Installing ArgoCD on a K8s Cluster using helm_release resource on Terraform.

[mateokurti]

I'm not sure if this is a bug as I assume this is a common thing and would probably have other issues opened if a bug, so I'm starting a discussion instead.

I am trying to install ArgoCD using helm_release resource on Terraform. It works fine, but I am facing an issue when it comes to TLS, which I don't know why is happening as I'm doing everything as described in the README.

So I have the following code in Terraform:

resource "helm_release" "argocd" {
  repository = "https://argoproj.github.io/argo-helm"
  chart      = "argo-cd"
  version    = "5.24.1"

  name      = "argocd"
  namespace = var.namespace

  values = [
    file("${path.module}/configs/helm-values.yaml")
  ]
}

And the helm-values.yaml file as following:

crds:
  keep: false

configs:
  secret:
    argocdServerAdminPassword: "abcdef" # real password is here
  repositories:
    - url: [email protected]:myorganization/myrepo.git
      name: myrepo
      type: git
      sshPrivateKey: abcdef # real private key is here

server:
  certificate:
    enabled: true
    secretName: argocd-server-tls
    domain: argocd.mydomain.com
    issuer:
      group: cert-manager.io
      kind: ClusterIssuer
      name: letsencrypt-prod
  ingress:
    enabled: true
    ingressClassName: nginx
    hosts:
      - argocd.mydomain.com
    tls:
      - secretName: argocd-server-tls
        hosts:
          - argocd.mydomain.com

The ArgoCD is being installed and everything is configured correctly, apart from the argocd-server-tls Secret. It won't be created and I have no idea why.

cert-manager is being installed separately using the following terraform code:

resource "helm_release" "cert_manager" {
  name       = "cert-manager"
  namespace  = kubernetes_namespace.cert_manager.metadata.0.name
  chart      = "cert-manager"
  repository = "https://charts.jetstack.io"
  version    = "v1.11"

  set {
    name  = "installCRDs"
    value = "true"
  }
}

resource "kubectl_manifest" "clusterissuer_letsencrypt_prod" {
  yaml_body          = file("${path.module}/cert-manager/clusterissuer-letsencrypt-prod.yaml")
  override_namespace = kubernetes_namespace.cert_manager.metadata.0.name
  depends_on = [
    helm_release.ingress_nginx,
    helm_release.cert_manager,
  ]
}

What might the issue be?

[pdrastil]

Hi, I would try to investigate what's going on with your cert-manager. The Argo CD values creates Certificate resource which in turn should create argocd-server-tls. Maybe there is something with your configuration of LetEncrypt?

[mateokurti]

Using Lens, on the Certificate created by ArgoCD (argocd-server) I can see the following. It's issuing it with some other name.

[pdrastil]

Ok this is root of your problem. You've created Certificate resource it hasn't updated the secret with TLS information from the provider. Status should be Issued if I remember correctly.

[mateokurti]

Thanks for the help! I had to leave for a few hours and now that I checked it and it was created. I think it needs some time to create the Secret. Another problem I had was with cert-manager. Since I had retried it multiple times, it was refusing the creation of the certificate for the same domain for a few hours, so I had to wait.
If you could confirm that it's normal for it to need some time until the secret is created, then I think this is closed.