feat: register dieubernetes-stage-do-atl1 with ArgoCD via GitOps - #17
Merged
Conversation
Adds a cluster-registrations chart that renders one ExternalSecret per registered cluster, pulling the precomputed ArgoCD cluster-secret config blob from the 1Password item terraform creates alongside each cluster's dedicated argocd-manager ServiceAccount (see terraform ADR 0003). No argocd CLI step, no admin bearer token - registration is just git + ESO. Wires cluster-registrations into the existing platform appset instead of adding a new one, and tightens that appset's selector to also require argocd-active: "true" so a future second platform peer doesn't get treated as also-active. The live platform cluster's self-registration secret already has that label applied via terraform.
Helm template diffOnly in /tmp/head: cluster-registrations.yaml
diff -u --recursive --label base --label head base head
--- base
+++ head
@@ -218,7 +218,7 @@
app.kubernetes.io/managed-by: Helm
type: Opaque
data:
- SECRET_KEY_BASE: cGl2c0sydWd3b2VDZFYxMmVvTEgxNTh2MjRxeUFlbDR6dnEzUVlXWlVva0hNdXVIOHNxM05IYWs3b01PS05Jc2hMbGRPMk85Uk9tVlRCcWtiZGhXQURXalRu
+ SECRET_KEY_BASE: V1l1cGp0N0oyZmJzZ0hqekFTRVlDc2loOElCYzBTOE1kZTFUTWw3UHBaOHkzQXRkeFJRcFFPMkhxT0JJQzRjakxYVEpVaEVNQnRYMkVkOEJLNGJOTEVwWkpV
TOTP_VAULT_KEY: ZHN4dmJuM2p4RGQxNmF6MlFwc1g1QjhPK2xseGpRMlNKRTJpNUJ6eDM4ST0=
DATABASE_URL: cG9zdGdyZXM6Ly9wb3N0Z3Jlczpwb3N0Z3Jlc0BwbGF1c2libGUtYW5hbHl0aWNzLXBvc3RncmVzcWw6NTQzMi9wbGF1c2libGVfZGI=
CLICKHOUSE_DATABASE_URL: aHR0cDovL2NsaWNraG91c2U6cGFzc3dvcmRAcGxhdXNpYmxlLWFuYWx5dGljcy1jbGlja2hvdXNlOjgxMjMvcGxhdXNpYmxlX2V2ZW50c19kYg== |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a GitOps-managed mechanism to register non-platform workload clusters into ArgoCD using ExternalSecrets/1Password, and wires it into the existing platform ApplicationSet so registration is deployed alongside other platform components.
Changes:
- Introduces a new
cluster-registrationsHelm chart that renders oneExternalSecretper registered cluster, producing ArgoCD cluster secrets. - Adds initial registration values for the stage cluster (
stage-do-atl1) including API server endpoint and 1Password item reference. - Updates the
platformApplicationSet to (a) deploy the new chart and (b) requireargocd-active: "true"on the selected platform cluster.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| charts/platform/cluster-registrations/values.yaml | Defines the list of workload clusters to register and their 1Password item references. |
| charts/platform/cluster-registrations/templates/externalsecret.yaml | Renders ExternalSecret resources that create ArgoCD cluster secrets with purpose labels. |
| charts/platform/cluster-registrations/Chart.yaml | Adds the new Helm chart definition for cluster-registrations. |
| argocd/apps/platform/appset.yaml | Wires cluster-registrations into the platform appset and tightens the platform cluster selector via argocd-active. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+11
to
+13
| clusters: | ||
| - name: stage-do-atl1 | ||
| purpose: stage |
Comment on lines
11
to
16
| - clusters: | ||
| selector: | ||
| matchLabels: | ||
| purpose: platform | ||
| argocd-active: "true" | ||
| - list: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Registers the stage workload cluster with ArgoCD entirely through git + ExternalSecrets — no
argocdCLI, no admin bearer token. See terraform ADR 0003 for the full design.charts/platform/cluster-registrations: one ExternalSecret per registered cluster, pulling a precomputed ArgoCD cluster-secret config blob (bearerToken + CA) from the 1Password item terraform creates alongside each cluster's dedicatedargocd-managerServiceAccount.cluster-registrationsinto the existingplatformappset rather than adding a new one.platformappset's cluster selector to also requireargocd-active: "true", so a future second platform peer (failover) isn't treated as also-active. The live platform cluster's self-registration secret already has this label (applied via terraform).Once this syncs,
dieubernetes-stage-do-atl1should appear as a registered cluster in the ArgoCD UI, and the existingworkloadsappset (purpose in [prod, stage], unchanged) should start generating Applications for mealie/plausible/changedetection on stage.