Skip to content

Commit 3944c76

Browse files
pmarkiewkanihussmann
authored and
Thomas Michael
committed
feat: add multi-tenancy support for argocd-operator (#283)
* feat: add multi-tenancy support for argocd-operator - Template service account and resource namespaces using `namePrefix` - Add batch/Job permissions to all RBAC roles - Set argocd.yaml `.spec.server.insecure` when `--insecure` is enabled - Conditionally generate ingress.yaml for insecure mode (non-OpenShift), because argocd-operator always enforces https - Include `batch/Job` in resourceInclusions for operator CR - Prevent creation of empty rendered files when templates are fully conditional - Add tests covering all new conditional and templated logic * feat: add multi-tenancy support for argocd-operator - Cast doc and metadata to Map to satisfy Groovy static type checking - Ensure metadata.namespace is treated as String for AssertJ compatibility --------- Co-authored-by: Niklas Hußmann <niklas.hussmann-extern@cloudogu.com>
1 parent e595bc6 commit 3944c76

File tree

9 files changed

+292
-18
lines changed

9 files changed

+292
-18
lines changed

‎argocd/argocd/operator/argocd.ftl.yaml

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@ spec:
103103
</#list>
104104
</#if>
105105
server:
106+
insecure: ${isInsecure?c}
106107
resources:
107108
limits:
108109
cpu: "500m"
@@ -120,7 +121,42 @@ spec:
120121
route:
121122
enabled: ${isOpenshift?c}
122123
host: "${argocd.host}"
124+
# Enable ingress only if we are not on OpenShift and insecure mode is NOT enabled.
125+
# Note: When insecure mode is enabled, forced HTTP redirect to HTTPS cannot be disabled here(likely due to a bug),
126+
# so we cannot use this ingress for insecure mode. For insecure mode we use a separate file (ingress.ftl.yaml).
127+
ingress:
128+
enabled: ${((!isOpenshift) && (!isInsecure))?c}
129+
initialRepositories: |
130+
- name: argocd
131+
url: ${scmm.repoUrl}argocd/argocd<#if scmm.provider == "gitlab">.git</#if>
132+
- name: example-apps
133+
url: ${scmm.repoUrl}argocd/example-apps<#if scmm.provider == "gitlab">.git</#if>
134+
- name: cluster-resources
135+
url: ${scmm.repoUrl}argocd/cluster-resources<#if scmm.provider == "gitlab">.git</#if>
136+
- name: nginx-helm-jenkins
137+
url: ${scmm.repoUrl}argocd/nginx-helm-jenkins<#if scmm.provider == "gitlab">.git</#if>
138+
- name: nginx-helm-umbrella
139+
url: ${scmm.repoUrl}argocd/nginx-helm-umbrella<#if scmm.provider == "gitlab">.git</#if>
140+
- name: bitnami
141+
type: helm
142+
url: https://raw.githubusercontent.com/bitnami/charts/archive-full-index/bitnami
143+
- name: prometheus-community
144+
type: helm
145+
url: https://prometheus-community.github.io/helm-charts
146+
- name: codecentric
147+
type: helm
148+
url: https://codecentric.github.io/helm-charts
149+
- name: ingress-nginx
150+
type: helm
151+
url: https://kubernetes.github.io/ingress-nginx
123152
resourceInclusions: |
153+
- apiGroups:
154+
- "batch"
155+
kinds:
156+
- "Job"
157+
clusters:
158+
- "https://kubernetes.default.svc"
159+
- "${argocd.resourceInclusionsCluster}"
124160
- apiGroups:
125161
- ""
126162
kinds:

‎argocd/argocd/operator/ingress.ftl.yaml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<#if (!isOpenshift && isInsecure)>
2+
apiVersion: networking.k8s.io/v1
3+
kind: Ingress
4+
metadata:
5+
name: argocd
6+
namespace: "${namePrefix}argocd"
7+
labels:
8+
app: argocd-server
9+
annotations:
10+
nginx.ingress.kubernetes.io/ssl-redirect: "false"
11+
nginx.ingress.kubernetes.io/force-ssl-redirect: "false"
12+
spec:
13+
rules:
14+
- host: "${argocd.host}"
15+
http:
16+
paths:
17+
- path: /
18+
pathType: Prefix
19+
backend:
20+
service:
21+
name: argocd-server
22+
port:
23+
number: 80
24+
</#if>
25+

‎argocd/argocd/operator/rbac/example-apps-production.ftl.yaml

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,18 @@ metadata:
44
namespace: "${namePrefix}example-apps-production"
55
name: argocd
66
rules:
7+
- apiGroups:
8+
- "batch"
9+
resources:
10+
- jobs
11+
verbs:
12+
- create
13+
- delete
14+
- get
15+
- list
16+
- patch
17+
- update
18+
- watch
719
- apiGroups:
820
- "route.openshift.io"
921
resources:
@@ -170,13 +182,13 @@ metadata:
170182
subjects:
171183
- kind: ServiceAccount
172184
name: argocd-argocd-server
173-
namespace: argocd
185+
namespace: "${namePrefix}argocd"
174186
- kind: ServiceAccount
175187
name: argocd-argocd-application-controller
176-
namespace: argocd
188+
namespace: "${namePrefix}argocd"
177189
- kind: ServiceAccount
178190
name: argocd-applicationset-controller
179-
namespace: argocd
191+
namespace: "${namePrefix}argocd"
180192
roleRef:
181193
kind: Role
182194
name: argocd

‎argocd/argocd/operator/rbac/example-apps-staging.ftl.yaml

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,18 @@ metadata:
44
namespace: "${namePrefix}example-apps-staging"
55
name: argocd
66
rules:
7+
- apiGroups:
8+
- "batch"
9+
resources:
10+
- jobs
11+
verbs:
12+
- create
13+
- delete
14+
- get
15+
- list
16+
- patch
17+
- update
18+
- watch
719
- apiGroups:
820
- "route.openshift.io"
921
resources:
@@ -170,13 +182,13 @@ metadata:
170182
subjects:
171183
- kind: ServiceAccount
172184
name: argocd-argocd-server
173-
namespace: argocd
185+
namespace: "${namePrefix}argocd"
174186
- kind: ServiceAccount
175187
name: argocd-argocd-application-controller
176-
namespace: argocd
188+
namespace: "${namePrefix}argocd"
177189
- kind: ServiceAccount
178190
name: argocd-applicationset-controller
179-
namespace: argocd
191+
namespace: "${namePrefix}argocd"
180192
roleRef:
181193
kind: Role
182194
name: argocd

‎argocd/argocd/operator/rbac/ingress-nginx.ftl.yaml

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,18 @@ metadata:
44
namespace: "${namePrefix}ingress-nginx"
55
name: argocd
66
rules:
7+
- apiGroups:
8+
- "batch"
9+
resources:
10+
- jobs
11+
verbs:
12+
- create
13+
- delete
14+
- get
15+
- list
16+
- patch
17+
- update
18+
- watch
719
- apiGroups:
820
- "route.openshift.io"
921
resources:
@@ -170,13 +182,13 @@ metadata:
170182
subjects:
171183
- kind: ServiceAccount
172184
name: argocd-argocd-server
173-
namespace: argocd
185+
namespace: "${namePrefix}argocd"
174186
- kind: ServiceAccount
175187
name: argocd-argocd-application-controller
176-
namespace: argocd
188+
namespace: "${namePrefix}argocd"
177189
- kind: ServiceAccount
178190
name: argocd-applicationset-controller
179-
namespace: argocd
191+
namespace: "${namePrefix}argocd"
180192
roleRef:
181193
kind: Role
182194
name: argocd

‎argocd/argocd/operator/rbac/monitoring.ftl.yaml

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,18 @@ metadata:
44
namespace: "${namePrefix}monitoring"
55
name: argocd
66
rules:
7+
- apiGroups:
8+
- "batch"
9+
resources:
10+
- jobs
11+
verbs:
12+
- create
13+
- delete
14+
- get
15+
- list
16+
- patch
17+
- update
18+
- watch
719
- apiGroups:
820
- "route.openshift.io"
921
resources:
@@ -170,13 +182,13 @@ metadata:
170182
subjects:
171183
- kind: ServiceAccount
172184
name: argocd-argocd-server
173-
namespace: argocd
185+
namespace: "${namePrefix}argocd"
174186
- kind: ServiceAccount
175187
name: argocd-argocd-application-controller
176-
namespace: argocd
188+
namespace: "${namePrefix}argocd"
177189
- kind: ServiceAccount
178190
name: argocd-applicationset-controller
179-
namespace: argocd
191+
namespace: "${namePrefix}argocd"
180192
roleRef:
181193
kind: Role
182194
name: argocd

‎argocd/argocd/operator/rbac/secrets.ftl.yaml

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,18 @@ metadata:
44
namespace: "${namePrefix}secrets"
55
name: argocd
66
rules:
7+
- apiGroups:
8+
- "batch"
9+
resources:
10+
- jobs
11+
verbs:
12+
- create
13+
- delete
14+
- get
15+
- list
16+
- patch
17+
- update
18+
- watch
719
- apiGroups:
820
- "route.openshift.io"
921
resources:
@@ -170,13 +182,13 @@ metadata:
170182
subjects:
171183
- kind: ServiceAccount
172184
name: argocd-argocd-server
173-
namespace: argocd
185+
namespace: "${namePrefix}argocd"
174186
- kind: ServiceAccount
175187
name: argocd-argocd-application-controller
176-
namespace: argocd
188+
namespace: "${namePrefix}argocd"
177189
- kind: ServiceAccount
178190
name: argocd-applicationset-controller
179-
namespace: argocd
191+
namespace: "${namePrefix}argocd"
180192
roleRef:
181193
kind: Role
182194
name: argocd

‎src/main/groovy/com/cloudogu/gitops/utils/TemplatingEngine.groovy

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,17 @@ class TemplatingEngine {
2222
*/
2323
File replaceTemplate(File templateFile, Map parameters) {
2424
def targetFile = new File(templateFile.toString().replace(".ftl", ""))
25-
26-
template(templateFile, targetFile, parameters)
25+
def rendered = template(templateFile, parameters)
26+
27+
// Only write file if template has non-empty output.
28+
// This avoids creating empty files when the entire template is skipped via <#if>.
29+
if (rendered?.trim()) {
30+
targetFile.text = rendered
31+
} else {
32+
targetFile.delete()
33+
}
2734

2835
templateFile.delete()
29-
3036
return targetFile
3137
}
3238

0 commit comments

Comments
 (0)