-
Notifications
You must be signed in to change notification settings - Fork 9.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[bitnami/argo-cd] Add native support for ConfigManagementPlugins #27628
[bitnami/argo-cd] Add native support for ConfigManagementPlugins #27628
Conversation
1d02ec8
to
8e0232a
Compare
255d610
to
3801362
Compare
08f19c9
to
ad57930
Compare
Not sure why the VIB Verify check failed here. But it also failed for other PRs. Maybe somethings wrong with the action? |
a74cb4f
to
349c29d
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you very much for your contribution, this could be a great addition! I left some initial questions. Let's discuss them before we go more in depth!
## @param repoServer.configManagementPlugins.enabled Whether the config management plugins are enabled or not. | ||
enabled: false |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is this new value repoServer.configManagementPlugins.enabled
actually needed? Wouldn't it be enough to check if repoServer.configManagementPlugins.plugins
has elements or not?
- If it has elements, then we consider the feature activated
- Otherwise, deactivated
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We could, yeah. This is the pattern we use for most features though, right? I also like the fact, that for debugging purposes you can just disable it here without having to delete the whole plugins config.
bitnami/argo-cd/values.yaml
Outdated
## - name: my-custom-binary | ||
## url: https://www.example.com/my-custom-binary-1.2.3 | ||
## customScript: "" | ||
additionalBinaries: [] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Could we achieve the same by using repoServer.initContainers
? And it gives you more flexibility... In addition to that, I would expect that users also customize their container images to include any required binaries baked in the image instead of having to download the binaries every time at runtime. Does it make sense?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yep. In the end having the binaries here will only fill an init container. You can still use your own init container or bake your binaries into your custom image. You just have to make sure, that the binaries are on the path in the sidecar container, that runs your plugin.
The whole point of the change was to get rid of the boilerplate and having a simple way of configuring a CMP. That why I included this. But as stated, this is fully optional.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
While I was thinking about it: Maybe we can skip the "customScript" part and recommend to use an own init container or custom image in that case. But for the easy cases, where the binary can just be downloaded from a given URL, I would prefre to keep the functionality.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, at the very least, we should skip the customScript
part. Will you update the PR? Once we have that removed, let's see if it makes sense to keep simplifying the implementation. Thanks!
8dcbbb4
to
7f95571
Compare
09b9eae
to
6107d31
Compare
Updated the chart and removed the custom script option of the additional binaries. |
@maxnitze, thank you for addressing this. Let me take a look at the changes to get back to you. No worries about the conflicts, I'll take care of resolving them. |
name: cmp-additional-binaries | ||
{{- if .Values.repoServer.configManagementPlugins.additionalBinaries }} | ||
- name: download-additional-binaries | ||
image: {{ include "common.images.image" (dict "imageRoot" (dict "repository" "curlimages/curl" "tag" "latest") "global" .Values.global) }} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Any container image should be maintained by Bitnami and configured in a standard way from values.yaml
. You could use bitnami/os-shell
. Look at the volumePermissions.image
value to follow a similar pattern.
Do you have any concerns with that?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
No issues at all! I remember thinking about this when I added the init-container. I think I just forgot about it. Anyway, added it now!
6ea59ed
to
ff3d0f6
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi, I just added some comments to the PR. Could you please check? Thank you!
@@ -191,6 +191,24 @@ Create the name of the service account to use for Dex | |||
{{- end -}} | |||
{{- end -}} | |||
|
|||
{{/* |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm not sure what is the value of having this helper function here in argo-cd. It looks like a generic function unrelated to argo-cd itself.
This should go in the common library, although I would try to avoid adding more complexity and try to avoid the usage of this helper if possible.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yep, I would really like to move this to the common chart. I posted my reasoning to the description of the PR. But here's the condensed version of it:
Let's assume we have these two dicts:
context1:
enabled: true
name: 1001
isRunning: true
someOtherKey: "someOtherValue"
context2:
enabled: false
name: 1234
isRunning: false
anotherKey: "anotherValue"
When we merge both with common.tplvalues.merge
(from the common chart), the resulting dict is
mergedContext:
enabled: true
name: 1234
isRunning: true
someOtherKey: "someOtherValue"
anotherKey: "anotherValue"
So even though we would assume the values from context2
to have precedence (which they have for name
, for example), the boolean values stay the same.
In general it is not possible to overwrite any keys from context1
with values that are falsy.
I'm not sure if this is a bug or by design (the docs say that "precedence is consistent with http://masterminds.github.io/sprig/dicts.html#merge-mustmerge"). This helper here is designed to circumvent that.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
To be implemented in common, see #29668
- /opt/bitnami/argo-cd/bin/argocd | ||
- /additional-binaries/argocd-cmp-server | ||
{{- if .Values.repoServer.containerSecurityContext.enabled }} | ||
securityContext: {{- omit .Values.repoServer.containerSecurityContext "enabled" | toYaml | nindent 12 }} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
securityContext: {{- omit .Values.repoServer.containerSecurityContext "enabled" | toYaml | nindent 12 }} | |
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.repoServer.containerSecurityContext "context" $) | nindent 12 }} |
{{- with .Values.repoServer.configManagementPlugins.additionalBinaries }} | ||
{{- if .binaries }} | ||
- name: download-additional-binaries | ||
image: {{ include "common.images.image" (dict "imageRoot" .image "global" $.Values.global) }} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This should go into its own helper function (see examples for the other images):
{{/*
Return the proper CMP binary downloader image name
*/}}
{{- define "argocd.repoServer.configManagementPlugins.additionalBinaries.image" -}}
{{- include "common.images.image" ( dict "imageRoot" .Values.repoServer.configManagementPlugins.additionalBinaries.image "global" .Values.global ) -}}
{{- end -}}
and be called like:
image: {{ include "common.images.image" (dict "imageRoot" .image "global" $.Values.global) }} | |
image: {{ include "argocd.repoServer.configManagementPlugins.additionalBinaries.image" . }} |
imagePullPolicy: {{ .image.pullPolicy }} | ||
command: | ||
- sh | ||
- -c |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should we pass the -ec
flags to detect errors?
- name: {{ $plugin.name }} | ||
image: {{ include "common.images.image" (dict "imageRoot" $plugin.sidecar.image "global" $.Values.global) }} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think it would be better to simplify all this and let users decide what will be the sidecar preferred structure. It simplify our maintenance at the same time it allows total flexibility for users.
It would be the same approach that we follow in .Values.repoServer.sidecars
for example.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This block is kind of the whole point of this PR. There are some mounts that have to be mounted to specific directories, like the CMP binary, the plugins
folder or the plugin.yml
.
The user still has the option to completely set it by him or herself (through .Values.repoServer.sidecars
). But removing this opinionated block defeats the whole purpose of this PR.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The thing is... This assumes a very specific object structure for each element in the plugins
array.
The main value the PR adds is automating the volumeMounts
that are required for the sidecars to work. Could we sth like this instead?
{{- range $sidecar := .Values.repoServer.configManagementPlugins.sidecars }}
{{- include "common.tplvalues.render" (dict "value" $sidecar "context" $) | nindent 8 }}
volumeMounts:
- name: cmp-{{ $sidecar.name }}
mountPath: /home/argocd/cmp-server/config/plugin.yaml
subPath: plugin.yaml
- name: cmp-server-plugins
mountPath: /home/argocd/cmp-server/plugins
- name: cmp-additional-binaries
mountPath: {{ $additionalBinariesDir }}
- name: cmp-server-tmp-dir
mountPath: /tmp
{{- end }}
This way, we help users setting up mounted directories while we keep flexible enough for users to customize the sidecars.
{{- end }} | ||
{{- if $plugin.sidecar.resources }} | ||
resources: {{- toYaml $plugin.sidecar.resources | nindent 12 }} | ||
{{- else if and $plugin.sidecar.resourcePreset (ne $plugin.sidecar.resourcesPreset "none") }} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There is a typo here, but in any case, refer to my previous comment about simplifying all this code and allow users to set their sidecars config explicitly.
{{- else if and $plugin.sidecar.resourcePreset (ne $plugin.sidecar.resourcesPreset "none") }} | |
{{- else if and $plugin.sidecar.resourcesPreset (ne $plugin.sidecar.resourcesPreset "none") }} |
## pullSecrets: | ||
## - myRegistryKeySecretName | ||
## | ||
pullSecrets: [ ] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should this image be added to argocd.imagePullSecrets
?
This Pull Request has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thank you for your contribution. |
Signed-off-by: Max Nitze <[email protected]>
…a custom script Signed-off-by: Max Nitze <[email protected]>
…inaries in config management plugins Signed-off-by: Max Nitze <[email protected]>
…ix typos Signed-off-by: Max Nitze <[email protected]>
0fedbce
to
99fa136
Compare
I'm back from a longer vacation and looked through your remarks. Had some comments myself, but fixed most of them. On the |
Signed-off-by: Bitnami Containers <[email protected]>
Yes, please. Let's do it like that. Once the new PR for the bitnami/common library is merged, we can continue with the final changes here. Thank you! |
Created #29566 to discuss what the correct fix for the issue is. Will come back here once that issue is closed. |
Signed-off-by: Bitnami Containers <[email protected]>
@@ -191,6 +191,24 @@ Create the name of the service account to use for Dex | |||
{{- end -}} | |||
{{- end -}} | |||
|
|||
{{/* |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
To be implemented in common, see #29668
- name: copy-cmp-server-binary | ||
image: {{ include "argocd.image" . }} | ||
imagePullPolicy: {{ .Values.image.pullPolicy }} | ||
command: | ||
- /bin/cp | ||
- -n | ||
- /opt/bitnami/argo-cd/bin/argocd | ||
- /additional-binaries/argocd-cmp-server | ||
{{- if .Values.repoServer.containerSecurityContext.enabled }} | ||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.repoServer.containerSecurityContext "context" $) | nindent 12 }} | ||
{{- end }} | ||
volumeMounts: | ||
- mountPath: /additional-binaries | ||
name: cmp-additional-binaries | ||
{{- with .Values.repoServer.configManagementPlugins.additionalBinaries }} | ||
{{- if .binaries }} | ||
- name: download-additional-binaries | ||
image: {{ include "argocd.repo-server.config-management-plugins.additional-binaries.image" $ }} | ||
imagePullPolicy: {{ .image.pullPolicy }} | ||
command: | ||
- sh | ||
- -ec | ||
args: | ||
- |- | ||
{{- range $additionalBinary := .binaries }} | ||
# downloading {{ $additionalBinary.name }} | ||
curl -L {{ $additionalBinary.url }} -o /additional-binaries/{{ $additionalBinary.name }} | ||
chmod +x /additional-binaries/{{ $additionalBinary.name }} | ||
{{- end }} | ||
volumeMounts: | ||
- mountPath: /additional-binaries | ||
name: cmp-additional-binaries |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
These two steps look overcomplicated to me. I guess we're using bitnami/os-shell
to download extra binaries because bitnami/argo-cd
lacks curl
, right?
{{- if $plugin.sidecar.customCommand }} | ||
command: {{- include "common.tplvalues.render" (dict "value" $plugin.sidecar.customCommand "context" $) | nindent 12 }} | ||
{{- else }} | ||
command: | ||
- {{ $additionalBinariesDir }}/argocd-cmp-server | ||
{{- end }} | ||
{{- if $plugin.sidecar.customArgs }} | ||
args: {{- include "common.tplvalues.render" (dict "value" $plugin.sidecar.customArgs "context" $) | nindent 12 }} | ||
{{- end }} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We always use xxx.command
and xxx.args
as paramaters name for users to customize their custom command/args. For consistency with the catalog, please use this naming.
- name: {{ $plugin.name }} | ||
image: {{ include "common.images.image" (dict "imageRoot" $plugin.sidecar.image "global" $.Values.global) }} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The thing is... This assumes a very specific object structure for each element in the plugins
array.
The main value the PR adds is automating the volumeMounts
that are required for the sidecars to work. Could we sth like this instead?
{{- range $sidecar := .Values.repoServer.configManagementPlugins.sidecars }}
{{- include "common.tplvalues.render" (dict "value" $sidecar "context" $) | nindent 8 }}
volumeMounts:
- name: cmp-{{ $sidecar.name }}
mountPath: /home/argocd/cmp-server/config/plugin.yaml
subPath: plugin.yaml
- name: cmp-server-plugins
mountPath: /home/argocd/cmp-server/plugins
- name: cmp-additional-binaries
mountPath: {{ $additionalBinariesDir }}
- name: cmp-server-tmp-dir
mountPath: /tmp
{{- end }}
This way, we help users setting up mounted directories while we keep flexible enough for users to customize the sidecars.
Closing due to lack of activity, feel free to reopen it if the work is resumed. |
Still have it on my TODO list. Sorry for that. Will re-open once I find the time to do it! |
Description of the change
Adding support for ArgoCD Config Management Plugins (CMP) to the chart.
Adding those plugins creates a bit of overhead, as there are some volumes that need to be shared between the repo server and the sidecar container of the plugin and the sidecar configuration in general. This is automatically added when the plugins are enabled.
Benefits
ConfigManagementPlugins can be enabled directly from the chart.
Example with the argocd-vault-plugin
Here's an example of how I would be using it for a CMP that adds support for the argocd-vault-plugin.
Possible drawbacks
The change tries to make everything as much configurable as possible. So no drawbacks there (hopefully).
The change in general is opt-in. So no undesired changes to existing installations.
Applicable issues
None
Additional information
argocd.tplvalues.merge-with-precedence
HelperI introduced a new helper for merging values from a list with precedence to later entries.
This was necessary, because the helper
common.tplvalues.merge
has one major "flaw", that I needed fixed here:When I merge these two with
include "common.tplvalues.merge" (dict "values" (list .context1 .context2) "context" $)
, the result isI don't know if this is a bug or a feature (the comment of the helper says, that "precedence is consistent with http://masterminds.github.io/sprig/dicts.html#merge-mustmerge").
Since I was merging container security contexts here, I wanted to be give the option to deactivate the
readOnlyRootFilesystem
, for example. Or disable the context completely.The result when using the new helper
include "argocd.tplvalues.merge-with-precedence" (dict "values" (list .context1 .context2) "context" $)
isChecklist
Chart.yaml
according to semver. This is not necessary when the changes only affect README.md files.README.md
using readme-generator-for-helm