Skip to content

Commit 68da149

Browse files
simusimu
authored
Merge pull request #200 from projectsyn/fix/refresh-tls-secret
Deploy cronjob which periodically refreshes the `syn-argocd-tls` secret
2 parents 358488e + 3e39695 commit 68da149

File tree

5 files changed

+460
-0
lines changed

5 files changed

+460
-0
lines changed

‎component/argocd.jsonnet‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -405,6 +405,85 @@ local webhook_certs = [
405405
},
406406
];
407407

408+
// Manually trigger refresh of ArgoCD TLS certificate. Currently the operator
409+
// will not do anything if it sees that the secret `syn-argocd-tls` exists
410+
// even if the certificate stored in the secret expired or is expiring soon.
411+
local tls_sa = kube.ServiceAccount('syn-argocd-tls-refresher') {
412+
metadata+: {
413+
namespace: params.namespace,
414+
},
415+
};
416+
local tls_role = kube.Role('syn-argocd-tls-refresher') {
417+
metadata+: {
418+
namespace: params.namespace,
419+
},
420+
rules: [ {
421+
apiGroups: [ '' ],
422+
resources: [ 'secrets' ],
423+
verbs: [ 'delete' ],
424+
resourceNames: [
425+
'syn-argocd-tls',
426+
'syn-argocd-ca',
427+
],
428+
} ],
429+
};
430+
local tls_rolebinding = kube.RoleBinding('syn-argocd-tls-refresher') {
431+
metadata+: {
432+
namespace: params.namespace,
433+
},
434+
subjects_: [ tls_sa ],
435+
roleRef_: tls_role,
436+
};
437+
local tls_cronjob =
438+
local homedir = '/home/refresh';
439+
kube.CronJob('syn-argocd-tls-refresher') {
440+
metadata+: {
441+
namespace: params.namespace,
442+
},
443+
spec+: {
444+
failedJobsHistoryLimit: 3,
445+
// At 09:00 on the first day of the month every 4th month.
446+
schedule: '0 9 1 */4 *',
447+
jobTemplate+: {
448+
spec+: {
449+
template+: {
450+
spec+: {
451+
containers_: {
452+
refresh: kube.Container('refresh') {
453+
image: common.render_image('kubectl'),
454+
command: [
455+
'kubectl',
456+
'delete',
457+
'secret',
458+
'syn-argocd-tls',
459+
'syn-argocd-ca',
460+
],
461+
env_: {
462+
HOME: homedir,
463+
},
464+
volumeMounts_+: {
465+
home: { mountPath: homedir },
466+
},
467+
},
468+
},
469+
serviceAccountName: tls_sa.metadata.name,
470+
volumes_+: {
471+
home: { emptyDir: {} },
472+
},
473+
},
474+
},
475+
},
476+
},
477+
},
478+
};
479+
480+
local tls_refresh = [
481+
tls_sa,
482+
tls_role,
483+
tls_rolebinding,
484+
tls_cronjob,
485+
];
486+
408487
{
409488
'00_vault_agent_config': vault_agent_config,
410489
'00_kapitan_plugin_config': kapitan_plugin_config,
@@ -415,4 +494,5 @@ local webhook_certs = [
415494
// as the upstream kustomize is broken.
416495
// 2023/02/19 sfe
417496
[if params.operator.conversion_webhook then '../10_operator_webhook_certs']: webhook_certs,
497+
'10_refresh_argocd_tls': tls_refresh,
418498
}

‎tests/golden/defaults/argocd/argocd/30_argocd/10_refresh_argocd_tls.yaml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
annotations: {}
5+
labels:
6+
name: syn-argocd-tls-refresher
7+
name: syn-argocd-tls-refresher
8+
namespace: syn
9+
---
10+
apiVersion: rbac.authorization.k8s.io/v1
11+
kind: Role
12+
metadata:
13+
annotations: {}
14+
labels:
15+
name: syn-argocd-tls-refresher
16+
name: syn-argocd-tls-refresher
17+
namespace: syn
18+
rules:
19+
- apiGroups:
20+
- ''
21+
resourceNames:
22+
- syn-argocd-tls
23+
- syn-argocd-ca
24+
resources:
25+
- secrets
26+
verbs:
27+
- delete
28+
---
29+
apiVersion: rbac.authorization.k8s.io/v1
30+
kind: RoleBinding
31+
metadata:
32+
annotations: {}
33+
labels:
34+
name: syn-argocd-tls-refresher
35+
name: syn-argocd-tls-refresher
36+
namespace: syn
37+
roleRef:
38+
apiGroup: rbac.authorization.k8s.io
39+
kind: Role
40+
name: syn-argocd-tls-refresher
41+
subjects:
42+
- kind: ServiceAccount
43+
name: syn-argocd-tls-refresher
44+
namespace: syn
45+
---
46+
apiVersion: batch/v1
47+
kind: CronJob
48+
metadata:
49+
annotations: {}
50+
labels:
51+
name: syn-argocd-tls-refresher
52+
name: syn-argocd-tls-refresher
53+
namespace: syn
54+
spec:
55+
concurrencyPolicy: Forbid
56+
failedJobsHistoryLimit: 3
57+
jobTemplate:
58+
spec:
59+
completions: 1
60+
parallelism: 1
61+
template:
62+
metadata:
63+
labels:
64+
name: syn-argocd-tls-refresher
65+
spec:
66+
containers:
67+
- args: []
68+
command:
69+
- kubectl
70+
- delete
71+
- secret
72+
- syn-argocd-tls
73+
- syn-argocd-ca
74+
env:
75+
- name: HOME
76+
value: /home/refresh
77+
image: docker.io/bitnami/kubectl
78+
imagePullPolicy: IfNotPresent
79+
name: refresh
80+
ports: []
81+
stdin: false
82+
tty: false
83+
volumeMounts:
84+
- mountPath: /home/refresh
85+
name: home
86+
imagePullSecrets: []
87+
initContainers: []
88+
restartPolicy: OnFailure
89+
serviceAccountName: syn-argocd-tls-refresher
90+
terminationGracePeriodSeconds: 30
91+
volumes:
92+
- emptyDir: {}
93+
name: home
94+
schedule: 0 9 1 */4 *
95+
successfulJobsHistoryLimit: 10

‎tests/golden/openshift/argocd/argocd/30_argocd/10_refresh_argocd_tls.yaml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
annotations: {}
5+
labels:
6+
name: syn-argocd-tls-refresher
7+
name: syn-argocd-tls-refresher
8+
namespace: syn
9+
---
10+
apiVersion: rbac.authorization.k8s.io/v1
11+
kind: Role
12+
metadata:
13+
annotations: {}
14+
labels:
15+
name: syn-argocd-tls-refresher
16+
name: syn-argocd-tls-refresher
17+
namespace: syn
18+
rules:
19+
- apiGroups:
20+
- ''
21+
resourceNames:
22+
- syn-argocd-tls
23+
- syn-argocd-ca
24+
resources:
25+
- secrets
26+
verbs:
27+
- delete
28+
---
29+
apiVersion: rbac.authorization.k8s.io/v1
30+
kind: RoleBinding
31+
metadata:
32+
annotations: {}
33+
labels:
34+
name: syn-argocd-tls-refresher
35+
name: syn-argocd-tls-refresher
36+
namespace: syn
37+
roleRef:
38+
apiGroup: rbac.authorization.k8s.io
39+
kind: Role
40+
name: syn-argocd-tls-refresher
41+
subjects:
42+
- kind: ServiceAccount
43+
name: syn-argocd-tls-refresher
44+
namespace: syn
45+
---
46+
apiVersion: batch/v1
47+
kind: CronJob
48+
metadata:
49+
annotations: {}
50+
labels:
51+
name: syn-argocd-tls-refresher
52+
name: syn-argocd-tls-refresher
53+
namespace: syn
54+
spec:
55+
concurrencyPolicy: Forbid
56+
failedJobsHistoryLimit: 3
57+
jobTemplate:
58+
spec:
59+
completions: 1
60+
parallelism: 1
61+
template:
62+
metadata:
63+
labels:
64+
name: syn-argocd-tls-refresher
65+
spec:
66+
containers:
67+
- args: []
68+
command:
69+
- kubectl
70+
- delete
71+
- secret
72+
- syn-argocd-tls
73+
- syn-argocd-ca
74+
env:
75+
- name: HOME
76+
value: /home/refresh
77+
image: docker.io/bitnami/kubectl
78+
imagePullPolicy: IfNotPresent
79+
name: refresh
80+
ports: []
81+
stdin: false
82+
tty: false
83+
volumeMounts:
84+
- mountPath: /home/refresh
85+
name: home
86+
imagePullSecrets: []
87+
initContainers: []
88+
restartPolicy: OnFailure
89+
serviceAccountName: syn-argocd-tls-refresher
90+
terminationGracePeriodSeconds: 30
91+
volumes:
92+
- emptyDir: {}
93+
name: home
94+
schedule: 0 9 1 */4 *
95+
successfulJobsHistoryLimit: 10

‎tests/golden/params/argocd/argocd/30_argocd/10_refresh_argocd_tls.yaml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
annotations: {}
5+
labels:
6+
name: syn-argocd-tls-refresher
7+
name: syn-argocd-tls-refresher
8+
namespace: syn
9+
---
10+
apiVersion: rbac.authorization.k8s.io/v1
11+
kind: Role
12+
metadata:
13+
annotations: {}
14+
labels:
15+
name: syn-argocd-tls-refresher
16+
name: syn-argocd-tls-refresher
17+
namespace: syn
18+
rules:
19+
- apiGroups:
20+
- ''
21+
resourceNames:
22+
- syn-argocd-tls
23+
- syn-argocd-ca
24+
resources:
25+
- secrets
26+
verbs:
27+
- delete
28+
---
29+
apiVersion: rbac.authorization.k8s.io/v1
30+
kind: RoleBinding
31+
metadata:
32+
annotations: {}
33+
labels:
34+
name: syn-argocd-tls-refresher
35+
name: syn-argocd-tls-refresher
36+
namespace: syn
37+
roleRef:
38+
apiGroup: rbac.authorization.k8s.io
39+
kind: Role
40+
name: syn-argocd-tls-refresher
41+
subjects:
42+
- kind: ServiceAccount
43+
name: syn-argocd-tls-refresher
44+
namespace: syn
45+
---
46+
apiVersion: batch/v1
47+
kind: CronJob
48+
metadata:
49+
annotations: {}
50+
labels:
51+
name: syn-argocd-tls-refresher
52+
name: syn-argocd-tls-refresher
53+
namespace: syn
54+
spec:
55+
concurrencyPolicy: Forbid
56+
failedJobsHistoryLimit: 3
57+
jobTemplate:
58+
spec:
59+
completions: 1
60+
parallelism: 1
61+
template:
62+
metadata:
63+
labels:
64+
name: syn-argocd-tls-refresher
65+
spec:
66+
containers:
67+
- args: []
68+
command:
69+
- kubectl
70+
- delete
71+
- secret
72+
- syn-argocd-tls
73+
- syn-argocd-ca
74+
env:
75+
- name: HOME
76+
value: /home/refresh
77+
image: docker.io/bitnami/kubectl
78+
imagePullPolicy: IfNotPresent
79+
name: refresh
80+
ports: []
81+
stdin: false
82+
tty: false
83+
volumeMounts:
84+
- mountPath: /home/refresh
85+
name: home
86+
imagePullSecrets: []
87+
initContainers: []
88+
restartPolicy: OnFailure
89+
serviceAccountName: syn-argocd-tls-refresher
90+
terminationGracePeriodSeconds: 30
91+
volumes:
92+
- emptyDir: {}
93+
name: home
94+
schedule: 0 9 1 */4 *
95+
successfulJobsHistoryLimit: 10

0 commit comments

Comments
 (0)