docs: update argocd apps pull solution using the clusteradm CLI for easier setup (#982)
Some checks failed
Scorecard supply-chain security / Scorecard analysis (push) Failing after 3m20s
Post / coverage (push) Failing after 26m0s
Post / images (amd64) (push) Failing after 3m12s
Post / images (arm64) (push) Failing after 3m9s
Post / image manifest (push) Has been skipped
Post / trigger clusteradm e2e (push) Has been skipped
Close stale issues and PRs / stale (push) Successful in 54s

Signed-off-by: Mike Ng <ming@redhat.com>
This commit is contained in:
Mike Ng
2025-05-06 10:42:34 -04:00
committed by GitHub
parent 67f0db9311
commit efda02e946
14 changed files with 47 additions and 165 deletions

View File

@@ -1,16 +1,18 @@
# ArgoCD Application Pull Controller
The [ArgoCD](https://argo-cd.readthedocs.io/en/stable/) application controller uses the hub-spoke pattern or pull model mechanism for decentralized resource delivery to remote clusters.
By using [Open Cluster Management (OCM)](https://open-cluster-management.io/) APIs and components,
the ArgoCD Applications will be pulled from the multi-cluster control plane hub cluster down to
the registered OCM managed clusters. To try it out, check out the [Getting Started Guide](getting-started.md).
# OCM Argo CD Add-on
The [Open Cluster Management (OCM)](https://open-cluster-management.io/)
[Argo CD](https://argo-cd.readthedocs.io/en/stable/) add-on uses the hub-spoke pattern
or pull model mechanism for decentralized resource delivery to remote clusters.
By using OCM APIs and components,
the Argo CD Applications will be pulled from the multi-cluster control plane hub cluster down to the registered OCM managed clusters.
To try it out, check out the [Getting Started Guide](getting-started.md).
## Overview
The current ArgoCD resource delivery is primarily pushing resources from a centralized cluster to the remote/managed clusters.
The current Argo CD resource delivery is primarily pushing resources from a centralized cluster to the remote/managed clusters.
![push model](./assets/push.png)
By using this controller, users can have a pull model resource delivery mechanism.
By using this OCM Argo CD add-on, users can have a pull model resource delivery mechanism.
![pull model](./assets/pull.png)
@@ -19,9 +21,14 @@ The pull model may offers some advantages over the existing push model:
- Security: cluster credentials doesn't have to be stored in a centralized environment may enhance security.
- It may reduce the impact of a single point of centralized failure.
This ArgoCD pull model controller on the Hub cluster will create [ManifestWork](https://open-cluster-management.io/concepts/manifestwork/) objects wrapping Application objects as payload.
This OCM Argo CD add-on on the Hub cluster will create
[ManifestWork](https://open-cluster-management.io/concepts/manifestwork/)
objects wrapping Application objects as payload.
The OCM agent on the Managed cluster will see the ManifestWork on the Hub cluster and pull the Application down.
The Managed cluster with the OCM Argo CD add-on enabled will automatically have an Argo CD instance installed.
The Argo CD application controller from the instance will be able to reconcile the Application CR on the managed cluster.
## Quick Start
See the [Getting Started](./getting-started.md) for a quick start guide.

View File

@@ -9,7 +9,7 @@ spec:
configMapRef: ocm-placement-generator
labelSelector:
matchLabels:
cluster.open-cluster-management.io/placement: guestbook-app-placement
cluster.open-cluster-management.io/placement: app-placement
requeueAfterSeconds: 30
template:
metadata:

View File

@@ -1,14 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
name: default
namespace: argocd
spec:
clusterResourceWhitelist:
- group: '*'
kind: '*'
destinations:
- namespace: '*'
server: '*'
sourceRepos:
- '*'

View File

@@ -1,8 +0,0 @@
apiVersion: cluster.open-cluster-management.io/v1beta2
kind: ManagedClusterSetBinding
metadata:
name: global
namespace: argocd
spec:
clusterSet: global

View File

@@ -1,6 +0,0 @@
apiVersion: cluster.open-cluster-management.io/v1beta1
kind: Placement
metadata:
name: guestbook-app-placement
namespace: argocd
spec: {}

View File

@@ -1,13 +0,0 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: ocm-placement-consumer
namespace: argocd
rules:
# Allow controller to manage placements/placementdecisions
- apiGroups: ["cluster.open-cluster-management.io"]
resources: ["placements"]
verbs: ["get", "list"]
- apiGroups: ["cluster.open-cluster-management.io"]
resources: ["placementdecisions"]
verbs: ["get", "list"]

View File

@@ -1,13 +0,0 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: ocm-placement-consumer:argocd
namespace: argocd
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: ocm-placement-consumer
subjects:
- kind: ServiceAccount
namespace: argocd
name: argocd-applicationset-controller

View File

@@ -1,10 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: ocm-placement-generator
namespace: argocd
data:
apiVersion: cluster.open-cluster-management.io/v1beta1
kind: placementdecisions
statusListKey: decisions
matchKey: clusterName

View File

@@ -1,8 +0,0 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: argocd-klusterlet-consumer
rules:
- apiGroups: ["argoproj.io"]
resources: ["applications", "appprojects"]
verbs: ["create", "get", "list", "watch", "update", "patch", "delete"]

View File

@@ -1,12 +0,0 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: klusterlet-argocd-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: argocd-klusterlet-consumer
subjects:
- kind: ServiceAccount
name: klusterlet-work-sa
namespace: open-cluster-management-agent

View File

@@ -1,14 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
name: default
namespace: argocd
spec:
clusterResourceWhitelist:
- group: '*'
kind: '*'
destinations:
- namespace: '*'
server: '*'
sourceRepos:
- '*'

View File

@@ -9,7 +9,7 @@ spec:
configMapRef: ocm-placement-generator
labelSelector:
matchLabels:
cluster.open-cluster-management.io/placement: guestbook-app-placement
cluster.open-cluster-management.io/placement: app-placement
requeueAfterSeconds: 30
template:
metadata:

View File

@@ -17,70 +17,43 @@
curl -L https://raw.githubusercontent.com/open-cluster-management-io/OCM/main/solutions/setup-dev-environment/local-up.sh | bash
```
See [Open Cluster Management Quick Start](https://open-cluster-management.io/getting-started/quick-start/) for more details.
See [Open Cluster Management (OCM) Quick Start](https://open-cluster-management.io/getting-started/quick-start/) for more details.
2. Install ArgoCD on the hub cluster and both managed clusters.
```
for i in "hub" "cluster1" "cluster2"
do
kubectl config use-context kind-$i
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
done
```
See [ArgoCD website](https://argo-cd.readthedocs.io/en/stable/getting_started/) for more details.
1. Install the Pull controller on the hub cluster:
1. Install Argo CD on the Hub cluster.
```
kubectl config use-context kind-hub
kubectl apply -f https://raw.githubusercontent.com/open-cluster-management-io/argocd-pull-integration/main/deploy/install.yaml
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
```
See [Argo CD website](https://argo-cd.readthedocs.io/en/stable/getting_started/) for more details.
2. If your controller starts successfully, you should see:
```
$ kubectl config use-context kind-hub
$ kubectl -n open-cluster-management get deploy | grep pull
argocd-pull-integration-controller-manager 1/1 1 1 106s
```
3. On the Hub cluster, create ArgoCD cluster secrets that represent the managed clusters. This step can be automated with [OCM auto import controller](https://github.com/open-cluster-management-io/multicloud-integrations/).
1. Install the OCM Argo CD add-on on the Hub cluster:
```
kubectl config use-context kind-hub
for i in "cluster1" "cluster2"
do
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Secret
metadata:
name: $i-secret # cluster1-secret
namespace: argocd
labels:
argocd.argoproj.io/secret-type: cluster
type: Opaque
stringData:
name: $i # cluster1
server: https://$i-control-plane:6443 # https://cluster1-control-plane:6443
EOF
done
clusteradm install hub-addon --names argocd
```
If your hub controller starts successfully, you should see:
```
$ kubectl -n argocd get deploy argocd-pull-integration
NAME READY UP-TO-DATE AVAILABLE AGE
argocd-pull-integration 1/1 1 1 55s
```
4. On the Hub cluster, apply the manifests in `example/hub`:
1. Enable the add-on for your choice of managed clusters:
```
kubectl config use-context kind-hub
kubectl apply -f example/hub
clusteradm addon enable --names argocd --clusters cluster1,cluster2
```
Replace `cluster1` and `cluster2` with your managed cluster names.
If your add-on starts successfully, you should see:
```
$ kubectl -n cluster1 get managedclusteraddon argocd
NAME AVAILABLE DEGRADED PROGRESSING
argocd True False
```
5. On the managed clusters, apply the manifests in `example/managed`:
```
for i in "cluster1" "cluster2"
do
kubectl config use-context kind-$i
kubectl apply -f example/managed
done
```
6. On the Hub cluster, apply the `guestbook-app-set` manifest:
1. On the Hub cluster, apply the `guestbook-app-set` manifest:
```
kubectl config use-context kind-hub
kubectl apply -f example/guestbook-app-set.yaml
@@ -99,7 +72,7 @@
The `ocm-managed-cluster` annotation is for the ApplicationSet to generate multiple Application based on each cluster generator targets.
7. When this guestbook ApplicationSet reconciles, it will generate an Application for the registered managed clusters. For example:
1. When this guestbook ApplicationSet reconciles, it will generate an Application for the registered managed clusters. For example:
```
$ kubectl config use-context kind-hub
$ kubectl -n argocd get appset
@@ -111,7 +84,7 @@
cluster2-guestbook-app
```
8. On the Hub cluster, the pull controller will wrap the Application with a ManifestWork. For example:
1. On the Hub cluster, the pull controller will wrap the Application with a ManifestWork. For example:
```
$ kubectl config use-context kind-hub
$ kubectl -n cluster1 get manifestwork
@@ -119,7 +92,7 @@
cluster1-guestbook-app-d0e5 2m41s
```
9. On a managed cluster, you should see that the Application is pulled down successfully. For example:
1. On a managed cluster, you should see that the Application is pulled down successfully. For example:
```
$ kubectl config use-context kind-cluster1
$ kubectl -n argocd get app
@@ -130,7 +103,7 @@
guestbook-ui 1/1 1 1 7m36s
```
10. On the Hub cluster, the status controller will sync the dormant Application with the ManifestWork status feedback. For example:
1. On the Hub cluster, the status controller will sync the dormant Application with the ManifestWork status feedback. For example:
```
$ kubectl config use-context kind-hub
$ kubectl -n argocd get app

View File

@@ -1,7 +1,7 @@
# Troubleshooting
#### For ArgoCD components, check the following containers for logs:
* argocd-pull-integration-* in the `open-cluster-management` namespace (only on the hub cluster)
#### For Argo CD components, check the following containers for logs:
* argocd-pull-integration-* in the `argocd` namespace (only on the hub cluster)
* argocd-applicationset-controller in the `argocd` namespace
* argocd-application-controller (only on managed clusters) in the `argocd` namespace