[argocd] how to manage appset token secret

[jkleinlercher]

initial problem

an scm applicationset needs a secret with a github PAT refernced in tokenRef https://github.com/suxess-it/sx-cnp-oss/blob/main/platform-apps/charts/team-onboarding/templates/appset-scm-multi-stage-kargo.yaml#L18

Otherwise (when accessing github unauthenticated) we immediatly get a "rate limit" error:

{"message":"API rate limit exceeded for 91.115.241.173. (But here's the good news: Authenticated requests get a higher rate limit. Check out the documentation for more details.)","documentation_url":"https://docs.github.com/rest/overview/resources-in-the-rest-api#rate-limiting"}

there are also other issues talking about this problem: argoproj/argo-cd#9413

reason: the argocd ScmProvider for github first collects ALL repos in this organization and then applies the filters internally.

workaround

Putting this token in the gitops repo is not secure AND github automatically revokes this token if it recognizes this value in a commit.
So we will put this token in the https://github.com/suxess-it/sx-cnp-oss/blob/9c1b83cfd02f4dbbe8d5fc05c9ba4353ce2f81c5/install-platform.sh#L56-L61 as a workaround.
In the github workflow we set the variable to https://github.com/suxess-it/sx-cnp-oss/blob/9c1b83cfd02f4dbbe8d5fc05c9ba4353ce2f81c5/.github/workflows/cluster-test.yml#L53

chicken-egg-problem

However, the problem is that we then need to know the team app-definitions namespaces upfront. It may be okay for this demo, but how to manage this in real live with new teams onboarding? chicken-egg-problem because the namespace -apps gets created when onboarding the team, then automatically the appset gets created which already expects the secret to exist in this -apps .. is there also a central place for this secret for applicationsets? --> need to open argocd issue

with external-secrets we can reevaluate a sustainable solution

[jkleinlercher]

with appSecretName we should be able to reference a GitHub App to access the API instead .. don't know where this secret needs to be placed.

[phac008]

The initialization secrets can be stored in vault via rest api call during installation, afterwards flexible usage within gitops with eso.
I will implement this.

[phac008]

move token to vault:
#616