Configuring an OpenShift cluster by deploying an application with cluster configurations

In the Administrator perspective of the web console, navigate to Operators → Installed Operators → Red Hat OpenShift GitOps → Subscription.

Click the Actions list and then click Edit Subscription.

On the openshift-gitops-operator Subscription details page, under the YAML tab, edit the Subscription YAML file by adding the namespace of the Argo CD instance to the ARGOCD_CLUSTER_CONFIG_NAMESPACES environment variable in the spec section:

apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: openshift-gitops-operator
  namespace: openshift-gitops-operator
# ...
spec:
  config:
    env:
    - name: ARGOCD_CLUSTER_CONFIG_NAMESPACES
      value: openshift-gitops, <list of namespaces of cluster-scoped Argo CD instances>
# ...

Click Save and Reload.

To verify that the Argo CD instance is configured with a cluster role to manage cluster-scoped resources, perform the following steps:

In the Argo CD dashboard, click NEW APP to add a new Argo CD application.

For this workflow, create a cluster-configs application with the following configurations:

Click CREATE to create your application.

Open the Administrator perspective of the web console and expand Administration → Namespaces.

Search for and select the namespace, then enter argocd.argoproj.io/managed-by=openshift-gitops in the Label field so that the Argo CD instance in the openshift-gitops namespace can manage your namespace.

Download the sample application:

$ git clone git@github.com:redhat-developer/openshift-gitops-getting-started.git

Create the application:

$ oc create -f openshift-gitops-getting-started/argo/app.yaml

Run the oc get command to review the created application:

$ oc get application -n openshift-gitops

Add a label to the namespace your application is deployed in so that the Argo CD instance in the openshift-gitops namespace can manage it:

$ oc label namespace spring-petclinic argocd.argoproj.io/managed-by=openshift-gitops

Get the admin account password for the Argo CD server:

$ ADMIN_PASSWD=$(oc get secret openshift-gitops-cluster -n openshift-gitops -o jsonpath='{.data.admin\.password}' | base64 -d)

Get the Argo CD server URL:

$ SERVER_URL=$(oc get routes openshift-gitops-server -n openshift-gitops -o jsonpath='{.status.ingress[0].host}')

Log in to the Argo CD server by using the admin account password and enclosing it in single quotes:

$ argocd login --username admin --password ${ADMIN_PASSWD} ${SERVER_URL}

$ argocd login --username admin --password '<password>' openshift-gitops.openshift-gitops.apps-crc.testing

Verify that you are able to run argocd commands in the default mode by listing all applications:

$ argocd app list

NAME CLUSTER NAMESPACE  PROJECT  STATUS  HEALTH   SYNCPOLICY  CONDITIONS  REPO PATH TARGET

Create an application in the default mode:

$ argocd app create app-cluster-configs \
    --repo https://github.com/redhat-developer/openshift-gitops-getting-started.git \
    --path cluster \
    --revision main \
    --dest-server  https://kubernetes.default.svc \
    --dest-namespace spring-petclinic \
    --directory-recurse \
    --sync-policy none \
    --sync-option Prune=true \
    --sync-option CreateNamespace=true

Label the spring-petclinic destination namespace to be managed by the openshif-gitops Argo CD instance:

$ oc label ns spring-petclinic "argocd.argoproj.io/managed-by=openshift-gitops"

List the available applications to confirm that the application is created successfully:

$ argocd app list

Log in to the OpenShift Container Platform cluster by using the oc CLI tool:

$ oc login -u <username> -p <password> <server_url>

$ oc login -u kubeadmin -p '<password>' https://api.crc.testing:6443

Check whether the context is set correctly in the kubeconfig file:

$ oc config current-context

Set the default namespace of the current context to openshift-gitops:

$ oc config set-context --current --namespace openshift-gitops

Set the following environment variable to override the Argo CD component names:

$ export ARGOCD_REPO_SERVER_NAME=openshift-gitops-repo-server

Verify that you are able to run argocd commands in core mode by listing all applications:

$ argocd app list --core

NAME CLUSTER NAMESPACE  PROJECT  STATUS  HEALTH   SYNCPOLICY  CONDITIONS  REPO PATH TARGET

Create an application in core mode:

$ argocd app create app-cluster-configs --core \
    --repo https://github.com/redhat-developer/openshift-gitops-getting-started.git \
    --path cluster \
    --revision main \
    --dest-server  https://kubernetes.default.svc \
    --dest-namespace spring-petclinic \
    --directory-recurse \
    --sync-policy none \
    --sync-option Prune=true \
    --sync-option CreateNamespace=true

Label the spring-petclinic destination namespace to be managed by the openshif-gitops Argo CD instance:

$ oc label ns spring-petclinic "argocd.argoproj.io/managed-by=openshift-gitops"

List the available applications to confirm that the application is created successfully:

$ argocd app list --core

In the Argo CD dashboard, notice that the cluster-configs Argo CD application has the statuses Missing and OutOfSync. Because the application was configured with a manual sync policy, Argo CD does not sync it automatically.

Click SYNC on the cluster-configs tile, review the changes, and then click SYNCHRONIZE. Argo CD will detect any changes in the Git repository automatically. If the configurations are changed, Argo CD will change the status of the cluster-configs to OutOfSync. You can modify the synchronization policy for Argo CD to automatically apply changes from your Git repository to the cluster.

Notice that the cluster-configs Argo CD application now has the statuses Healthy and Synced. Click the cluster-configs tile to check the details of the synchronized resources and their status on the cluster.

Navigate to the OpenShift Container Platform web console and click to verify that a link to the Red Hat Developer Blog - Kubernetes is now present there.

Navigate to the Project page and search for the spring-petclinic namespace to verify that it has been added to the cluster.

Get the admin account password for the Argo CD server:

$ ADMIN_PASSWD=$(oc get secret openshift-gitops-cluster -n openshift-gitops -o jsonpath='{.data.admin\.password}' | base64 -d)

Get the Argo CD server URL:

$ SERVER_URL=$(oc get routes openshift-gitops-server -n openshift-gitops -o jsonpath='{.status.ingress[0].host}')

Log in to the Argo CD server by using the admin account password and enclosing it in single quotes:

$ argocd login --username admin --password ${ADMIN_PASSWD} ${SERVER_URL}

$ argocd login --username admin --password '<password>' openshift-gitops.openshift-gitops.apps-crc.testing

Because the application is configured with the none sync policy, you must manually trigger the sync operation:

$ argocd app sync openshift-gitops/app-cluster-configs

List the application to confirm that the application has the Healthy and Synced statuses:

$ argocd app list

Log in to the OpenShift Container Platform cluster by using the oc CLI tool:

$ oc login -u <username> -p <password> <server_url>

$ oc login -u kubeadmin -p '<password>' https://api.crc.testing:6443

Check whether the context is set correctly in the kubeconfig file:

$ oc config current-context

Set the default namespace of the current context to openshift-gitops:

$ oc config set-context --current --namespace openshift-gitops

Set the following environment variable to override the Argo CD component names:

$ export ARGOCD_REPO_SERVER_NAME=openshift-gitops-repo-server

Because the application is configured with the none sync policy, you must manually trigger the sync operation:

$ argocd app sync --core openshift-gitops/app-cluster-configs

List the application to confirm that the application has the Healthy and Synced statuses:

$ argocd app list --core

In the web console, select User Management → Roles → Create Role. Use the following ClusterRole YAML template to add rules to specify the additional permissions.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: secrets-cluster-role
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["*"]

Click Create to add the cluster role.

To create the cluster role binding, select User Management → Role Bindings → Create Binding.

Select All Projects from the Project list.

Click Create binding.

Select Binding type as Cluster-wide role binding (ClusterRoleBinding).

Enter a unique value for the RoleBinding name.

Select the newly created cluster role or an existing cluster role from the drop-down list.

Select the Subject as ServiceAccount and the provide the Subject namespace and name.

Click Create. The YAML file for the ClusterRoleBinding object is as follows:

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: cluster-role-binding
subjects:
  - kind: ServiceAccount
    name: openshift-gitops-argocd-application-controller
    namespace: openshift-gitops
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: secrets-cluster-role