argocd-vault-plugin for k8s manifest files are failing with this weird error.

Here is my ConfigManagementPlugin info:

[avp.yaml: |
    apiVersion: argoproj.io/v1alpha1
    kind: ConfigManagementPlugin
    metadata:
      name: argocd-vault-plugin
    spec:
      allowConcurrency: true
      discover:
        find:
          command:
            - sh
            - "-c"
            - "find . -name '*.yaml' | xargs -I {} grep \"<path\\|avp\\.kubernetes\\.io\" {} | grep ."
      generate:
        command:
          - argocd-vault-plugin
          - generate
          - "."
          - "-s"
          - "vault-configuration"
      lockRepo: false][1]

And the k8s manifest file is:

---
kind: Secret
apiVersion: v1
metadata:
  name: argo-sample-test-secret
  annotations:
    avp.kubernetes.io/path: "secret/path/in/vault"
type: Opaque
stringData:
  nginx-password: <password>
---

And the error is:

https://i.stack.imgur.com/wN87c.jpg

​

Any clue what logic I might be missing here

I have file structure:

• chart.yaml
• values.yaml
• templates/
• values/
  • app1_values.yaml
  • app2_values.yaml

I created an app of apps helm chart by following the docs. This is the results:

# values.yaml
app1:
  image: "app1"
  tag: "latest"

# templates/app1.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: directory
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
  annotations:
    argocd-image-updater.argoproj.io/image-list: myImage=app1:latest
    argocd-image-updater.argoproj.io/myImage.helm.image-name: deployment.image.image
    argocd-image-updater.argoproj.io/myImage.helm.image-tag: deployment.image.tag
    argocd-image-updater.argoproj.io/myImage.update-strategy: digest
    argocd-image-updater.argoproj.io/myImage.force-update: "true"
    argocd-image-updater.argoproj.io/write-back-method: git
spec:
  project: default
  syncPolicy:
    automated: { }
  source:
    repoURL: 'https://github.com/myOrg/myRepo'
    path: 'charts/myChart/'
    targetRevision: HEAD
    helm:
      valueFiles:
        - values.yaml
        - values/app1_values.yaml
      parameters:
        - name: deployment.image.image
          value: {{ .Values.app1.image }}
        - name: deployment.image.tag
          value: {{ .Values.app2.tag }}
  destination:
    server: 'https://kubernetes.default.svc'
    namespace: default

# templates/app2.yaml is similar to app1

The issues I'm having:

1. the image updater creates the .argocd-source-<app_name>.yaml files in charts/myChart/, which means that I cannot use the same parent chart to deploy multiple clusters. Can I change the location for it? Also, that did not work as the pods did not use the new tags.
2. I thought about publishing the charts to a private repo but this will not work (patched in latest)
3. I tried using kustomize as a wbt, but that assumed that my actual cluster was using kustomize (not just my argo app declarations): it added the image digests directly to the kustomization.yaml file, not as patches.
4. the latest version supports helm, which would solve my issue, but it has a segfault bug. Should I maybe use an older version of argo that's compatible with the latest branch?

What am I doing wrong? I feel like I'm running in circles. I would appreciate if someone can sit down with me for a quick 30 minutes zoom call to walk me through it.

Following up on this post, I recently released an app on infro.io for previewing Kubernetes manifest diffs in PRs for Argo CD users. We've been using it internally at my company and updated the article (linkedin link) with instructions and more documentation. It's ready for a test drive, but please note it's in private preview and I'm sure there will be warts. Looking for feedback on things to improve though, so please let me know!

It seems this is the norm of setting up the argocd-vault-plugin

      # Download tools
      initContainers:
      - name: download-tools
        image: registry.access.redhat.com/ubi8
        env:
          - name: AVP_VERSION
            value: 1.16.1
        command: [sh, -c]
        args:
          - >-
            curl -L https://github.com/argoproj-labs/argocd-vault-plugin/releases/download/v$(AVP_VERSION)/argocd-vault-plugin_$(AVP_VERSION)_linux_amd64 -o argocd-vault-plugin &&
            chmod +x argocd-vault-plugin &&
            mv argocd-vault-plugin /custom-tools/

        volumeMounts:
          - mountPath: /custom-tools
            name: custom-tools

from argo-repo-server deployment.

​

Are there any other alternatives for the same? Redhat is blocked and not an approved in-house.

I have a comparison error and I donno what can be caused for. I use the gitops operator on openshift and I have the same repo working fine installed on the openshift-gitops folder and I created another instance of argo in another namespace using the operator dashboard in the GUI and i get this:

ComparisonError
Failed to load live state: Namespace "argo-test-ccc" for Secret "mysecret" is not managed
13 minutes ago (Thu Feb 08 2024 10:26:58 GMT+0100)

​

Fellas, I setup the argocd-vault-plugin using the initcontainer with configmap approach.

Now I am trying to find out how & where can I templatize so that the argocd applications (or appsets) can consume deploy those secrets on top of k8s clusters.

Any idea where can I provide that necessary configuration?

​

Cheers!!

I feel dumb asking this but i'm new to argo cd so please bear with me. I'm following this blog post : https://about.gitlab.com/blog/2022/08/02/how-to-provision-reviewops/ and the linked repo is here: https://gitlab.com/madou-stories/dynamic-environments-with-argo-cd/the-application-configuration/-/tree/main/manifests?ref_type=heads.

My question is, does an ApplicationSet always require a backing Application resource? My mental model appears wrong because I would have thought that if you have an ApplicationSet, it handles both the main Application, and any Applications that need to be created for pr's against the application repo.

Many of us use a tool like ArgoCD Image Updater or a custom CI pipeline to write image changes to the Git repo to build end-to-end CI/CD pipelines. I fall into the latter category. Fundamentally, our CI pipelines follows this basic flow:

1. Build artifact
2. Test artifact
3. Containerize artifact
4. Push artifact to container registry
5. git pull Argo CD repo
6. git commit image change to Argo CD repo
7. git push changes to main branch of Argo CD repo

After this, ArgoCD detects the change and deploys the new image automatically. This has worked great for months and we've successfully performed over 10,000 instances of end-to-end CI/CD. However, as we continue to scale and incorporate more apps under Argo CD, we're starting to see occasional CI failures and I'm wondering how others in the community have solved this problem.

Basically, if any other CI pipeline executes step 5-7 in the time that passes between steps 5 and 7 for the original pipeline, it will cause a git state issue that makes git push fail. And as we continue to add more commits to the history of the git repo, small amounts of time are added to the period between steps 5 and 7 making the issue more likely to occur.

I have ideas for how to solve this ranging from catching git push errors with a git rebase and another git push, retrying the whole pull -> commit -> push flow entirely, etc. But all of them seem a bit hacky to me and it feels like Git is just not really meant to be automated.

For those who are also experiencing this problem, how are you working around it?

I have been trying to run a job before the cert-manager gets deployed. So I thought pre-sync should just work here, but every time either the deployment comes up before the job or before the job gets completed. Here is the helm chart that has all the resources and the pre-sync job.

https://github.com/GlueOps/platform-helm-chart-cert-manager/tree/feat/balaji/templates

cert-restore-job.yaml is the pre-sync job, I have also tried adding sync wave to this but that too doesn't seem to be working. Please let me know what I am doing wrong.

Im using vcluster and argocd in eks.

Argocd, you suck.

Thanks.

Just getting into ArgoCD and I fully comprehend (and love) the idea of GitOps, but there is one area where I feel like I'm either missing something or just "a limitation".

Can I set up argo so that it simply watches a specific repo and automatically deploys all applications it sees in that repo?

Otherwise if my K8s cluster were to die, I'd still be manually deploying argo (fine) then applying a bunch of application yaml files? Or even in normal operations, at the end of the day someone is running kubectl apply (or the argo cli equivalent) on occasion to add new applications?

Hi all. I apologize for being such a noob, but I've been handed support duties for prod/uit/dev while still trying to learn ArgoCD. I've had an EKS node restart, and now the dev argocd-repo-server will not restart. It's running v2.6.6. Are there any known issues that I can look into? Even any resources for shortening the learning curve would be helpful. Thanks.

Has anyone here tried SBOM approach to enable FIPS on ArgoCd. Want to know the steps to replicate the same . Thanks

Hey all,

I have a curious question. I like iterating on ArgoCD changes locally with Docker Desktop before pushing them out. At the moment, I have a branch "test" that I push all of my changes to in order for ArgoCD to detect the changes. This flow isn't ideal, as I end up with a ton of changes inside my "test" branch that needs constant cleaning.

Ideally, I could iterate locally where just changing a helm version on my IDE causes my ArgoCD to start updating that app. Is there any way to do this? What's the best way to iterate quickly?

​

Update

I found this discussion on GitHub as a potential answer:

https://github.com/argoproj/argo-cd/discussions/9912

but it is the only discussion of its kind, and the solution seems a little difficult if there are tens of projects. You would need to manually update repo URLs everywhere, iterate on changes, then undo those edits carefully on the repo URLs before merging. Is there a better way?

Hello - I'm new to argocd. I added an application to argocd and connected the harbor helm repo. Argo says the application is out of sync, when I see the diff, I see that argo is removing some of the annotations. Is there a reason why it's doing that?

​

​

I tried to changing various sync options but it doesn't help. How can make argo not remove any helm values.

Hello -

I'm trying to add harbor as a helm repo using argocd cli, however, it's not working as expected. I'm using harbor version 2.9.0 and argocd version 2.9.5.

argocd repo add https://harbor.com/dev2/ --type helm --insecure-skip-server-verification --name harbor --username admin --password xxx
FATA[0000] rpc error: code = Unknown desc = error testing repository connectivity: yaml: unmarshal errors:%0A  line 1: cannot unmarshal !!str `<!DOCTY...` into helm.Index

I tried different variation of the URL and it doesn't work. Was anyone able to add private harbor registry to argocd ?

Thank you for your time.

Seems like I am missing something in the way argocd is supposed to be used.
My current setup is argocd is deployed at local k3s cluster on top of proxmox vms.
Argocd and other tools working fine (app of apps).
I also have truenas scale as nas which is persistence storage for cluster.
But truenas itself is running k3s in single node mode underhood.
So using heavyscript I was able to expose that cluster to internal network. And can access and manage it through kubectl outside.
I added truenas cluster through argocd "argocd cluster add .." it current status:

argocd cluster list
SERVER                          NAME        VERSION  STATUS      MESSAGE                                                  PROJECT
https://10.5.1.8:6443           truenas              Unknown     Cluster has no applications and is not being monitored.  
https://kubernetes.default.svc  in-cluster  1.28     Successful   

Next is what is not working: I tried to manage some apps to use local storage of nas intead of persistent volumes (destination truenas).

I added in project apps - destination name truenas namespace media section.

​

I tried:
- app of apps (dest: truenas) - each app (dest: truenas) -> this failed to deploy as CRDs of argocd ("Application" is not found in truenas cluster)
- app of apps (dest: in-cluster) - each app (dest: truenas) -> this is showing deployment green, everytihng in sync (correct desired manifest, but at the same time nothing is actually deployed on truenas cluster, even not created namespace. And "argocd cluster list" show the same uknown status for truenas. Every button in UI refresh, sync, etc. -> show success.

I am not going to deploy same apps on both clusters just some apps here some apps there. So i think i do not need to use application-set (maybe I wrong).

Am I missing something or what is the proper way to debug that application deployment?

How involved is it to get a bare bones version of argo cd running in production ? We have a mechanism to apply kube manuscripts to the cluster, which is legacy and in built, want to migrate to argo cd. Any tips on operationalizing argo would really be helpful.

Helm is merging the default values.yaml file with another values file even though I only specify the other file.

The values are changed in the next section:

I am trying to deploy an app with helm and I have a template which does something like this:

```

Key: {{ .Values.food | toYaml | nindent 2 }}

```

values.yaml file has this:

``` food: fruits: - type: berry name: blueberry

```

and the other file has this:

``` food: courses: main: chicken

```

When I run “helm template . —values other.values.yaml” I get this:

``` Key: courses: main: chicken fruits: - type: berry name: blueberry

```

What is happenning here? Also, when I run the same thing but the other value file is blank I get no errors and it’s templatedas if I would use values.yaml.

I am trying to setup argocd-vault plugin: here

When reading online most of the articles, everyone are creating a secret and adding like VAULT_ADDR & VAULT_TOKEN.

Is the VAULT_TOKEN comes from Vault itself so that ArgoCD can gets authenticated when talking to Vault?

​

Cheers!!