Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cert-manager installation using argocd #1350

Closed
wants to merge 3 commits into from
Closed

cert-manager installation using argocd #1350

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4afaab4
cert-manager installation using argocd
shahkv95 Nov 25, 2023
4ce05d1
removed unnecessary configurations
shahkv95 Nov 25, 2023
5098cdb
formatting updates for installing cert-manager via argocd
shahkv95 Nov 26, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
138 changes: 138 additions & 0 deletions content/docs/installation/continuous-deployment-and-gitops.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,3 +112,141 @@ Check the cert-manager logs for warnings and errors:
```bash
kubectl logs -n cert-manager -l app.kubernetes.io/instance=cert-manager --prefix --all-containers
```


## Using ArgoCD
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.

### Pre-requisites
Ensure the following are in place before proceeding:
- A Kubernetes cluster
- ArgoCD deployed on the Kubernetes cluster: [installation guide](https://argo-cd.readthedocs.io/en/stable/getting_started/)
- Optional: A GitOps repository connected with ArgoCD: [setup guide](https://argo-cd.readthedocs.io/en/stable/user-guide/private-repositories/)

### Setting up cert-manager
1. Create an ArgoCD Application manifest file with the provided configuration to set up cert-manager.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
1. Create an ArgoCD Application manifest file with the provided configuration to set up cert-manager.
1. Create an [ArgoCD Application manifest file](link-to-reference-documentation) with the provided configuration to set up cert-manager.

It will be useful to link to the documentation so that the reader can learn about the fields of this custom resource.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@wallrj this is not my code/fix BUT i'm currently affected by this.
I will pull this branch and make the suggested edits after my comments below are accepted or better suggestions are made.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks. I don't have permission to push to @shahkv95 's branch, so I've created my own.


```yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: cert-manager
namespace: argocd
annotations:
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
finalizers:
- resources-finalizer.argocd.argoproj.io
wallrj marked this conversation as resolved.
Show resolved Hide resolved
spec:
destination:
namespace: cert-manager
server: https://kubernetes.default.svc
wallrj marked this conversation as resolved.
Show resolved Hide resolved
project: default
source:
chart: cert-manager
repoURL: https://charts.jetstack.io
targetRevision: 1.10.1
wallrj marked this conversation as resolved.
Show resolved Hide resolved
helm:
values: |
installCRDs: true
syncPolicy:
automated:
prune: true
selfHeal: true
wallrj marked this conversation as resolved.
Show resolved Hide resolved
syncOptions:
- CreateNamespace=true
```
2. Commit the manifest file and sync the changes in ArgoCD. If a GitOps repository is not set up, use `kubectl apply -f <above-file-path>` to apply the manifest [installation guide for kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl).
3. ArgoCD will synchronize the `DESIRED MANIFEST` and deploy cert-manager on Kubernetes based on the provided configuration.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Show the reader how they can check the status of the installation.
And explain what the reader should look for to know that the installation has succeeded.



### Troubleshooting

#### Scenario 1:
Out-of-sync cert-manager in the AKS (Azure Kubernetes Service) cluster
wallrj marked this conversation as resolved.
Show resolved Hide resolved

##### Issue:
Cert-manager in the AKS cluster remains out-of-sync due to discrepancies between the `DESIRED MANIFEST` and `LIVE MANIFEST` files.
wallrj marked this conversation as resolved.
Show resolved Hide resolved

##### Potential Reasons
Multiple factors could cause the OutOfSync issue; refer to [ArgoCD documentation](https://argo-cd.readthedocs.io/en/stable/user-guide/diffing/#diffing-customization) for potential causes.
wallrj marked this conversation as resolved.
Show resolved Hide resolved

##### Example configuration differences
The below configurations are observed to be present in the `LIVE MANIFEST` but not in the `DESIRED MANIFEST` file.

```yaml
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
...
webhooks:
- admissionReviewVersions:
namespaceSelector:
matchExpressions:
...
...
- key: control-plane
operator: NotIn
values:
- 'true'
- key: kubernetes.azure.com/managedby
operator: NotIn
values:
- aks
```

##### Root Cause Analysis
The discrepancy stems from how AKS manages admission controllers to protect internal services in the kube-system namespace. More details can be found in [Frequently Asked Questions about Azure Kubernetes Service (AKS)](https://learn.microsoft.com/en-us/azure/aks/faq#can-admission-controller-webhooks-impact-kube-system-and-internal-aks-namespaces)
wallrj marked this conversation as resolved.
Show resolved Hide resolved

##### Suggested Fix
It is also possible to ignore differences from fields owned by specific managers defined in `metadata.managedFields` in live resources. More details can be found in [(ArgoCD) Diffing Customization](https://argo-cd.readthedocs.io/en/stable/user-guide/diffing/#application-level-configuration)

To resolve this issue, modify the cert-manager manifest file under spec to ignore specific differences:
```
ignoreDifferences:
- group: admissionregistration.k8s.io
kind: ValidatingWebhookConfiguration
name: cert-manager-webhook
jqPathExpressions:
- .webhooks[].namespaceSelector.matchExpressions[] | select(.key == "control-plane")
- .webhooks[].namespaceSelector.matchExpressions[] | select(.key == "kubernetes.azure.com/managedby")
```

In that case, the updated cert-manager manifest would be as follows:

```yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: cert-manager
namespace: argocd
annotations:
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
finalizers:
- resources-finalizer.argocd.argoproj.io
spec:
destination:
namespace: cert-manager
server: https://kubernetes.default.svc
project: default
source:
chart: cert-manager
repoURL: https://charts.jetstack.io
targetRevision: 1.10.1
wallrj marked this conversation as resolved.
Show resolved Hide resolved
helm:
values: |
installCRDs: true
ignoreDifferences:
- group: admissionregistration.k8s.io
kind: ValidatingWebhookConfiguration
name: cert-manager-webhook
jqPathExpressions:
- .webhooks[].namespaceSelector.matchExpressions[] | select(.key == "control-plane")
- .webhooks[].namespaceSelector.matchExpressions[] | select(.key == "kubernetes.azure.com/managedby")
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
```

Once ArgoCD syncs the updated manifest, the differences due to the above two keys will be ignored, and cert-manager will be in a complete synchronization state.
Loading