-
Notifications
You must be signed in to change notification settings - Fork 5.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(14638): Set managed-by label on installed resources (Alpha) #14945
base: master
Are you sure you want to change the base?
Conversation
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #14945 +/- ##
==========================================
- Coverage 49.57% 49.52% -0.05%
==========================================
Files 273 269 -4
Lines 48314 47025 -1289
==========================================
- Hits 23951 23291 -660
+ Misses 22000 21449 -551
+ Partials 2363 2285 -78 ☔ View full report in Codecov by Sentry. |
I think that if the user has opted in to use this feature, the label should be set always. If the label already exists with another value, overwrite it!
|
@@ -61,6 +61,8 @@ spec: | |||
namespace: guestbook | |||
``` | |||
|
|||
By default, all resources are generated with label `app.kubernetes.io/managed-by: argocd`. Current Status: Alpha (Since v2.8.0) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think it would be a good idea to have this be opt-in rather than changing the default. That will make it a lot easier to merge, since it wouldn't be a breaking change.
reposerver/repository/repository.go
Outdated
if labels == nil { | ||
labels = make(map[string]string, 1) | ||
} | ||
if labels["app.kubernetes.io/managed-by"] == "" { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In the case of Helm applications app.kubernetes.io/managed-by
will be Helm
, even though de-facto it is Argo CD that is doing the management. I'm not sure what the right thing to do is here tbh. Either Argo CD should overwrite it and set argocd
, or leave as-is. 🤔
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I like what @lindhe suggested with making this opt-in. Other than making this PR a non-breaking change, anybody who uses this feature in the future will know what's going on because they will explicitly choose to use it.
This way, I feel like maintainers who want to be able to filter their k8s resources by ones managed by argo will want managed-by: helm
to be overwritten with argocd
.
Thoughts?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, exactly why I think we should have this as an opt-in! If we can offload this design choice to the users, it's all for the better.
Apart from the issue above it generally LGTM 👍 It'd also be good to add an E2E test that checks that this label is set for all manifests managed by an application. |
How hard would it be to make this enforced on a project level (i.e. "set this label for all resources deployed by applications in project x")? |
I am assuming we are adding our new option to argocd-repo-server? If so, I believe your suggestion is more than doable. I would go an extra mile and let users add multiple projects e.g. Do you think this is too tedious? If so, is it good or legit practice in these situations to interpret an empty array as "Write this label on all of my projects"? |
Great to hear! It is my opinion that we should try to get the basic functionality merged first (as on opt-in 😉) and then we create a follow-up PR for making it possible on a project-basis. That keeps things agile and minimal. |
@@ -20,6 +20,7 @@ argocd-repo-server [flags] | |||
-h, --help help for argocd-repo-server | |||
--logformat string Set the logging format. One of: text|json (default "text") | |||
--loglevel string Set the logging level. One of: debug|info|warn|error (default "info") | |||
--managed-by-argo Set managed-by label for every k8s resource generated by argo Current Status: Alpha (Since v2.8.0) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎉
IMO I think this should be all-or-nothing; if we are to have any flags at all then I think Jura's approach is the way to go. At some point in the future this should be the default for all manifests managed by Argo CD. |
I need help figuring out what happened with this test
Can you point me to the bit of code which creates a new argocd repo server in e2e test setup or where the new flag can be set for an already existing repo server which these tests use? |
I think you'll need to run |
Yeah this one is a bit tricky 😄 You'd need to do something like the following:
|
@@ -212,6 +214,7 @@ func NewCommand() *cobra.Command { | |||
command.Flags().BoolVar(&allowOutOfBoundsSymlinks, "allow-oob-symlinks", env.ParseBoolFromEnv("ARGOCD_REPO_SERVER_ALLOW_OUT_OF_BOUNDS_SYMLINKS", false), "Allow out-of-bounds symlinks in repositories (not recommended)") | |||
command.Flags().StringVar(&streamedManifestMaxTarSize, "streamed-manifest-max-tar-size", env.StringFromEnv("ARGOCD_REPO_SERVER_STREAMED_MANIFEST_MAX_TAR_SIZE", "100M"), "Maximum size of streamed manifest archives") | |||
command.Flags().StringVar(&streamedManifestMaxExtractedSize, "streamed-manifest-max-extracted-size", env.StringFromEnv("ARGOCD_REPO_SERVER_STREAMED_MANIFEST_MAX_EXTRACTED_SIZE", "1G"), "Maximum size of streamed manifest archives when extracted") | |||
command.Flags().BoolVar(&managedByArgo, "managed-by-argo", env.ParseBoolFromEnv("ARGOCD_REPO_SERVER_MANAGED_BY_ARGO", false), "Set managed-by label for every k8s resource generated by argo") |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If you want Current Status: Alpha (Since v2.8.0)
you'd have to add it here and run make codegen
, so that the docs matches what is in the command.
You could also attempt to add the exact same string in docs/operator-manual/server-commands/argocd-repo-server.md
without running make codegen
, but if they differ you'll bump into the same issue as previously.
I'm having trouble writing the e2e test and/or setting up test infrastructure to support the new env variable. Can someone take a look? |
Seems like you're doing everything right @jmilic1. I took a look at |
Looking at all the uses of doSomething(){
if fixture.IsLocal(){
...
} else {
fixture.RestartRepoServer()
}
} It seems to me like This way, tests complete no matter if you are running the environment locally or remotely. |
@jmilic1 I think the |
@blakepettersson I think I did what you mentioned, but it's still failing. Can you take a look? |
Bump for the this. Not sure what to do to correct e2e tests |
@jmilic1 sorry about the delay, I'm on paternity leave so I haven't had much focus re: Argo CD. I took a look anyways and the E2E test are indeed run with Goreman instead of k8s. A workaround for this is to instead set the variable through the When I did that locally I got this:
|
Add this line in the
|
Signed-off-by: djerfy <[email protected]> Signed-off-by: jmilic1 <[email protected]>
* chore: update gitops engine version Signed-off-by: pashakostohrys <[email protected]> * chore: update gitops engine version Signed-off-by: pashakostohrys <[email protected]> --------- Signed-off-by: pashakostohrys <[email protected]> Signed-off-by: jmilic1 <[email protected]>
Signed-off-by: Kazakov Stepan <[email protected]> Signed-off-by: jmilic1 <[email protected]>
…link to `../faq.md#why-is-my-app-out-of-sync-even-after-syncing` (argoproj#16236) The broken link is visible in https://argo-cd.readthedocs.io/en/stable/user-guide/annotations-and-labels/#labels Signed-off-by: Alexey Vazhnov <[email protected]> Signed-off-by: jmilic1 <[email protected]>
…rgoproj#16222) * fix(16207): Fix name conflict in appset controller Signed-off-by: gmuselli <[email protected]> * fix(16207): e2e Signed-off-by: gmuselli <[email protected]> * Update test/e2e/fixture/applicationsets/utils/fixture.go Signed-off-by: Ishita Sequeira <[email protected]> --------- Signed-off-by: gmuselli <[email protected]> Signed-off-by: Ishita Sequeira <[email protected]> Co-authored-by: Ishita Sequeira <[email protected]> Signed-off-by: jmilic1 <[email protected]>
* feat: support components in kustomize Signed-off-by: pashakostohrys <[email protected]> * feat: support components in kustomize Signed-off-by: pashakostohrys <[email protected]> * feat: support components in kustomize Signed-off-by: pashakostohrys <[email protected]> * feat: support components in kustomize Signed-off-by: pashakostohrys <[email protected]> * fix: typo in kustomization word Signed-off-by: pashakostohrys <[email protected]> * fix: typo in kustomization word Signed-off-by: pashakostohrys <[email protected]> * fix: typo in kustomization word Signed-off-by: pashakostohrys <[email protected]> * fix: typo in kustomization word Signed-off-by: pashakostohrys <[email protected]> --------- Signed-off-by: pashakostohrys <[email protected]> Signed-off-by: jmilic1 <[email protected]>
Add Fortra to Official USers Signed-off-by: Alex Jones <[email protected]> Co-authored-by: Ishita Sequeira <[email protected]> Signed-off-by: jmilic1 <[email protected]>
* fix: check for double definition As found in argoproj#13965 (and as a follow-up to argoproj#13999), we also need to define what happens if _both_ managedNamespaceMetadata _and_ an Application manifest are both defined for the same namespace. The idea here is that if that happens, we emit an `ApplicationConditionRepeatedResourceWarning`, and set the sync status to `Unknown`, since it's unclear what is supposed to happen. The user will then have the option of removing one of the two definitions. Signed-off-by: Blake Pettersson <[email protected]> * fix: check for double definition A simpler fix - don't add a managed namespace to the targetObjs list if a namespace already exists in the application source. Signed-off-by: Blake Pettersson <[email protected]> * test: add test cases This adds a test case showing that an ns manifest will override `managedNamespaceMetadata` without failing horribly (as it currently does on `HEAD`), as well as a "standard" mNMd diff vs live. Signed-off-by: Blake Pettersson <[email protected]> --------- Signed-off-by: Blake Pettersson <[email protected]> Signed-off-by: jmilic1 <[email protected]>
Signed-off-by: mikutas <[email protected]> Signed-off-by: jmilic1 <[email protected]>
Signed-off-by: Rafal Pelczar <[email protected]> Signed-off-by: jmilic1 <[email protected]>
I found this being used in an application I was working on but had a hard time discovering its meaning since it wasn't in the specification[1] though it was in the `sync-options` docs[2] (see also baa0f2e) [1] https://argo-cd.readthedocs.io/en/stable/user-guide/application-specification/ [2] https://argo-cd.readthedocs.io/en/stable/user-guide/sync-options/#selective-sync Signed-off-by: Matt Hughes <[email protected]> Signed-off-by: jmilic1 <[email protected]>
…j#12172) (argoproj#15903) * fix(applicationset): prevent app deletion according to appset policy Signed-off-by: mikutas <[email protected]> * test: add unit test Signed-off-by: mikutas <[email protected]> * fix: unit test Signed-off-by: mikutas <[email protected]> * fix: remove TODO Signed-off-by: mikutas <[email protected]> --------- Signed-off-by: mikutas <[email protected]> Signed-off-by: jmilic1 <[email protected]>
Signed-off-by: Noam Gal <[email protected]> Co-authored-by: Ishita Sequeira <[email protected]> Signed-off-by: jmilic1 <[email protected]>
Signed-off-by: Rafal Pelczar <[email protected]> Signed-off-by: jmilic1 <[email protected]>
…maller screens (argoproj#16268) Signed-off-by: Rafal Pelczar <[email protected]> Signed-off-by: jmilic1 <[email protected]>
23ac4b5
to
a3804df
Compare
# Conflicts: # cmd/argocd-repo-server/commands/argocd_repo_server.go # docs/operator-manual/argocd-cmd-params-cm.yaml # manifests/base/repo-server/argocd-repo-server-deployment.yaml # manifests/core-install.yaml # manifests/ha/install.yaml # manifests/ha/namespace-install.yaml # manifests/install.yaml # manifests/namespace-install.yaml # reposerver/repository/repository.go
Signed-off-by: jmilic1 <[email protected]>
Signed-off-by: jmilic1 <[email protected]>
My dudes, I just realized something! In Helm, there are a handful of Built-in Objects. One of them is I do not think we should set It could possibly impact this feature, if for example it becomes an internal struggle between Argo CD trying to apply a Helm chart that sets I'm not sure this makes any sense, it was just a thought that stuck me that I wanted to bring up. |
@jmilic1 and @blakepettersson: I notice this has stalled. Can I help somehow to power through the last bit so we can pass the finish line here? 🙂 |
I am also interested in seeing this to completion for our company. Would be happy to help in any way that I can. |
Signed-off-by: Jura Milić <[email protected]>
@blakepettersson @lindhe @jmilic1 I fixed the checks in this PR. Just trying to get this past the 99% mark. Let me know if this is not proper etiquette or something. |
@lets-call-n-walk Nope, you're good. I failed to see where my code was failing and got overwhelmed from dealing with tests I had to wait on for half an hour. Still, it's my bad for not responding. If you can get your tests working, be my guest on finishing this |
Maybe it would nice to make the value |
Note on DCO:
If the DCO action in the integration test fails, one or more of your commits are not signed off. Please click on the Details link next to the DCO action for instructions on how to resolve this.
app.kubernetes.io/managed-by
label to all resources #14638app.kubernetes.io/managed-by
label set. Kubernetes recommends having multiple labels on resources, one of which is themanaged-by
label. If the new resource does not have the label set, it should now default toargocd
.Checklist:
Please see Contribution FAQs if you have questions about your pull-request.