"
        else
            echo "$(date) Error: Could not failover, exiting..."
            exit 1
        fi
    else
        echo "  $(date) Found reachable redis master (${MASTER})"
        echo "Updating redis and sentinel config.."
        sentinel_update "${MASTER}"
        redis_update "${MASTER}"
    fi
}

redis_ro_update() {
    echo "Updating read-only redis config.."
    echo "  redis.conf set 'replica-priority 0'"
    echo "replica-priority 0" >> ${REDIS_CONF}
}

getent_hosts() {
    index=${1:-${INDEX}}
    service="${SERVICE}-announce-${index}"
    pod="${SERVICE}-server-${index}"
    host=$(getent hosts "${service}")
    if [ -z "${host}" ]; then
        host=$(getent hosts "${pod}")
    fi
    echo "${host}"
}

mkdir -p /data/conf/

echo "Initializing config.."
copy_config

# where is redis master
identify_master

echo "Identify announce ip for this pod.."
echo "  using (${SERVICE}-announce-${INDEX}) or (${SERVICE}-server-${INDEX})"
ANNOUNCE_IP=$(getent_hosts | awk '{ print $1 }')
echo "  identified announce (${ANNOUNCE_IP})"
if [ -z "${ANNOUNCE_IP}" ]; then
    "Error: Could not resolve the announce ip for this pod."
    exit 1
elif [ "${MASTER}" ]; then
    find_master
else
    setup_defaults
fi

if [ "${AUTH:-}" ]; then
    echo "Setting redis auth values.."
    ESCAPED_AUTH=$(echo "${AUTH}" | sed -e 's/[\/&]/\\&/g');
    sed -i "s/replace-default-auth/${ESCAPED_AUTH}/" "${REDIS_CONF}" "${SENTINEL_CONF}"
fi

if [ "${SENTINELAUTH:-}" ]; then
    echo "Setting sentinel auth values"
    ESCAPED_AUTH_SENTINEL=$(echo "$SENTINELAUTH" | sed -e 's/[\/&]/\\&/g');
    sed -i "s/replace-default-sentinel-auth/${ESCAPED_AUTH_SENTINEL}/" "$SENTINEL_CONF"
fi

echo "$(date) Ready..."

redis.conf: |
dir "/data"
port 6379
bind 0.0.0.0
maxmemory 0
maxmemory-policy volatile-lru
min-replicas-max-lag 5
min-replicas-to-write 1
rdbchecksum yes
rdbcompression yes
repl-diskless-sync yes
save ""
sentinel.conf: |
dir "/data"
port 26379
bind 0.0.0.0
sentinel down-after-milliseconds argocd 10000
sentinel failover-timeout argocd 180000
maxclients 10000
sentinel parallel-syncs argocd 5
kind: ConfigMap
metadata:
labels:
app.kubernetes.io/component: redis
app.kubernetes.io/name: argocd-redis-ha
app.kubernetes.io/part-of: argocd
name: argocd-redis-ha-configmap

apiVersion: v1
data:
redis_liveness.sh: |
response=$(
redis-cli
-h localhost
-p 6379
ping
)
if [ "$response" != "PONG" ] && [ "${response:0:7}" != "LOADING" ] ; then
echo "$response"
exit 1
fi
echo "response=$response"
redis_readiness.sh: |
response=$(
redis-cli
-h localhost
-p 6379
ping
)
if [ "$response" != "PONG" ] ; then
echo "$response"
exit 1
fi
echo "response=$response"
sentinel_liveness.sh: |
response=$(
redis-cli
-h localhost
-p 26379
ping
)
if [ "$response" != "PONG" ]; then
echo "$response"
exit 1
fi
echo "response=$response"
kind: ConfigMap
metadata:
labels:
app: argocd-redis-ha
chart: redis-ha-4.12.15
heritage: Helm
release: argocd
name: argocd-redis-ha-health-configmap

apiVersion: v1
data:
ssh_known_hosts: |
bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/VqLat/MaB33pZy0y3rJZtnqwR2qOOvbwKZYKiEO1O6VqNEBxKvJJelCq0dTXWT5pbO2gDXC6h6QDXCaHo6pOHGPUy+YBaGQRGuSusMEASYiWunYN0vCAI8QaXnWMXNMdFP3jHAJH0eDsoiGnLPBlBp4TNm6rYI74nMzgz3B9IikW4WVK+dc8KZJZWYjAuORU3jc1c/NPskD2ASinf8v3xnfXeukU0sJ5N6m5E8VLjObPEO+mN2t/FZTMZLiFqPWc/ALSqnMnnhwrNi2rbfg/rd/IpL8Le3pSBne8+seeFVBoGqzHM9yXw==
github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
gitlab.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFSMqzJeV9rUzU4kWitGjeR4PWSa29SPqJ1fVkhtj3Hw9xjLVXVYrU9QlYWrOLXBpQ6KWjbjTDTdDkoohFzgbEY=
gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf
gitlab.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bNKTBSpIYDEGk9KxsGh3mySTRgMtXL583qmBpzeQ+jqCMRgBqB98u3z++J1sKlXHWfM9dyhSevkMwSbhoR8XIq/U0tCNyokEi/ueaBMCvbcTHhO7FcwzY92WK4Yt0aGROY5qX2UKSeOvuP4D6TPqKF1onrSzH9bx9XUf2lEdWT/ia1NEKjunUqu1xOB/StKDHMoX4/OKyIzuS0q/T1zOATthvasJFoPrAjkohTyaDUz2LN5JoH839hViyEG82yB+MjcFV5MU3N1l1QL3cVUCh93xSaua1N85qivl+siMkPGbO5xR/En4iEY6K2XPASUEMaieWVNTRCtJ4S8H+9
ssh.dev.azure.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H
vs-ssh.visualstudio.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H
kind: ConfigMap
metadata:
labels:
app.kubernetes.io/name: argocd-ssh-known-hosts-cm
app.kubernetes.io/part-of: argocd
name: argocd-ssh-known-hosts-cm

apiVersion: v1
data: null
kind: ConfigMap
metadata:
labels:
app.kubernetes.io/name: argocd-tls-certs-cm
app.kubernetes.io/part-of: argocd
name: argocd-tls-certs-cm

apiVersion: v1
kind: Secret
metadata:
labels:
app.kubernetes.io/name: argocd-secret
app.kubernetes.io/part-of: argocd
name: argocd-secret
type: Opaque

apiVersion: v1
kind: Service
metadata:
labels:
app.kubernetes.io/component: dex-server
app.kubernetes.io/name: argocd-dex-server
app.kubernetes.io/part-of: argocd
name: argocd-dex-server
spec:
ports:

• name: http
  port: 5556
  protocol: TCP
  targetPort: 5556
• name: grpc
  port: 5557
  protocol: TCP
  targetPort: 5557
• name: metrics
  port: 5558
  protocol: TCP
  targetPort: 5558
  selector:
  app.kubernetes.io/name: argocd-dex-server

---

apiVersion: v1
kind: Service
metadata:
labels:
app.kubernetes.io/component: metrics
app.kubernetes.io/name: argocd-metrics
app.kubernetes.io/part-of: argocd
name: argocd-metrics
spec:
ports:

• name: metrics
  port: 8082
  protocol: TCP
  targetPort: 8082
  selector:
  app.kubernetes.io/name: argocd-application-controller

---

apiVersion: v1
kind: Service
metadata:
labels:
app.kubernetes.io/component: redis
app.kubernetes.io/name: argocd-redis-ha
app.kubernetes.io/part-of: argocd
name: argocd-redis-ha
spec:
clusterIP: None
ports:

• name: tcp-server
  port: 6379
  protocol: TCP
  targetPort: redis
• name: tcp-sentinel
  port: 26379
  protocol: TCP
  targetPort: sentinel
  selector:
  app.kubernetes.io/name: argocd-redis-ha
  type: ClusterIP

---

apiVersion: v1
kind: Service
metadata:
annotations:
service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
labels:
app.kubernetes.io/component: redis
app.kubernetes.io/name: argocd-redis-ha
app.kubernetes.io/part-of: argocd
name: argocd-redis-ha-announce-0
spec:
ports:

• name: tcp-server
  port: 6379
  protocol: TCP
  targetPort: redis
• name: tcp-sentinel
  port: 26379
  protocol: TCP
  targetPort: sentinel
  publishNotReadyAddresses: true
  selector:
  app.kubernetes.io/name: argocd-redis-ha
  statefulset.kubernetes.io/pod-name: argocd-redis-ha-server-0
  type: ClusterIP

---

apiVersion: v1
kind: Service
metadata:
annotations:
service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
labels:
app.kubernetes.io/component: redis
app.kubernetes.io/name: argocd-redis-ha
app.kubernetes.io/part-of: argocd
name: argocd-redis-ha-announce-1
spec:
ports:

• name: tcp-server
  port: 6379
  protocol: TCP
  targetPort: redis
• name: tcp-sentinel
  port: 26379
  protocol: TCP
  targetPort: sentinel
  publishNotReadyAddresses: true
  selector:
  app.kubernetes.io/name: argocd-redis-ha
  statefulset.kubernetes.io/pod-name: argocd-redis-ha-server-1
  type: ClusterIP

---

apiVersion: v1
kind: Service
metadata:
annotations:
service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
labels:
app.kubernetes.io/component: redis
app.kubernetes.io/name: argocd-redis-ha
app.kubernetes.io/part-of: argocd
name: argocd-redis-ha-announce-2
spec:
ports:

• name: tcp-server
  port: 6379
  protocol: TCP
  targetPort: redis
• name: tcp-sentinel
  port: 26379
  protocol: TCP
  targetPort: sentinel
  publishNotReadyAddresses: true
  selector:
  app.kubernetes.io/name: argocd-redis-ha
  statefulset.kubernetes.io/pod-name: argocd-redis-ha-server-2
  type: ClusterIP

---

apiVersion: v1
kind: Service
metadata:
labels:
app.kubernetes.io/component: redis
app.kubernetes.io/name: argocd-redis-ha-haproxy
app.kubernetes.io/part-of: argocd
name: argocd-redis-ha-haproxy
spec:
ports:

• name: tcp-haproxy
  port: 6379
  protocol: TCP
  targetPort: redis
  selector:
  app.kubernetes.io/name: argocd-redis-ha-haproxy
  type: ClusterIP

---

apiVersion: v1
kind: Service
metadata:
labels:
app.kubernetes.io/component: repo-server
app.kubernetes.io/name: argocd-repo-server
app.kubernetes.io/part-of: argocd
name: argocd-repo-server
spec:
ports:

• name: server
  port: 8081
  protocol: TCP
  targetPort: 8081
• name: metrics
  port: 8084
  protocol: TCP
  targetPort: 8084
  selector:
  app.kubernetes.io/name: argocd-repo-server

---

apiVersion: v1
kind: Service
metadata:
labels:
app.kubernetes.io/component: server
app.kubernetes.io/name: argocd-server
app.kubernetes.io/part-of: argocd
name: argocd-server
spec:
ports:

• name: http
  port: 80
  protocol: TCP
  targetPort: 8080
• name: https
  port: 443
  protocol: TCP
  targetPort: 8080
  selector:
  app.kubernetes.io/name: argocd-server

---

apiVersion: v1
kind: Service
metadata:
labels:
app.kubernetes.io/component: server
app.kubernetes.io/name: argocd-server-metrics
app.kubernetes.io/part-of: argocd
name: argocd-server-metrics
spec:
ports:

• name: metrics
  port: 8083
  protocol: TCP
  targetPort: 8083
  selector:
  app.kubernetes.io/name: argocd-server

---

apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app.kubernetes.io/component: dex-server
app.kubernetes.io/name: argocd-dex-server
app.kubernetes.io/part-of: argocd
name: argocd-dex-server
spec:
selector:
matchLabels:
app.kubernetes.io/name: argocd-dex-server
template:
metadata:
labels:
app.kubernetes.io/name: argocd-dex-server
spec:
affinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- podAffinityTerm:
labelSelector:
matchLabels:
app.kubernetes.io/part-of: argocd
topologyKey: kubernetes.io/hostname
weight: 5
containers:
- command:
- /shared/argocd-dex
- rundex
image: ghcr.io/dexidp/dex:v2.27.0
imagePullPolicy: Always
name: dex
ports:
- containerPort: 5556
- containerPort: 5557
- containerPort: 5558
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
volumeMounts:
- mountPath: /shared
name: static-files
- mountPath: /tmp
name: dexconfig
initContainers:
- command:
- cp
- -n
- /usr/local/bin/argocd
- /shared/argocd-dex
image: quay.io/argoproj/argocd:v2.1.0
imagePullPolicy: Always
name: copyutil
volumeMounts:
- mountPath: /shared
name: static-files
- mountPath: /tmp
name: dexconfig
serviceAccountName: argocd-dex-server
volumes:
- emptyDir: {}
name: static-files
- emptyDir: {}
name: dexconfig

apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app.kubernetes.io/component: redis
app.kubernetes.io/name: argocd-redis-ha-haproxy
app.kubernetes.io/part-of: argocd
name: argocd-redis-ha-haproxy
spec:
replicas: 3
revisionHistoryLimit: 1
selector:
matchLabels:
app.kubernetes.io/name: argocd-redis-ha-haproxy
strategy:
type: RollingUpdate
template:
metadata:
annotations:
checksum/config: c55502ce732f78a70658dc77f00c02444cd6b6bede4b270f56d082fdaed1dc5f
labels:
app.kubernetes.io/name: argocd-redis-ha-haproxy
name: argocd-redis-ha-haproxy
spec:
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchLabels:
app.kubernetes.io/name: argocd-redis-ha-haproxy
topologyKey: kubernetes.io/hostname
containers:
- image: haproxy:2.0.22-alpine
imagePullPolicy: IfNotPresent
lifecycle: {}
livenessProbe:
httpGet:
path: /healthz
port: 8888
initialDelaySeconds: 5
periodSeconds: 3
name: haproxy
ports:
- containerPort: 6379
name: redis
readinessProbe:
httpGet:
path: /healthz
port: 8888
initialDelaySeconds: 5
periodSeconds: 3
volumeMounts:
- mountPath: /usr/local/etc/haproxy
name: data
- mountPath: /run/haproxy
name: shared-socket
initContainers:
- args:
- /readonly/haproxy_init.sh
command:
- sh
image: haproxy:2.0.22-alpine
imagePullPolicy: IfNotPresent
name: config-init
volumeMounts:
- mountPath: /readonly
name: config-volume
readOnly: true
- mountPath: /data
name: data
securityContext:
fsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
serviceAccountName: argocd-redis-ha-haproxy
volumes:
- configMap:
name: argocd-redis-ha-configmap
name: config-volume
- emptyDir: {}
name: shared-socket
- emptyDir: {}
name: data

apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app.kubernetes.io/component: repo-server
app.kubernetes.io/name: argocd-repo-server
app.kubernetes.io/part-of: argocd
name: argocd-repo-server
spec:
replicas: 2
selector:
matchLabels:
app.kubernetes.io/name: argocd-repo-server
template:
metadata:
labels:
app.kubernetes.io/name: argocd-repo-server
spec:
affinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- podAffinityTerm:
labelSelector:
matchLabels:
app.kubernetes.io/name: argocd-repo-server
topologyKey: failure-domain.beta.kubernetes.io/zone
weight: 100
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchLabels:
app.kubernetes.io/name: argocd-repo-server
topologyKey: kubernetes.io/hostname
automountServiceAccountToken: false
containers:
- command:
- entrypoint.sh
- argocd-repo-server
- --redis
- argocd-redis-ha-haproxy:6379
env:
- name: ARGOCD_RECONCILIATION_TIMEOUT
valueFrom:
configMapKeyRef:
key: timeout.reconciliation
name: argocd-cm
optional: true
- name: ARGOCD_REPO_SERVER_LOGFORMAT
valueFrom:
configMapKeyRef:
key: reposerver.log.format
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_REPO_SERVER_LOGLEVEL
valueFrom:
configMapKeyRef:
key: reposerver.log.level
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_REPO_SERVER_PARALLELISM_LIMIT
valueFrom:
configMapKeyRef:
key: reposerver.parallelism.limit
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_REPO_SERVER_DISABLE_TLS
valueFrom:
configMapKeyRef:
key: reposerver.disable.tls
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_TLS_MIN_VERSION
valueFrom:
configMapKeyRef:
key: reposerver.tls.minversion
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_TLS_MAX_VERSION
valueFrom:
configMapKeyRef:
key: reposerver.tls.maxversion
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_TLS_CIPHERS
valueFrom:
configMapKeyRef:
key: reposerver.tls.ciphers
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_REPO_CACHE_EXPIRATION
valueFrom:
configMapKeyRef:
key: reposerver.repo.cache.expiration
name: argocd-cmd-params-cm
optional: true
- name: REDIS_SERVER
valueFrom:
configMapKeyRef:
key: redis.server
name: argocd-cmd-params-cm
optional: true
- name: REDISDB
valueFrom:
configMapKeyRef:
key: redis.db
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_DEFAULT_CACHE_EXPIRATION
valueFrom:
configMapKeyRef:
key: reposerver.default.cache.expiration
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.1.0
imagePullPolicy: Always
livenessProbe:
failureThreshold: 3
httpGet:
path: /healthz?full=true
port: 8084
initialDelaySeconds: 30
periodSeconds: 5
name: argocd-repo-server
ports:
- containerPort: 8081
- containerPort: 8084
readinessProbe:
httpGet:
path: /healthz
port: 8084
initialDelaySeconds: 5
periodSeconds: 10
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- all
readOnlyRootFilesystem: true
runAsNonRoot: true
volumeMounts:
- mountPath: /app/config/ssh
name: ssh-known-hosts
- mountPath: /app/config/tls
name: tls-certs
- mountPath: /app/config/gpg/source
name: gpg-keys
- mountPath: /app/config/gpg/keys
name: gpg-keyring
- mountPath: /app/config/reposerver/tls
name: argocd-repo-server-tls
- mountPath: /tmp
name: tmp
volumes:
- configMap:
name: argocd-ssh-known-hosts-cm
name: ssh-known-hosts
- configMap:
name: argocd-tls-certs-cm
name: tls-certs
- configMap:
name: argocd-gpg-keys-cm
name: gpg-keys
- emptyDir: {}
name: gpg-keyring
- emptyDir: {}
name: tmp
- name: argocd-repo-server-tls
secret:
items:
- key: tls.crt
path: tls.crt
- key: tls.key
path: tls.key
- key: ca.crt
path: ca.crt
optional: true
secretName: argocd-repo-server-tls

apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app.kubernetes.io/component: server
app.kubernetes.io/name: argocd-server
app.kubernetes.io/part-of: argocd
name: argocd-server
spec:
replicas: 2
selector:
matchLabels:
app.kubernetes.io/name: argocd-server
template:
metadata:
labels:
app.kubernetes.io/name: argocd-server
spec:
affinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- podAffinityTerm:
labelSelector:
matchLabels:
app.kubernetes.io/name: argocd-server
topologyKey: failure-domain.beta.kubernetes.io/zone
weight: 100
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchLabels:
app.kubernetes.io/name: argocd-server
topologyKey: kubernetes.io/hostname
containers:
- command:
- argocd-server
- --redis
- argocd-redis-ha-haproxy:6379
env:
- name: ARGOCD_API_SERVER_REPLICAS
value: "2"
- name: ARGOCD_SERVER_INSECURE
valueFrom:
configMapKeyRef:
key: server.insecure
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_SERVER_BASEHREF
valueFrom:
configMapKeyRef:
key: server.basehref
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_SERVER_ROOTPATH
valueFrom:
configMapKeyRef:
key: server.rootpath
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_SERVER_LOGFORMAT
valueFrom:
configMapKeyRef:
key: server.log.format
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_REPO_SERVER_LOGLEVEL
valueFrom:
configMapKeyRef:
key: server.log.level
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_SERVER_REPO_SERVER
valueFrom:
configMapKeyRef:
key: repo.server
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_SERVER_DEX_SERVER
valueFrom:
configMapKeyRef:
key: server.dex.server
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_SERVER_DISABLE_AUTH
valueFrom:
configMapKeyRef:
key: server.disable.auth
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_SERVER_ENABLE_GZIP
valueFrom:
configMapKeyRef:
key: server.enable.gzip
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_SERVER_REPO_SERVER_TIMEOUT_SECONDS
valueFrom:
configMapKeyRef:
key: server.repo.server.timeout.seconds
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_SERVER_X_FRAME_OPTIONS
valueFrom:
configMapKeyRef:
key: server.x.frame.options
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_SERVER_REPO_SERVER_PLAINTEXT
valueFrom:
configMapKeyRef:
key: server.repo.server.plaintext
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_SERVER_REPO_SERVER_STRICT_TLS
valueFrom:
configMapKeyRef:
key: server.repo.server.strict.tls
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_TLS_MIN_VERSION
valueFrom:
configMapKeyRef:
key: server.tls.minversion
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_TLS_MAX_VERSION
valueFrom:
configMapKeyRef:
key: server.tls.maxversion
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_TLS_CIPHERS
valueFrom:
configMapKeyRef:
key: server.tls.ciphers
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_SERVER_CONNECTION_STATUS_CACHE_EXPIRATION
valueFrom:
configMapKeyRef:
key: server.connection.status.cache.expiration
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_SERVER_OIDC_CACHE_EXPIRATION
valueFrom:
configMapKeyRef:
key: server.oidc.cache.expiration
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_SERVER_LOGIN_ATTEMPTS_EXPIRATION
valueFrom:
configMapKeyRef:
key: server.login.attempts.expiration
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_APP_STATE_CACHE_EXPIRATION
valueFrom:
configMapKeyRef:
key: server.app.state.cache.expiration
name: argocd-cmd-params-cm
optional: true
- name: REDIS_SERVER
valueFrom:
configMapKeyRef:
key: redis.server
name: argocd-cmd-params-cm
optional: true
- name: REDISDB
valueFrom:
configMapKeyRef:
key: redis.db
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_DEFAULT_CACHE_EXPIRATION
valueFrom:
configMapKeyRef:
key: server.default.cache.expiration
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.1.0
imagePullPolicy: Always
livenessProbe:
httpGet:
path: /healthz?full=true
port: 8080
initialDelaySeconds: 3
periodSeconds: 30
name: argocd-server
ports:
- containerPort: 8080
- containerPort: 8083
readinessProbe:
httpGet:
path: /healthz
port: 8080
initialDelaySeconds: 3
periodSeconds: 30
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- all
readOnlyRootFilesystem: true
runAsNonRoot: true
volumeMounts:
- mountPath: /app/config/ssh
name: ssh-known-hosts
- mountPath: /app/config/tls
name: tls-certs
- mountPath: /app/config/server/tls
name: argocd-repo-server-tls
- mountPath: /home/argocd
name: plugins-home
- mountPath: /tmp
name: tmp
serviceAccountName: argocd-server
volumes:
- emptyDir: {}
name: plugins-home
- emptyDir: {}
name: tmp
- emptyDir: {}
name: static-files
- configMap:
name: argocd-ssh-known-hosts-cm
name: ssh-known-hosts
- configMap:
name: argocd-tls-certs-cm
name: tls-certs
- name: argocd-repo-server-tls
secret:
items:
- key: tls.crt
path: tls.crt
- key: tls.key
path: tls.key
- key: ca.crt
path: ca.crt
optional: true
secretName: argocd-repo-server-tls

apiVersion: apps/v1
kind: StatefulSet
metadata:
labels:
app.kubernetes.io/component: application-controller
app.kubernetes.io/name: argocd-application-controller
app.kubernetes.io/part-of: argocd
name: argocd-application-controller
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: argocd-application-controller
serviceName: argocd-application-controller
template:
metadata:
labels:
app.kubernetes.io/name: argocd-application-controller
spec:
affinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- podAffinityTerm:
labelSelector:
matchLabels:
app.kubernetes.io/name: argocd-application-controller
topologyKey: kubernetes.io/hostname
weight: 100
- podAffinityTerm:
labelSelector:
matchLabels:
app.kubernetes.io/part-of: argocd
topologyKey: kubernetes.io/hostname
weight: 5
containers:
- command:
- argocd-application-controller
- --status-processors
- "20"
- --operation-processors
- "10"
- --redis
- argocd-redis-ha-haproxy:6379
env:
- name: ARGOCD_RECONCILIATION_TIMEOUT
valueFrom:
configMapKeyRef:
key: timeout.reconciliation
name: argocd-cm
optional: true
- name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER
valueFrom:
configMapKeyRef:
key: repo.server
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_TIMEOUT_SECONDS
valueFrom:
configMapKeyRef:
key: controller.repo.server.timeout.seconds
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_APPLICATION_CONTROLLER_STATUS_PROCESSORS
valueFrom:
configMapKeyRef:
key: controller.status.processors
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_APPLICATION_CONTROLLER_OPERATION_PROCESSORS
valueFrom:
configMapKeyRef:
key: controller.operation.processors
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_APPLICATION_CONTROLLER_LOGFORMAT
valueFrom:
configMapKeyRef:
key: controller.log.format
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_APPLICATION_CONTROLLER_LOGLEVEL
valueFrom:
configMapKeyRef:
key: controller.log.level
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_APPLICATION_CONTROLLER_METRICS_CACHE_EXPIRATION
valueFrom:
configMapKeyRef:
key: controller.metrics.cache.expiration
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_APPLICATION_CONTROLLER_SELF_HEAL_TIMEOUT_SECONDS
valueFrom:
configMapKeyRef:
key: controller.self.heal.timeout.seconds
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_PLAINTEXT
valueFrom:
configMapKeyRef:
key: controller.repo.server.plaintext
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_STRICT_TLS
valueFrom:
configMapKeyRef:
key: controller.repo.server.strict.tls
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_APP_STATE_CACHE_EXPIRATION
valueFrom:
configMapKeyRef:
key: controller.app.state.cache.expiration
name: argocd-cmd-params-cm
optional: true
- name: REDIS_SERVER
valueFrom:
configMapKeyRef:
key: redis.server
name: argocd-cmd-params-cm
optional: true
- name: REDISDB
valueFrom:
configMapKeyRef:
key: redis.db
name: argocd-cmd-params-cm
optional: true
- name: ARGOCD_DEFAULT_CACHE_EXPIRATION
valueFrom:
configMapKeyRef:
key: controller.default.cache.expiration
name: argocd-cmd-params-cm
optional: true
image: quay.io/argoproj/argocd:v2.1.0
imagePullPolicy: Always
livenessProbe:
httpGet:
path: /healthz
port: 8082
initialDelaySeconds: 5
periodSeconds: 10
name: argocd-application-controller
ports:
- containerPort: 8082
readinessProbe:
httpGet:
path: /healthz
port: 8082
initialDelaySeconds: 5
periodSeconds: 10
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- all
readOnlyRootFilesystem: true
runAsNonRoot: true
volumeMounts:
- mountPath: /app/config/controller/tls
name: argocd-repo-server-tls
- mountPath: /home/argocd
name: argocd-home
workingDir: /home/argocd
serviceAccountName: argocd-application-controller
volumes:
- emptyDir: {}
name: argocd-home
- name: argocd-repo-server-tls
secret:
items:
- key: tls.crt
path: tls.crt
- key: tls.key
path: tls.key
- key: ca.crt
path: ca.crt
optional: true
secretName: argocd-repo-server-tls

apiVersion: apps/v1
kind: StatefulSet
metadata:
labels:
app.kubernetes.io/component: redis
app.kubernetes.io/name: argocd-redis-ha
app.kubernetes.io/part-of: argocd
name: argocd-redis-ha-server
spec:
podManagementPolicy: OrderedReady
replicas: 3
selector:
matchLabels:
app.kubernetes.io/name: argocd-redis-ha
serviceName: argocd-redis-ha
template:
metadata:
annotations:
checksum/init-config: 7128bfbb51eafaffe3c33b1b463e15f0cf6514cec570f9d9c4f2396f28c724ac
labels:
app.kubernetes.io/name: argocd-redis-ha
spec:
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchLabels:
app.kubernetes.io/name: argocd-redis-ha
topologyKey: kubernetes.io/hostname
automountServiceAccountToken: false
containers:
- args:
- /data/conf/redis.conf
command:
- redis-server
image: redis:6.2.4-alpine
imagePullPolicy: IfNotPresent
lifecycle: {}
livenessProbe:
exec:
command:
- sh
- -c
- /health/redis_liveness.sh
failureThreshold: 5
initialDelaySeconds: 30
periodSeconds: 15
successThreshold: 1
timeoutSeconds: 15
name: redis
ports:
- containerPort: 6379
name: redis
readinessProbe:
exec:
command:
- sh
- -c
- /health/redis_readiness.sh
failureThreshold: 5
initialDelaySeconds: 30
periodSeconds: 15
successThreshold: 1
timeoutSeconds: 15
volumeMounts:
- mountPath: /data
name: data
- mountPath: /health
name: health
- args:
- /data/conf/sentinel.conf
command:
- redis-sentinel
image: redis:6.2.4-alpine
imagePullPolicy: IfNotPresent
lifecycle: {}
livenessProbe:
exec:
command:
- sh
- -c
- /health/sentinel_liveness.sh
failureThreshold: 5
initialDelaySeconds: 30
periodSeconds: 15
successThreshold: 1
timeoutSeconds: 15
name: sentinel
ports:
- containerPort: 26379
name: sentinel
readinessProbe:
exec:
command:
- sh
- -c
- /health/sentinel_liveness.sh
failureThreshold: 5
initialDelaySeconds: 30
periodSeconds: 15
successThreshold: 3
timeoutSeconds: 15
volumeMounts:
- mountPath: /data
name: data
- mountPath: /health
name: health
initContainers:
- args:
- /readonly-config/init.sh
command:
- sh
env:
- name: SENTINEL_ID_0
value: 3c0d9c0320bb34888c2df5757c718ce6ca992ce6
- name: SENTINEL_ID_1
value: 40000915ab58c3fa8fd888fb8b24711944e6cbb4
- name: SENTINEL_ID_2
value: 2bbec7894d954a8af3bb54d13eaec53cb024e2ca
image: redis:6.2.4-alpine
imagePullPolicy: IfNotPresent
name: config-init
volumeMounts:
- mountPath: /readonly-config
name: config
readOnly: true
- mountPath: /data
name: data
securityContext:
fsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
serviceAccountName: argocd-redis-ha
terminationGracePeriodSeconds: 60
volumes:
- configMap:
name: argocd-redis-ha-configmap
name: config
- configMap:
defaultMode: 493
name: argocd-redis-ha-health-configmap
name: health
- emptyDir: {}
name: data
updateStrategy:
type: RollingUpdate

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: argocd-application-controller-network-policy
spec:
ingress:

• from:
  • namespaceSelector: {}
    ports:
  • port: 8082
    podSelector:
    matchLabels:
    app.kubernetes.io/name: argocd-application-controller
    policyTypes:
• Ingress

---

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: argocd-dex-server-network-policy
spec:
ingress:

• from:
  • podSelector:
    matchLabels:
    app.kubernetes.io/name: argocd-server
    ports:
  • port: 5556
    protocol: TCP
  • port: 5557
    protocol: TCP
• from:
  • namespaceSelector: {}
    ports:
  • port: 5558
    protocol: TCP
    podSelector:
    matchLabels:
    app.kubernetes.io/name: argocd-dex-server
    policyTypes:
• Ingress

---

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: argocd-redis-ha-proxy-network-policy
spec:
ingress:

• from:
  • podSelector:
    matchLabels:
    app.kubernetes.io/name: argocd-server
  • podSelector:
    matchLabels:
    app.kubernetes.io/name: argocd-repo-server
  • podSelector:
    matchLabels:
    app.kubernetes.io/name: argocd-application-controller
  • podSelector:
    matchLabels:
    app.kubernetes.io/name: argocd-redis-ha
    podSelector:
    matchLabels:
    app.kubernetes.io/name: argocd-redis-ha-haproxy
    policyTypes:
• Ingress

---

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: argocd-redis-ha-server-network-policy
spec:
ingress:

• from:
  • podSelector:
    matchLabels:
    app.kubernetes.io/name: argocd-redis-ha-haproxy
  • podSelector:
    matchLabels:
    app.kubernetes.io/name: argocd-redis-ha
    podSelector:
    matchLabels:
    app.kubernetes.io/name: argocd-redis-ha
    policyTypes:
• Ingress

---

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: argocd-repo-server-network-policy
spec:
ingress:

• from:
  • podSelector:
    matchLabels:
    app.kubernetes.io/name: argocd-server
  • podSelector:
    matchLabels:
    app.kubernetes.io/name: argocd-application-controller
  • podSelector:
    matchLabels:
    app.kubernetes.io/name: argocd-notifications-controller
    ports:
  • port: 8081
    protocol: TCP
• from:
  • namespaceSelector: {}
    ports:
  • port: 8084
    podSelector:
    matchLabels:
    app.kubernetes.io/name: argocd-repo-server
    policyTypes:
• Ingress

---

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: argocd-server-network-policy
spec:
ingress:

• {}
  podSelector:
  matchLabels:
  app.kubernetes.io/name: argocd-server
  policyTypes:
• Ingress

Actual output

Error: accumulating resources: accumulating resources from 'https://github.com/argoproj/argo-cd/manifests/ha/cluster-install?ref=v2.1.0': HTTP Error: status code 404 (Not Found)

Kustomize version
Kustomize v4.5.1 for this issue, it also occurs on v4.5.0.

Platform
Linux (automated build system), macOS for local reproduction.

Additional context

[natasha41575]

/triage accepted
/kind regression

Hopefully this will be fixed by #4453

[natasha41575]

FYI @KnVerey another regression, we think it was caused by #4334

[sylr]

@dlowrey Immediate workaround is to prefix your resources with git:::

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
bases:
- git::https://github.com/argoproj/argo-cd/manifests/ha/cluster-install?ref=v2.1.0

[natasha41575]

This is fixed by #4453 and will be released shortly.