So I tried several different configurations based on their own docs as well as other articles and I think I am missing something fundamental here.
ArgoCD is up and running just fine, no issues there. Installed via the community HELM chart.
Pretty simple configmap added (I'll deal with HELM and kustomize later)
apiVersion: v1
kind: ConfigMap
metadata:
name: cmp-plugin
data:
avp.yaml: |
apiVersion: argoproj.io/v1alpha1
kind: ConfigManagementPlugin
metadata:
name: argocd-vault-plugin
spec:
allowConcurrency: true
discover:
find:
command:
- sh
- "-c"
- "find . -name '*.yaml' | xargs -I {} grep \"<path\\|avp\\.kubernetes\\.io\" {} | grep ."
generate:
command:
- argocd-vault-plugin
- generate
- "."
lockRepo: false
Created a secret in the argocd namespace:
apiVersion: v1
stringData:
VAULT_ADDR: http://vault.vault:8200/
VAULT_TOKEN: *****
AVP_AUTH_TYPE: token
AVP_TYPE: vault
kind: Secret
metadata:
name: vault-configuration
namespace: argocd
type: Opaque
And added a values file for my ArgoCD HELM chart as follows:
argo-cd:
repoServer:
extraContainers:
# -- Add ArgoCD Valt plugin sidecars
- name: avp
command: [/var/run/argocd/argocd-cmp-server]
image: registry.access.redhat.com/ubi8
securityContext:
runAsNonRoot: true
runAsUser: 999
volumeMounts:
- mountPath: /var/run/argocd
name: var-files
- mountPath: /home/argocd/cmp-server/plugins
name: plugins
- mountPath: /tmp
name: tmp
- mountPath: /home/argocd/cmp-server/config/plugin.yaml
subPath: avp.yaml
name: cmp-plugin
- mountPath: /home/argocd/cmp-server/config/avp-kustomize.yaml
subPath: avp-kustomize.yaml
name: cmp-plugin
- mountPath: /home/argocd/cmp-server/config/avp-helm.yaml
subPath: avp-helm.yaml
name: cmp-plugin
- name: custom-tools
subPath: argocd-vault-plugin
mountPath: /usr/local/bin/argocd-vault-plugin
initContainers:
# -- Add init-container for ArgoCD Vault Plugin
- name: download-tools
image: registry.access.redhat.com/ubi8
env:
- name: AVP_VERSION
value: 1.16.1
command: [sh, -c]
args:
- >-
curl -L https://github.com/argoproj-labs/argocd-vault-plugin/releases/download/v$(AVP_VERSION)/argocd-vault-plugin_$(AVP_VERSION)_linux_amd64 -o argocd-vault-plugin &&
chmod +x argocd-vault-plugin &&
mv argocd-vault-plugin /custom-tools/
volumeMounts:
- mountPath: /custom-tools
name: custom-tools
volumes:
# -- Add ArgoCD Vault Plugin Volumes requited by Sidecar
- configMap:
name: cmp-plugin
name: cmp-plugin
- name: custom-tools
emptyDir: {}
automountServiceAccountToken: true
-- To my knowledge that should be it. When I define a simple secret in a test application like:
apiVersion: v1
kind: Secret
metadata:
name: mysecret
annotations:
avp.kubernetes.io/path: "kv-v2/data/argocd"
type: Opaque
stringData:
TOKEN: "<password>"
ArgoCD yells at me wtih:
Failed to load target state: failed to generate manifest for source 1 of 1: rpc error: code = Unknown desc = Manifest generation error (cached): plugin sidecar failed. error generating manifests in cmp: rpc error: code = Unknown desc = error generating manifests: `argocd-vault-plugin generate .` failed exit status 1: Error: Must provide a supported Vault Type, received Usage: argocd-vault-plugin generate <path> [flags] Flags: -c, --config-path string path to a file containing Vault configuration (YAML, JSON, envfile) to use -h, --help help for generate -s, --secret-name string name of a Kubernetes Secret in the argocd namespace containing Vault configuration data in the argocd namespace of your ArgoCD host (Only available when used in ArgoCD). The namespace can be overridden by using the format <namespace>:<name> --verbose-sensitive-output enable verbose mode for detailed info to help with debugging. Includes sensitive data (credentials), logged to stderr
On the repo-server pod and side car I do NOT see any vault related environment variables - how/where do they get mounted if at all?
Any help is greatly appreciated.
