Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,9 @@ toc::[]

After the {gitops-title} Operator is installed, Argo CD automatically creates a user with `admin` permissions. To manage multiple users, cluster administrators can use Argo CD to configure Single Sign-On (SSO).

[IMPORTANT]
[NOTE]
====
The `spec.dex` parameter in the ArgoCD CR is deprecated. In a future release of {gitops-title} v1.10.0, configuring Dex using the `spec.dex` parameter in the ArgoCD CR is planned to be removed. Consider using the `.spec.sso` parameter instead.
The `spec.dex` parameter in the ArgoCD CR is no longer supported from {gitops-title} v1.10.0 onwards. Consider using the `.spec.sso` parameter instead.
====

include::modules/gitops-creating-a-new-client-in-dex.adoc[leveloffset=+1]
Expand All @@ -19,7 +19,7 @@ include::modules/gitops-dex-role-mappings.adoc[leveloffset=+2]

//include::modules/gitops-configuring-argo-cd-using-dex-github-conector.adoc[leveloffset=+1]

include::modules/gitops-disable-dex.adoc[leveloffset=+1]
//include::modules/gitops-disable-dex.adoc[leveloffset=+1]

include::modules/gitops-disable-dex-using-spec-sso.adoc[leveloffset=+1]

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ You can specify the command arguments, environment variables, a custom image nam
.Example: `RolloutManager` CR
[source,yaml]
----
apiVersion: argoproj.io/v1alpha1
apiVersion: argoproj.io/v1beta1
kind: RolloutManager
metadata:
name: argo-rollout
Expand Down
2 changes: 1 addition & 1 deletion modules/gitops-argo-cd-notification.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ To enable or disable the link:https://argo-cd.readthedocs.io/en/stable/operator-

[source,yaml]
----
apiVersion: argoproj.io/v1alpha1
apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
name: example-argocd
Expand Down
10 changes: 4 additions & 6 deletions modules/gitops-argo-cd-properties.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,9 @@ a|* _<AutoTLS>_ - Use the provider to create the Redis server's TLS certificate
* _<Image>_ - The container image for Redis. This overrides the `ARGOCD_REDIS_IMAGE` environment variable.
* _<Resources>_ - The container compute resources.
* _<Version>_ - The tag to use with the Redis container image.
|`ResourceCustomizations` |Customize resource behavior.|`__<empty>__` |
|`ResourceHealthChecks` |Customize resource health check behavior.|`__<empty>__` |
|`ResourceIgnoreDifferences` |Customize resource ignore difference behavior.|`__<empty>__` |
|`ResourceActions` |Customize resource action behavior.|`__<empty>__` |
|`ResourceExclusions` |Completely ignore entire classes of resource group.|`__<empty>__` |
|`ResourceInclusions` |The configuration to configure which resource group/kinds are applied.|`__<empty>__` |
|`Server` |Argo CD Server configuration options.|`__<Object>__`
Expand All @@ -87,13 +89,9 @@ a|* _<Autoscale>_ - Server autoscale configuration options.
* _<LogFormat>_ - The log format used by the Argo CD Application Controller component. Valid options are `text` or `json`.
* _<Env>_ - Environment to set for the server workloads.
|`SSO` |Single Sign-on options.|`__<Object>__`
a|* _<Image>_ - The container image for Keycloak. This overrides the `ARGOCD_KEYCLOAK_IMAGE` environment variable.
* _<Keycloak>_ - Configuration options for Keycloak SSO provider.
a|* _<Keycloak>_ - Configuration options for Keycloak SSO provider.
* _<Dex>_ - Configuration options for Dex SSO provider.
* _<Provider>_ - The name of the provider used to configure Single Sign-on. For now the supported options are Dex and Keycloak.
* _<Resources>_ - The container compute resources.
* _<VerifyTLS>_ - Whether to enforce strict TLS checking when communicating with Keycloak service.
* _<Version>_ - The tag to use with the Keycloak container image.
|`StatusBadgeEnabled` |Enable application status badge.|`true` |
|`TLS` |TLS configuration options.|`__<Object>__`
a|* _<CA.ConfigMapName>_ - The name of the `ConfigMap` which contains the CA certificate.
Expand Down
2 changes: 1 addition & 1 deletion modules/gitops-configuring-argo-cd-oidc.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ $ oc edit argocd -n <your_namespace>
.Example of `argocd` custom resource
[source,yaml]
----
apiVersion: argoproj.io/v1alpha1
apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
creationTimestamp: null
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
+
[source,yaml]
----
apiVersion: argoproj.io/v1alpha1
apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
name: example-argocd
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ You can manually configure TLS encryption for Redis by creating the `argocd-oper
.Example ArgoCD CR with autotls disabled
[source,yaml]
----
apiVersion: argoproj.io/v1alpha1
apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
name: argocd <1>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ By default, the `autotls` setting is disabled.
.Example Argo CD CR with autotls enabled
[source,yaml]
----
apiVersion: argoproj.io/v1alpha1
apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
name: argocd <1>
Expand Down
2 changes: 1 addition & 1 deletion modules/gitops-configuring-workloads.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ The following Argo CD instance deploys the Argo CD workloads such as `Applicatio

[source,yaml]
----
apiVersion: argoproj.io/v1alpha1
apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
name: example
Expand Down
33 changes: 14 additions & 19 deletions modules/gitops-creating-a-new-client-in-dex.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -6,27 +6,22 @@
[id="gitops-creating-a-new-client-in-dex_{context}"]
= Configuration to enable the Dex OpenShift OAuth Connector

Dex is installed by default for all the Argo CD instances created by the Operator. Dex uses the users and groups defined within OpenShift by checking the `OAuth` server provided by the platform. You can configure the options for the Dex SSO provider. The following example shows the properties of Dex along with example configurations:
Dex is installed by default for all the Argo CD instances created by the Operator. You can configure {gitops-title} to use Dex as the SSO authentication provider by setting the `.spec.sso` parameter.

Dex uses the users and groups defined within {OCP} by checking the `OAuth` server provided by the platform.

.Procedure

* To enable Dex, set the `.spec.sso.provider` parameter to `dex` in the YAML resource of the Operator:
+
[source,yaml]
----
apiVersion: argoproj.io/v1alpha1
kind: ArgoCD
metadata:
name: example-argocd
labels:
example: openshift-oauth
# ...
spec:
dex:
openShiftOAuth: true <1>
groups:<2>
- default
rbac:<3>
defaultPolicy: 'role:readonly'
policy: |
g, cluster-admins, role:admin
scopes: '[groups]'
sso:
provider: dex
dex:
openShiftOAuth: true <1>
# ...
----
<1> The `openShiftOAuth` property triggers the Operator to automatically configure the built-in OpenShift `OAuth` server when the value is set to `true`.
<2> The `groups` property allows users of the specified group(s) to log in.
<3> The RBAC policy property assigns the admin role in the Argo CD cluster to users in the OpenShift `cluster-admins` group.
<1> The `openShiftOAuth` property triggers the Operator to automatically configure the built-in {OCP} `OAuth` server when the value is set to `true`.
6 changes: 3 additions & 3 deletions modules/gitops-creating-a-new-client-using-keycloak.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ dex:
+
[source,yaml]
----
apiVersion: argoproj.io/v1alpha1
apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
name: example-argocd
Expand All @@ -52,13 +52,13 @@ spec:
----
<1> A custom certificate used to verify the Keycloak's TLS certificate.
+
The Operator reconciles changes in the `.spec.keycloak.rootCA` parameter and updates the `oidc.config` parameter with the PEM encoded root certificate in the `argocd-cm` configuration map.
The Operator reconciles changes in the `.spec.sso.keycloak.rootCA` parameter and updates the `oidc.config` parameter with the PEM encoded root certificate in the `argocd-cm` configuration map.

* For an insecure connection, leave the value of the `rootCA` parameter empty and use the `oidc.tls.insecure.skip.verify` parameter as shown below:
+
[source,yaml]
----
apiVersion: argoproj.io/v1alpha1
apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
name: example-argocd
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ To manage progressive delivery of deployments by using Argo Rollouts in {gitops-
.Example: `RolloutManager` CR
[source,yaml]
----
apiVersion: argoproj.io/v1alpha1
apiVersion: argoproj.io/v1beta1
kind: RolloutManager
metadata:
name: argo-rollout
Expand Down
22 changes: 2 additions & 20 deletions modules/gitops-disable-dex-using-spec-sso.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -4,24 +4,6 @@

:_content-type: PROCEDURE
[id="gitops-disable-dex-using-spec-sso_{context}"]
= Enabling or disabling Dex using .spec.sso
= Disabling Dex by replacing .spec.sso

You can configure {gitops-title} to use Dex as its SSO authentication provider by setting the `.spec.sso` parameter.

.Procedure

. To enable Dex, set the `.spec.sso.provider: dex` parameter in the YAML resource of the Operator:

+
[source,yaml]
----
...
spec:
sso:
provider: dex
dex:
openShiftOAuth: true
...
----
+
. To disable dex, either remove the `spec.sso` element from the Argo CD custom resource, or specify a different SSO provider.
* To disable dex, either remove the `spec.sso` element from the Argo CD custom resource or specify a different SSO provider.
4 changes: 2 additions & 2 deletions modules/gitops-disable-dex.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -19,11 +19,11 @@ In {gitops-title} v1.6.0, `DISABLE_DEX` is deprecated and is planned to be remov
+
[source,yaml]
----
...
# ...
spec:
config:
env:
- name: DISABLE_DEX
value: "true"
...
# ...
----
Original file line number Diff line number Diff line change
Expand Up @@ -16,15 +16,15 @@ You can disable workload monitoring for specific Argo CD instances. Disabling wo

[source,yaml]
----
apiVersion: argoproj.io/v1alpha1
apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
name: example-argocd
labels:
example: repo
spec:
...
# ...
monitoring:
enabled: false
...
# ...
----
2 changes: 1 addition & 1 deletion modules/gitops-enable-replicas-for-argo-cd-server.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ Argo CD-server and Argo CD-repo-server workloads are stateless. To better distri

[source,yaml]
----
apiVersion: argoproj.io/v1alpha1
apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
name: example-argocd
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -18,17 +18,17 @@ With {gitops-title}, you can enable workload monitoring for specific Argo CD ins

[source,yaml]
----
apiVersion: argoproj.io/v1alpha1
apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
name: example-argocd
labels:
example: repo
spec:
...
# ...
monitoring:
enabled: true
...
# ...
----

. Verify whether an alert rule is included in the PrometheusRule created by the Operator:
Expand All @@ -46,7 +46,7 @@ spec:
groups:
- name: ArgoCDComponentStatus
rules:
...
# ...
- alert: ApplicationSetControllerNotReady <1>
annotations:
message: >-
Expand Down
8 changes: 4 additions & 4 deletions modules/gitops-installing-olm-operators-using-gitops.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -44,14 +44,14 @@ To install namespace-scoped Operators, create and place the `Subscription` and `

[source,yaml]
----
...
# ...
apiVersion: v1
kind: Namespace
metadata:
labels:
openshift.io/cluster-monitoring: "true"
name: ansible-automation-platform
...
# ...
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
Expand All @@ -60,7 +60,7 @@ metadata:
spec:
targetNamespaces:
- ansible-automation-platform
...
# ...
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
Expand All @@ -72,7 +72,7 @@ spec:
name: ansible-automation-platform-operator
source: redhat-operators
sourceNamespace: openshift-marketplace
...
# ...
----

[IMPORTANT]
Expand Down
Loading