fix: add roles to redis-ha service accounts to enable run-as non-root users in OpenShift

assets/swagger.json

@@ -124,7 +124,7 @@
           "AccountService"
         ],
         "summary": "CreateToken creates a token",
-        "operationId": "CreateTokenMixin10",
+        "operationId": "CreateTokenMixin7",
         "parameters": [
           {
             "type": "string",
@@ -157,7 +157,7 @@
           "AccountService"
         ],
         "summary": "DeleteToken deletes a token",
-        "operationId": "DeleteTokenMixin10",
+        "operationId": "DeleteTokenMixin7",
         "parameters": [
           {
             "type": "string",
@@ -188,7 +188,7 @@
           "ApplicationService"
         ],
         "summary": "List returns list of applications",
-        "operationId": "List",
+        "operationId": "ListMixin10",
         "parameters": [
           {
             "type": "string",
@@ -239,7 +239,7 @@
           "ApplicationService"
         ],
         "summary": "Create creates an application",
-        "operationId": "Create",
+        "operationId": "CreateMixin10",
         "parameters": [
           {
             "name": "body",
@@ -266,7 +266,7 @@
           "ApplicationService"
         ],
         "summary": "Update updates an application",
-        "operationId": "Update",
+        "operationId": "UpdateMixin10",
         "parameters": [
           {
             "type": "string",
@@ -400,7 +400,7 @@
           "ApplicationService"
         ],
         "summary": "Get returns an application by name",
-        "operationId": "GetMixin1",
+        "operationId": "GetMixin10",
         "parameters": [
           {
             "type": "string",
@@ -452,7 +452,7 @@
           "ApplicationService"
         ],
         "summary": "Delete deletes an application",
-        "operationId": "Delete",
+        "operationId": "DeleteMixin10",
         "parameters": [
           {
             "type": "string",
@@ -1162,7 +1162,7 @@
           "ClusterService"
         ],
         "summary": "List returns list of clusters",
-        "operationId": "ListMixin5",
+        "operationId": "ListMixin1",
         "parameters": [
           {
             "type": "string",
@@ -1189,7 +1189,7 @@
           "ClusterService"
         ],
         "summary": "Create creates a cluster",
-        "operationId": "CreateMixin5",
+        "operationId": "CreateMixin1",
         "parameters": [
           {
             "name": "body",
@@ -1216,7 +1216,7 @@
           "ClusterService"
         ],
         "summary": "Update updates a cluster",
-        "operationId": "UpdateMixin5",
+        "operationId": "Update",
         "parameters": [
           {
             "type": "string",
@@ -1250,7 +1250,7 @@
           "ClusterService"
         ],
         "summary": "Get returns a cluster by server address",
-        "operationId": "GetMixin5",
+        "operationId": "GetMixin1",
         "parameters": [
           {
             "type": "string",
@@ -1278,7 +1278,7 @@
           "ClusterService"
         ],
         "summary": "Delete deletes a cluster",
-        "operationId": "DeleteMixin5",
+        "operationId": "DeleteMixin1",
         "parameters": [
           {
             "type": "string",
@@ -1358,7 +1358,7 @@
           "GPGKeyService"
         ],
         "summary": "List all available repository certificates",
-        "operationId": "ListMixin2",
+        "operationId": "List",
         "parameters": [
           {
             "type": "string",
@@ -1381,7 +1381,7 @@
           "GPGKeyService"
         ],
         "summary": "Create one or more GPG public keys in the server's configuration",
-        "operationId": "CreateMixin2",
+        "operationId": "Create",
         "parameters": [
           {
             "description": "Raw key data of the GPG key(s) to create",
@@ -1407,7 +1407,7 @@
           "GPGKeyService"
         ],
         "summary": "Delete specified GPG public key from the server's configuration",
-        "operationId": "DeleteMixin2",
+        "operationId": "Delete",
         "parameters": [
           {
             "type": "string",
@@ -1432,7 +1432,7 @@
           "GPGKeyService"
         ],
         "summary": "Get information about specified GPG public key from the server",
-        "operationId": "GetMixin2",
+        "operationId": "Get",
         "parameters": [
           {
             "type": "string",
@@ -1948,7 +1948,7 @@
           "RepositoryService"
         ],
         "summary": "Get returns a repository or its credentials",
-        "operationId": "Get",
+        "operationId": "GetMixin2",
         "parameters": [
           {
             "type": "string",
@@ -2235,7 +2235,7 @@
           "SettingsService"
         ],
         "summary": "Get returns Argo CD settings",
-        "operationId": "GetMixin8",
+        "operationId": "GetMixin4",
         "responses": {
           "200": {
             "description": "A successful response.",

docs/operator-manual/high_availability.md

@@ -8,13 +8,6 @@ A set HA of manifests are provided for users who wish to run Argo CD in a highly
 
 !!! note
     The HA installation will require at least three different nodes due to pod anti-affinity roles in the specs.
-
-
-In OpenShift clusters, `argocd-redis-ha` service accounts need to be granted `nonroot` Security Context Constraints (SCC) by running the following OpenShift commands which allow Redis containers to run as non-root users.
-```shell
-$ oc adm policy add-scc-to-user nonroot -z argocd-redis-ha
-$ oc adm policy add-scc-to-user nonroot -z argocd-redis-ha-haproxy
-```
 
 ## Scaling Up
 

manifests/ha/base/redis-ha/README.md

@@ -1,8 +1,10 @@
 # Redis HA Manifests
 
 The Redis HA manifests are taken from the upstream helm chart, and tweaked slightly to add
-Argo CD labels.
+Argo CD labels.  We also add roles to redis-ha service accounts to enable run-as non-root users
+in OpenShift.
 * `chart` is a helm chart that references the upstream redis-ha chart. To update redis, update the
   version in `chart/requirements.yaml` with a later version of the chart.
-* `overlays` is a directory containing kustomize overlays for Argo CD, namely label modifications
+* `overlays` is a directory containing kustomize overlays for Argo CD, namely label modifications and
+  role additions.
 * `generate.sh` is a script to regenerate the final kustomize 

manifests/ha/base/redis-ha/kustomization.yaml

@@ -3,6 +3,7 @@ kind: Kustomization
 
 resources:
 - chart/upstream.yaml
+- overlays/redis-haproxy.yaml
 
 patchesJson6902:
 - target:
@@ -33,6 +34,20 @@ patchesJson6902:
     name: argocd-redis-ha
     namespace: argocd
   path: overlays/remove-namespace.yaml
+- target:
+    group: rbac.authorization.k8s.io
+    version: v1
+    kind: Role
+    name: argocd-redis-ha
+    namespace: argocd
+  path: overlays/add-openshift-nonroot-scc.yaml
+- target:
+    group: rbac.authorization.k8s.io
+    version: v1
+    kind: Role
+    name: argocd-redis-haproxy
+    namespace: argocd
+  path: overlays/add-openshift-nonroot-scc.yaml      
 - target:
     group: rbac.authorization.k8s.io
     version: v1

manifests/ha/base/redis-ha/overlays/add-openshift-nonroot-scc.yaml

@@ -0,0 +1,11 @@
+- op: add
+  path: /rules/-
+  value:
+    apiGroups:
+    - security.openshift.io
+    resourceNames:
+    - nonroot
+    resources:
+    - securitycontextconstraints
+    verbs:
+    - use

manifests/ha/base/redis-ha/overlays/redis-haproxy.yaml

@@ -0,0 +1,28 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    app.kubernetes.io/component: redis
+    app.kubernetes.io/name: argocd-redis-haproxy
+    app.kubernetes.io/part-of: argocd
+  name: argocd-redis-haproxy
+  namespace: argocd
+rules: []
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: redis
+    app.kubernetes.io/name: argocd-redis-haproxy
+    app.kubernetes.io/part-of: argocd
+  name: argocd-redis-haproxy
+  namespace: argocd
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: argocd-redis-haproxy
+subjects:
+- kind: ServiceAccount
+  name: argocd-redis-haproxy
+

manifests/ha/install.yaml

@@ -1974,6 +1974,25 @@ metadata:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
+metadata:
+  labels:
+    app.kubernetes.io/component: redis
+    app.kubernetes.io/name: argocd-redis-haproxy
+    app.kubernetes.io/part-of: argocd
+  name: argocd-redis-haproxy
+  namespace: argocd
+rules:
+- apiGroups:
+  - security.openshift.io
+  resourceNames:
+  - nonroot
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - use
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
 metadata:
   labels:
     app.kubernetes.io/component: application-controller
@@ -2045,6 +2064,14 @@ rules:
   - endpoints
   verbs:
   - get
+- apiGroups:
+  - security.openshift.io
+  resourceNames:
+  - nonroot
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - use
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -2142,6 +2169,23 @@ rules:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: redis
+    app.kubernetes.io/name: argocd-redis-haproxy
+    app.kubernetes.io/part-of: argocd
+  name: argocd-redis-haproxy
+  namespace: argocd
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: argocd-redis-haproxy
+subjects:
+- kind: ServiceAccount
+  name: argocd-redis-haproxy
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
 metadata:
   labels:
     app.kubernetes.io/component: application-controller

manifests/ha/namespace-install.yaml

@@ -1974,6 +1974,25 @@ metadata:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
+metadata:
+  labels:
+    app.kubernetes.io/component: redis
+    app.kubernetes.io/name: argocd-redis-haproxy
+    app.kubernetes.io/part-of: argocd
+  name: argocd-redis-haproxy
+  namespace: argocd
+rules:
+- apiGroups:
+  - security.openshift.io
+  resourceNames:
+  - nonroot
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - use
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
 metadata:
   labels:
     app.kubernetes.io/component: application-controller
@@ -2045,6 +2064,14 @@ rules:
   - endpoints
   verbs:
   - get
+- apiGroups:
+  - security.openshift.io
+  resourceNames:
+  - nonroot
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - use
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -2091,6 +2118,23 @@ rules:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: redis
+    app.kubernetes.io/name: argocd-redis-haproxy
+    app.kubernetes.io/part-of: argocd
+  name: argocd-redis-haproxy
+  namespace: argocd
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: argocd-redis-haproxy
+subjects:
+- kind: ServiceAccount
+  name: argocd-redis-haproxy
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
 metadata:
   labels:
     app.kubernetes.io/component: application-controller