How to avoid an ArgoCD Application definition to manage ArgoCD itself getting OutofSync everytime a user is added?

[amfcdr]

Good/morning/afternoon/evening.

TL;DR

• Can jqPathExpressions be used in an Application definition .spec.ignoreDifferences[] for non-array matching and, if so, how?

(for those who require a proper background, please keep reading)

The setup:

• I've got a central ArgoCD deployment that will manage other ArgoCD deployments in remote clusters (as a disaster-recovery of sorts).
• Each remote ArgoCD has an Application definition in the central ArgoCD deployment.
• Whenever a user of one of the remote ArgoCD is added, or changes password, the respective Application on the central ArgoCD gets OutOfSync.
• For completeness, each remote ArgoCD also has a "self-managing" Application definition and the same behavior occurs in the user added / password change scenario.

The issue:

• ArgoCD users are referenced in both the argocd-cm and in the argocd-secret with (and here is the source of the issue) different keys for each user:
  argocd/argocd-cm:

  apiVersion: v1
  data:
    accounts.manager: login
    accounts.user1: apiKey
    accounts.otheruser: apiKey, login
    accounts.someoneelse: login
    admin.enabled: "false"
    application.resourceTrackingMethod: annotation+label
    resource.respectRBAC: normal
    server.rbac.log.enforce.enable: "true"
  kind: ConfigMap
  metadata:
    name: argocd-cm
    namespace: argocd

  argocd/argocd-cm:

  apiVersion: v1
  data:
    accounts.manager.password: <password>
    accounts.manager.passwordMtime: <timestamp>
    accounts.manager.tokens: bnVsbA==
    accounts.user1.password: <password>
    accounts.user1.passwordMtime: <timestamp>
    accounts.user1.tokens: <api key>
    accounts.otheruser.password: <password>
    accounts.otheruser.passwordMtime: <timestamp>
    accounts.otheruser.tokens: <api key>
    accounts.someoneelse.password: <password>
    accounts.someoneelse.passwordMtime: <timestamp>
    accounts.someoneelse.tokens: bnVsbA==
    server.secretkey: <secret key>
    webhook.<git>.secret: <webhook secret>
  kind: Secret
  metadata:
    name: argocd-secret
    namespace: argocd
  type: Opaque

The workaround:

• Taking advantage of the ignoreDifferences key and the RespectIgnoreDifferences=true directive, the Application definition (both on the central and remote ArgoCDs) is setup as (for the relevant parts):

  apiVersion: argoproj.io/v1alpha1
  kind: Application
  metadata:
    name: argocd-application
    namespace: argocd
  spec:
    destination:
      name: <"destination cluster" or "in-cluster" depending on where it's deployed>
      namespace: argocd
    ignoreDifferences:
    - jsonPointers:
      - /data/accounts.manager.password
      - /data/accounts.manager.passwordMtime
      - /data/accounts.manager.tokens
      - /data/accounts.user1.password
      - /data/accounts.user1.passwordMtime
      - /data/accounts.user1.tokens
      - /data/accounts.otheruser.password
      - /data/accounts.otheruser.passwordMtime
      - /data/accounts.otheruser.tokens
      - /data/accounts.someoneelse.password
      - /data/accounts.someoneelse.passwordMtime
      - /data/accounts.someoneelse.tokens
      kind: Secret
      name: argocd-secret
      namespace: argocd
    - jsonPointers:
      - /data/accounts.manager
      - /data/accounts.user1
      - /data/accounts.otheruser
      - /data/accounts.someoneelse
      kind: ConfigMap
      name: argocd-cm
      namespace: argocd
    source:
      path: deploy/argocd/overlay/<"destination cluster" or "in-cluster" depending on where it's deployed>
      repoURL: <git repository>
      targetRevision: master
    syncPolicy:
      syncOptions:
      - ApplyOutOfSyncOnly=true
      - RespectIgnoreDifferences=true

  Additional concerns:
  • This addresses the password change scenario, but not the user added one, since adding users will create additional keys that'll have to be added to the .spec.ignoreDifferences[].jsonPointers[] arrays.
  • Ignoring the whole content of the ConfigMap / Secret is not acceptable since there are other keys there that need to be managed.

The questions:

• ignoreDifferences has another way of defining keys to be ignored, jqPathExpressions, which I've only found references of its use when arrays are in question in the YAML manifests.

• Question 1: Can jqPathExpressions be used to avoid editing the Application definition each time a new user is added to ArgoCD?

  • I've tried several approaches myself to this without success (I'm not that familiar with JSON queries):
    • .data |with_entries(select(.key |startswith("accounts.")))
    • .data |to_entries[] |select(.key |startswith("accounts.")) |.key
    • .data |to_entries |map(select(.key |startswith("accounts."))) |from_entries
    • .data |to_entries |map(select(.key |startswith("accounts."))) |map(".data." + .key)

• Question 2: If the answer to Question 1 is positive, what should be the expected input to jqPathExpressions?

Thank you very much for reading so far.