chore(argo-cd): Remove deprecated features and redesign Ingress (#2407)
* chore(argo-cd): Remove deprecated features Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * Remove wildcard catch all ingress rule Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * Add ingress extra rules Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * Remove unnecessary ingress variables Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * Improve documentation Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * Replace ingress paths and hosts with single backend service Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * Use only port number to support all ingress controllers Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * Minor gRPC fixes Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * Simplify TLS configuration Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * Decouple AWS and GKE ALB from generic ingress Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * Remove map nesting for ApplicationSet ingress Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * Use example.com domain Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * Remove fallback for argocd-cm checksum annotation Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * Add revisionHistoryLimit for controller Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * Update README Signed-off-by: Petr Drastil <petr.drastil@gmail.com> * Update README Signed-off-by: Petr Drastil <petr.drastil@gmail.com> --------- Signed-off-by: Petr Drastil <petr.drastil@gmail.com>
This commit is contained in:
Petr Drastil
GitHub
parent
0b79f5e5c1
commit
b8212e0b30
33 changed files with 685 additions and 634 deletions
|
|
@ -105,15 +105,84 @@ For full list of changes please check ArtifactHub [changelog].
|
|||
|
||||
Highlighted versions provide information about additional steps that should be performed by user when upgrading to newer version.
|
||||
|
||||
### 6.0.0
|
||||
|
||||
This version **removes support for**:
|
||||
|
||||
* deprecated component options `logLevel` and `logFormat`
|
||||
* deprecated component arguments `<components>.args.<feature>` that were replaced with `configs.params`
|
||||
* deprecated configuration `server.config` that was replaced with `configs.cm`
|
||||
* deprecated configuration `server.rbacConfig` that was replaced with `configs.rbac`
|
||||
|
||||
Major version also contains breaking **changes related to Argo CD Ingress** resources that were hard to extend and maintain for various ingress controller implementations.
|
||||
Please review your setup and adjust to new configuration options:
|
||||
|
||||
* catch all rule was removed for security reasons. If you need this please use `server.ingress.extraRules` to provide ingress rule without hostname
|
||||
* ingress rule for `paths` changed to `path` as there is only single Argo CD backend path
|
||||
* ingress rule for `hosts` changed to `hostname` as there can be only single SSO redirect for given hostname
|
||||
* ingress TLS for server uses by default `argocd-server-tls` secret required by Argo CD server, additional ingresses are using `<hostname>-tls` secret when `tls: true`
|
||||
* additional hostnames and routing can be provided via `extraHosts` configuration section
|
||||
* additional TLS secrets can be provided via `extraTls` configuration section
|
||||
|
||||
Specific ingress implementations for cloud providers were decoupled from generic ingress resource.
|
||||
|
||||
To configure AWS Application Load Balancer:
|
||||
|
||||
```yaml
|
||||
server:
|
||||
ingress:
|
||||
enabled: true
|
||||
controller: aws
|
||||
annotations:
|
||||
alb.ingress.kubernetes.io/backend-protocol: HTTPS
|
||||
alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
|
||||
aws:
|
||||
backendProtocolVersion: HTTP2
|
||||
serviceType: NodePort
|
||||
```
|
||||
|
||||
To configure GKE Application Load Balancer:
|
||||
|
||||
```yaml
|
||||
configs:
|
||||
params:
|
||||
"server.insecure": true
|
||||
|
||||
server:
|
||||
service:
|
||||
annotations:
|
||||
cloud.google.com/neg: '{"ingress": true}'
|
||||
cloud.google.com/backend-config: '{"ports": {"http":"argocd-server"}}'
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
controller: gke
|
||||
gke:
|
||||
backendConfig:
|
||||
healthCheck:
|
||||
checkIntervalSec: 30
|
||||
timeoutSec: 5
|
||||
healthyThreshold: 1
|
||||
unhealthyThreshold: 2
|
||||
type: HTTP
|
||||
requestPath: /healthz
|
||||
port: 8080
|
||||
frontendConfig:
|
||||
redirectToHttps:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
### 5.53.0
|
||||
|
||||
Argocd-repo-server can now optionally use Persistent Volumes for its mountpoints instead of only emptydir()
|
||||
|
||||
### 5.52.0
|
||||
|
||||
Because [Argo CD Extensions] is now deprecated and no further changes will be made, we switched to [Argo CD Extension Installer], adding an Argo CD Extension Installer to init-container in the Argo CD API server.
|
||||
If you used old mechanism, please move to new mechanism. For more details, please refer `.Values.server.extensions` in values.yaml.
|
||||
|
||||
### 5.35.0
|
||||
|
||||
This version supports Kubernetes version `>=1.23.0-0`. The current supported version of Kubernetes is v1.24 or later and we align with the Amazon EKS calendar, because many AWS users follow a conservative approach.
|
||||
|
||||
Please see more information about EoL: [Amazon EKS EoL][EKS EoL].
|
||||
|
|
@ -399,7 +468,7 @@ NAME: my-release
|
|||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| apiVersionOverrides.cloudgoogle | string | `""` | String to override apiVersion of GKE resources rendered by this helm chart |
|
||||
| apiVersionOverrides | object | `{}` | |
|
||||
| crds.additionalLabels | object | `{}` | Addtional labels to be added to all CRDs |
|
||||
| crds.annotations | object | `{}` | Annotations to be added to all CRDs |
|
||||
| crds.install | bool | `true` | Install and upgrade CRDs |
|
||||
|
|
@ -516,7 +585,6 @@ NAME: my-release
|
|||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| controller.affinity | object | `{}` (defaults to global.affinity preset) | Assign custom [affinity] rules to the deployment |
|
||||
| controller.args | object | `{}` | DEPRECATED - Application controller commandline flags |
|
||||
| controller.clusterRoleRules.enabled | bool | `false` | Enable custom rules for the application controller's ClusterRole resource |
|
||||
| controller.clusterRoleRules.rules | list | `[]` | List of custom rules for the application controller's ClusterRole resource |
|
||||
| controller.containerPorts.metrics | int | `8082` | Metrics container port |
|
||||
|
|
@ -575,6 +643,7 @@ NAME: my-release
|
|||
| controller.readinessProbe.timeoutSeconds | int | `1` | Number of seconds after which the [probe] times out |
|
||||
| controller.replicas | int | `1` | The number of application controller pods to run. Additional replicas will cause sharding of managed clusters across number of replicas. |
|
||||
| controller.resources | object | `{}` | Resource limits and requests for the application controller pods |
|
||||
| controller.revisionHistoryLimit | int | `5` | Maximum number of controller revisions that will be maintained in StatefulSet history |
|
||||
| controller.serviceAccount.annotations | object | `{}` | Annotations applied to created service account |
|
||||
| controller.serviceAccount.automountServiceAccountToken | bool | `true` | Automount API credentials for the Service Account |
|
||||
| controller.serviceAccount.create | bool | `true` | Create a service account for the application controller |
|
||||
|
|
@ -686,12 +755,6 @@ NAME: my-release
|
|||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| server.GKEbackendConfig.enabled | bool | `false` | Enable BackendConfig custom resource for Google Kubernetes Engine |
|
||||
| server.GKEbackendConfig.spec | object | `{}` | [BackendConfigSpec] |
|
||||
| server.GKEfrontendConfig.enabled | bool | `false` | Enable FrontConfig custom resource for Google Kubernetes Engine |
|
||||
| server.GKEfrontendConfig.spec | object | `{}` | [FrontendConfigSpec] |
|
||||
| server.GKEmanagedCertificate.domains | list | `["argocd.example.com"]` | Domains for the Google Managed Certificate |
|
||||
| server.GKEmanagedCertificate.enabled | bool | `false` | Enable ManagedCertificate custom resource for Google Kubernetes Engine. |
|
||||
| server.affinity | object | `{}` (defaults to global.affinity preset) | Assign custom [affinity] rules to the deployment |
|
||||
| server.autoscaling.behavior | object | `{}` | Configures the scaling behavior of the target in both Up and Down directions. |
|
||||
| server.autoscaling.enabled | bool | `false` | Enable Horizontal Pod Autoscaler ([HPA]) for the Argo CD server |
|
||||
|
|
@ -744,28 +807,37 @@ NAME: my-release
|
|||
| server.image.tag | string | `""` (defaults to global.image.tag) | Tag to use for the Argo CD server |
|
||||
| server.imagePullSecrets | list | `[]` (defaults to global.imagePullSecrets) | Secrets with credentials to pull images from a private registry |
|
||||
| server.ingress.annotations | object | `{}` | Additional ingress annotations |
|
||||
| server.ingress.aws.backendProtocolVersion | string | `"HTTP2"` | Backend protocol version for the AWS ALB gRPC service |
|
||||
| server.ingress.aws.serviceType | string | `"NodePort"` | Service type for the AWS ALB gRPC service |
|
||||
| server.ingress.controller | string | `"generic"` | Specific implementation for ingress controller. One of `generic`, `aws` or `gke` |
|
||||
| server.ingress.enabled | bool | `false` | Enable an ingress resource for the Argo CD server |
|
||||
| server.ingress.extraPaths | list | `[]` | Additional ingress paths |
|
||||
| server.ingress.hosts | list | `[]` | List of ingress hosts |
|
||||
| server.ingress.https | bool | `false` | Uses `server.service.servicePortHttps` instead `server.service.servicePortHttp` |
|
||||
| server.ingress.extraHosts | list | `[]` (See [values.yaml]) | The list of additional hostnames to be covered by ingress record |
|
||||
| server.ingress.extraPaths | list | `[]` (See [values.yaml]) | Additional ingress paths |
|
||||
| server.ingress.extraRules | list | `[]` (See [values.yaml]) | Additional ingress rules |
|
||||
| server.ingress.extraTls | list | `[]` (See [values.yaml]) | Additional TLS configuration |
|
||||
| server.ingress.gke.backendConfig | object | `{}` (See [values.yaml]) | Google [BackendConfig] resource, for use with the GKE Ingress Controller |
|
||||
| server.ingress.gke.frontendConfig | object | `{}` (See [values.yaml]) | Google [FrontendConfig] resource, for use with the GKE Ingress Controller |
|
||||
| server.ingress.gke.managedCertificate.create | bool | `true` | Create ManagedCertificate resource and annotations for Google Load balancer |
|
||||
| server.ingress.gke.managedCertificate.extraDomains | list | `[]` | Additional domains for ManagedCertificate resource |
|
||||
| server.ingress.hostname | string | `"argocd.example.com"` | Argo CD server hostname |
|
||||
| server.ingress.ingressClassName | string | `""` | Defines which ingress controller will implement the resource |
|
||||
| server.ingress.labels | object | `{}` | Additional ingress labels |
|
||||
| server.ingress.path | string | `"/"` | The path to Argo CD server |
|
||||
| server.ingress.pathType | string | `"Prefix"` | Ingress path type. One of `Exact`, `Prefix` or `ImplementationSpecific` |
|
||||
| server.ingress.paths | list | `["/"]` | List of ingress paths |
|
||||
| server.ingress.tls | list | `[]` | Ingress TLS configuration |
|
||||
| server.ingress.tls | bool | `false` | Enable TLS configuration for the hostname defined at `server.ingress.hostname` |
|
||||
| server.ingressGrpc.annotations | object | `{}` | Additional ingress annotations for dedicated [gRPC-ingress] |
|
||||
| server.ingressGrpc.awsALB.backendProtocolVersion | string | `"HTTP2"` | Backend protocol version for the AWS ALB gRPC service |
|
||||
| server.ingressGrpc.awsALB.serviceType | string | `"NodePort"` | Service type for the AWS ALB gRPC service |
|
||||
| server.ingressGrpc.enabled | bool | `false` | Enable an ingress resource for the Argo CD server for dedicated [gRPC-ingress] |
|
||||
| server.ingressGrpc.extraPaths | list | `[]` | Additional ingress paths for dedicated [gRPC-ingress] |
|
||||
| server.ingressGrpc.hosts | list | `[]` | List of ingress hosts for dedicated [gRPC-ingress] |
|
||||
| server.ingressGrpc.https | bool | `false` | Uses `server.service.servicePortHttps` instead `server.service.servicePortHttp` |
|
||||
| server.ingressGrpc.extraHosts | list | `[]` (See [values.yaml]) | The list of additional hostnames to be covered by ingress record |
|
||||
| server.ingressGrpc.extraPaths | list | `[]` (See [values.yaml]) | Additional ingress paths for dedicated [gRPC-ingress] |
|
||||
| server.ingressGrpc.extraRules | list | `[]` (See [values.yaml]) | Additional ingress rules |
|
||||
| server.ingressGrpc.extraTls | list | `[]` (See [values.yaml]) | Additional TLS configuration for dedicated [gRPC-ingress] |
|
||||
| server.ingressGrpc.hostname | string | `""` | Argo CD server hostname for dedicated [gRPC-ingress] |
|
||||
| server.ingressGrpc.ingressClassName | string | `""` | Defines which ingress controller will implement the resource [gRPC-ingress] |
|
||||
| server.ingressGrpc.isAWSALB | bool | `false` | Setup up gRPC ingress to work with an AWS ALB |
|
||||
| server.ingressGrpc.labels | object | `{}` | Additional ingress labels for dedicated [gRPC-ingress] |
|
||||
| server.ingressGrpc.path | string | `"/"` | Argo CD server ingress path for dedicated [gRPC-ingress] |
|
||||
| server.ingressGrpc.pathType | string | `"Prefix"` | Ingress path type for dedicated [gRPC-ingress]. One of `Exact`, `Prefix` or `ImplementationSpecific` |
|
||||
| server.ingressGrpc.paths | list | `["/"]` | List of ingress paths for dedicated [gRPC-ingress] |
|
||||
| server.ingressGrpc.tls | list | `[]` | Ingress TLS configuration for dedicated [gRPC-ingress] |
|
||||
| server.ingressGrpc.tls | bool | `false` | Enable TLS configuration for the hostname defined at `server.ingressGrpc.hostname` |
|
||||
| server.initContainers | list | `[]` | Init containers to add to the server pod |
|
||||
| server.lifecycle | object | `{}` | Specify postStart and preStop lifecycle hooks for your argo-cd-server container |
|
||||
| server.livenessProbe.failureThreshold | int | `3` | Minimum consecutive failures for the [probe] to be considered failed after having succeeded |
|
||||
|
|
@ -1101,7 +1173,6 @@ If you want to use an existing Redis (eg. a managed service from a cloud provide
|
|||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| applicationSet.affinity | object | `{}` (defaults to global.affinity preset) | Assign custom [affinity] rules |
|
||||
| applicationSet.args | object | `{}` | DEPRECATED - ApplicationSet controller command line flags |
|
||||
| applicationSet.certificate.additionalHosts | list | `[]` | Certificate Subject Alternate Names (SANs) |
|
||||
| applicationSet.certificate.annotations | object | `{}` | Annotations to be applied to the ApplicationSet Certificate |
|
||||
| applicationSet.certificate.domain | string | `"argocd.example.com"` | Certificate primary domain (commonName) |
|
||||
|
|
@ -1125,7 +1196,7 @@ If you want to use an existing Redis (eg. a managed service from a cloud provide
|
|||
| applicationSet.dnsConfig | object | `{}` | [DNS configuration] |
|
||||
| applicationSet.dnsPolicy | string | `"ClusterFirst"` | Alternative DNS policy for ApplicationSet controller pods |
|
||||
| applicationSet.enabled | bool | `true` | Enable ApplicationSet controller |
|
||||
| applicationSet.extraArgs | list | `[]` | List of extra cli args to add |
|
||||
| applicationSet.extraArgs | list | `[]` | ApplicationSet controller command line flags |
|
||||
| applicationSet.extraContainers | list | `[]` | Additional containers to be added to the ApplicationSet controller pod |
|
||||
| applicationSet.extraEnv | list | `[]` | Environment variables to pass to the ApplicationSet controller |
|
||||
| applicationSet.extraEnvFrom | list | `[]` (See [values.yaml]) | envFrom to pass to the ApplicationSet controller |
|
||||
|
|
@ -1135,6 +1206,18 @@ If you want to use an existing Redis (eg. a managed service from a cloud provide
|
|||
| applicationSet.image.repository | string | `""` (defaults to global.image.repository) | Repository to use for the ApplicationSet controller |
|
||||
| applicationSet.image.tag | string | `""` (defaults to global.image.tag) | Tag to use for the ApplicationSet controller |
|
||||
| applicationSet.imagePullSecrets | list | `[]` (defaults to global.imagePullSecrets) | If defined, uses a Secret to pull an image from a private Docker registry or repository. |
|
||||
| applicationSet.ingress.annotations | object | `{}` | Additional ingress annotations |
|
||||
| applicationSet.ingress.enabled | bool | `false` | Enable an ingress resource for ApplicationSet webhook |
|
||||
| applicationSet.ingress.extraHosts | list | `[]` (See [values.yaml]) | The list of additional hostnames to be covered by ingress record |
|
||||
| applicationSet.ingress.extraPaths | list | `[]` (See [values.yaml]) | Additional ingress paths |
|
||||
| applicationSet.ingress.extraRules | list | `[]` (See [values.yaml]) | Additional ingress rules |
|
||||
| applicationSet.ingress.extraTls | list | `[]` (See [values.yaml]) | Additional ingress TLS configuration |
|
||||
| applicationSet.ingress.hostname | string | `"argocd.example.com"` | Argo CD ApplicationSet hostname |
|
||||
| applicationSet.ingress.ingressClassName | string | `""` | Defines which ingress ApplicationSet controller will implement the resource |
|
||||
| applicationSet.ingress.labels | object | `{}` | Additional ingress labels |
|
||||
| applicationSet.ingress.path | string | `"/api/webhook"` | List of ingress paths |
|
||||
| applicationSet.ingress.pathType | string | `"Prefix"` | Ingress path type. One of `Exact`, `Prefix` or `ImplementationSpecific` |
|
||||
| applicationSet.ingress.tls | bool | `false` | Enable TLS configuration for the hostname defined at `applicationSet.webhook.ingress.hostname` |
|
||||
| applicationSet.initContainers | list | `[]` | Init containers to add to the ApplicationSet controller pod |
|
||||
| applicationSet.livenessProbe.enabled | bool | `false` | Enable Kubernetes liveness probe for ApplicationSet controller |
|
||||
| applicationSet.livenessProbe.failureThreshold | int | `3` | Minimum consecutive failures for the [probe] to be considered failed after having succeeded |
|
||||
|
|
@ -1190,15 +1273,6 @@ If you want to use an existing Redis (eg. a managed service from a cloud provide
|
|||
| applicationSet.terminationGracePeriodSeconds | int | `30` | terminationGracePeriodSeconds for container lifecycle hook |
|
||||
| applicationSet.tolerations | list | `[]` (defaults to global.tolerations) | [Tolerations] for use with node taints |
|
||||
| applicationSet.topologySpreadConstraints | list | `[]` (defaults to global.topologySpreadConstraints) | Assign custom [TopologySpreadConstraints] rules to the ApplicationSet controller |
|
||||
| applicationSet.webhook.ingress.annotations | object | `{}` | Additional ingress annotations |
|
||||
| applicationSet.webhook.ingress.enabled | bool | `false` | Enable an ingress resource for Webhooks |
|
||||
| applicationSet.webhook.ingress.extraPaths | list | `[]` | Additional ingress paths |
|
||||
| applicationSet.webhook.ingress.hosts | list | `[]` | List of ingress hosts |
|
||||
| applicationSet.webhook.ingress.ingressClassName | string | `""` | Defines which ingress ApplicationSet controller will implement the resource |
|
||||
| applicationSet.webhook.ingress.labels | object | `{}` | Additional ingress labels |
|
||||
| applicationSet.webhook.ingress.pathType | string | `"Prefix"` | Ingress path type. One of `Exact`, `Prefix` or `ImplementationSpecific` |
|
||||
| applicationSet.webhook.ingress.paths | list | `["/api/webhook"]` | List of ingress paths |
|
||||
| applicationSet.webhook.ingress.tls | list | `[]` | Ingress TLS configuration |
|
||||
|
||||
## Notifications
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue