Hi, Habr. As part of the course "Infrastructure platform based on Kubernetes" we have prepared a translation of useful material for you.
We also invite you to the open webinar "Working with NoSQL databases in k8s (by the example of Apache Cassandra)" . At the webinar, the participants, together with an expert, will consider the pros and cons of running Apache Cassandra in k8s: how ready this installation option is for production, and what pitfalls there are.
In this article, we will look at a few questions about Argo CD: what it is, why is it used, how to deploy it (in Kubernetes), how to use it to implement continuous deployment, how to configure SSO with GitHub and permissions, etc. etc.
What is Argo CD and GitOps
Argo CD — GitOps- (continuous delivery) Kubernetes.
GitOps?
, GitOps — (continuous deployment) . , , Git Continuous Deployment.
, ? , , , , : K8s YAML Helm-, Git (single source of truth), CI , master , .
GitOps
, .
() :
, . , git ; ; , ; , .
GitOps , .
Argo CD
GitOps, CI/CD? , . , Jenkins, , Git- , git clone helm install. Jenkins, CI: CI: 17 CI CI 2020 .
, , , .
, Argo CD , : , , , , , , .
, , , , :
Cloud Native Computing Foundation (CNCF).
. :
git- , :
v0.1.0 2018 ( )
v1.0.0 2019 ( )
v1.7.8 ( 2020, )
4,3 . Argo CD ( )
60 PR 500 ( , , )
CNCF:
«» (ASSESS), , CNCF , . , .
CNCF End User Community. 140 , . , , , , , , , . , , .
, . K8s, k8s.
kubectl create namespace argocd
kubectl apply -n argocd -f \
https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
YAML, .
. :
Pods:
argocd-application-controller-6b47c9bd78-kp6dj
argocd-dex-server-7b6d8776d8-knsxx
argocd-redis-99fb49846-l466k
argocd-repo-server-b664bd94b-bmtwr
argocd-server-768879948c-sx875
Services:
argocd-dex-server
argocd-metrics
argocd-redis
argocd-repo-server
argocd-server
argocd-server-metrics
ingress:
, Cluster IP, ingress . , , , , ingress.
, EKS AWS, , ingress , , ingress-. Argo CD , 443 HTTPS ( - ), GRPC API . EKS, , ingress- Nginx, , TLS , ingress- , HTTP, GRPC. .
CLI
Mac :
brew install argocd
. :
argocd login ( , , ingress - )
:
argocd account update-password
, :
Argo CD
Argo CD, , , dev, test, staging, production - .
, Argo CD, Argo CD:
:
argocd cluster list
, :
argocd cluster add CONTEXTNAME
«CONTEXTNAME»- kube .
Helloworld-
«» Argo CD.
«TL;DR» « UI» — :
argocd app create helloworld --repo https://github.com/ironcore864/go-hello-http.git --path helm --sync-policy automatic --dest-server https://kubernetes.default.svc --dest-namespace default --values values.yaml --values values.dev.yaml
CLI- , . Argo CD, , :
«NEW APP» :
, :
Application Name: . «helloworld»
Project: «default». Project () — Argo CD,
Sync policy: Manual Automatic ( GitOps). Automatic ( , — «Manual»).
«SYNC POLICY» «Automatic»
SOURCE . URL- git. , . , , , Golang «helm», .
, URL- git-, «PATH», , Argo CD , «helm» , , :
«Path» «helm» .
, «Path» «helm».
, Argo CD . Argo CD ; YAML k8s, kustomize, helm. , «Path» , Argo CD , Helm; YAML k8s, Argo CD , kubectl apply. , ?
«Destination» , Kubernetes ( ) ( ).
«URL- », .
«helm» , Argo CD «Helm», , , :
«VALUES FILES», , «Path», .
, . helm — , , CLI-.
, , dev , , , .
«Create» Argo CD «» (sync) , git-, , git, Argo CD , git. , , :
, 1 ( «values.dev.yaml» 3 , «values.yaml»), , . , , :
, . 1 , bash- cd - , helm, , , helm, .
CLI-, , , , .
GitHub SSO
, , — , , .
Argo CD , . , SSO-.
Argo CD, , , SSO.
Argo CD Dex . (OIDC, SAML, LDAP, GitHub . .). (SSO) Argo CD argocd-cm Dex-. OAuth git configmap «argocd-cm», :
data:
url: https://argocd.example.com
dex.config: |
connectors:
# GitHub example
- type: github
id: github
name: GitHub
config:
clientID: aabbccddeeff00112233
clientSecret: $dex.github.clientSecret
orgs:
- name: your-github-org
# GitHub enterprise example
- type: github
id: acme-github
name: Acme GitHub
config:
hostName: github.acme.com
clientID: abcdefghijklmnopqrst
clientSecret: $dex.acme.clientSecret
orgs:
- name: your-github-org
, GitHub SSO .
GitHub SSO , , — - RBAC, Argo CD. , SSO, RBAC, configmap argocd-rbac-cm
:
apiVersion: v1
kind: ConfigMap
metadata:
name: argocd-rbac-cm
namespace: argocd
data:
policy.default: role:readonly
policy.csv: |
p, role:org-admin, applications, *, */*, allow
p, role:org-admin, clusters, get, *, allow
p, role:org-admin, repositories, get, *, allow
p, role:org-admin, repositories, create, *, allow
p, role:org-admin, repositories, update, *, allow
p, role:org-admin, repositories, delete, *, allow
g, your-github-org:your-team, role:org-admin
, , GitHub, .
, , (, SSO, , RBAC), ( , ) . , . , , .
« NoSQL k8s ( Apache Cassandra)».