chore(argo-cd)!: Remove apps, appprojs and deprecated features (#1417)

* feat(argo-cd): move server additionalApplications/additionalProjects to argocd-apps chart
Signed-off-by: yu-croco <yuki.kita22@gmail.com>

* Remove deprecated features
Signed-off-by: Petr Drastil <petr.drastil@gmail.com>

* chore(argo-cd): improve release note
Signed-off-by: yu-croco <yu.croco@gmail.com>

Co-authored-by: yu-croco <yuki.kita22@gmail.com>
Co-authored-by: Petr Drastil <petr.drastil@gmail.com>

charts/argo-cd/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 appVersion: v2.4.11
 description: A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.
 name: argo-cd
-version: 4.10.9
+version: 5.0.0
 home: https://github.com/argoproj/argo-helm
 icon: https://argo-cd.readthedocs.io/en/stable/assets/logo.png
 keywords:
@@ -21,4 +21,6 @@ dependencies:
     condition: redis-ha.enabled
 annotations:
   artifacthub.io/changes: |
-    - "[Changed]: Update to app version 2.4.11"
+    - "[Removed]: Legacy support to run controller as a Deployment"
+    - "[Removed]: Legacy support to use old format of repository secrets"
+    - "[Removed]: Parameters server.additionalApplications and server.additionalProjects are moved to a separate chart - argocd-apps"

charts/argo-cd/README.md

@@ -98,6 +98,92 @@ kubectl apply -k "https://github.com/argoproj/argo-cd/manifests/crds?ref=<appVer
 kubectl apply -k "https://github.com/argoproj/argo-cd/manifests/crds?ref=v2.4.9"
 ```
 
+### 5.0.0
+
+This version **removes support for**:
+
+- deprecated repository credentials (parameter `configs.repositoryCredentials`)
+- option to run application controller as a Deployment
+- the parameters `server.additionalApplications` and `server.additionalProjects`
+
+Please carefully read the following section if you are using these parameters!
+
+In order to upgrade Applications and Projects safely against CRDs' upgrade, `server.additionalApplications` and `server.additionalProjects` are moved to [argocd-apps](../argocd-apps).
+
+If you are using `server.additionalApplications` or `server.additionalProjects`, you can adopt to [argocd-apps](../argocd-apps) as below:
+
+1. Add [helm.sh/resource-policy annotation](https://helm.sh/docs/howto/charts_tips_and_tricks/#tell-helm-not-to-uninstall-a-resource) to avoid resources being removed by upgrading Helm chart
+
+You can keep your existing CRDs by adding `"helm.sh/resource-policy": keep` on `additionalAnnotations`, under `server.additionalApplications` and `server.additionalProjects` blocks, and running `helm upgrade`.
+
+e.g:
+
+```yaml
+server:
+  additionalApplications:
+    - name: guestbook
+      namespace: argocd
+      additionalLabels: {}
+      additionalAnnotations:
+        "helm.sh/resource-policy": keep # <-- add this
+      finalizers:
+      - resources-finalizer.argocd.argoproj.io
+      project: guestbook
+      source:
+        repoURL: https://github.com/argoproj/argocd-example-apps.git
+        targetRevision: HEAD
+        path: guestbook
+        directory:
+          recurse: true
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: guestbook
+      syncPolicy:
+        automated:
+          prune: false
+          selfHeal: false
+      ignoreDifferences:
+      - group: apps
+        kind: Deployment
+        jsonPointers:
+        - /spec/replicas
+      info:
+      - name: url
+        value: https://argoproj.github.io/
+```
+
+You can also keep your existing CRDs by running the following scripts.
+
+```bash
+# keep Applications
+for app in "guestbook"; do
+  kubectl annotate --overwrite application $app helm.sh/resource-policy=keep
+done
+
+# keep Projects
+for project in "guestbook"; do
+  kubectl annotate --overwrite appproject $project helm.sh/resource-policy=keep
+done
+```
+
+2. Upgrade argo-cd Helm chart to v5.0.0
+
+3. Remove keep [helm.sh/resource-policy annotation](https://helm.sh/docs/howto/charts_tips_and_tricks/#tell-helm-not-to-uninstall-a-resource)
+
+```bash
+# delete annotations from Applications
+for app in "guestbook"; do
+  kubectl annotate --overwrite application $app helm.sh/resource-policy-
+done
+
+# delete annotations from Projects
+for project in "guestbook"; do
+  kubectl annotate --overwrite appproject $project helm.sh/resource-policy-
+done
+```
+
+4. Adopt existing resources to [argocd-apps](../argocd-apps)
+
 ### 4.9.0
 
 This version starts to use upstream image with applicationset binary. Start command was changed from `applicationset-controller` to `argocd-applicationset-controller`
@@ -236,8 +322,6 @@ NAME: my-release
 | kubeVersionOverride | string | `""` | Override the Kubernetes version, which is used to evaluate certain manifests |
 | nameOverride | string | `"argocd"` | Provide a name in place of `argocd` |
 | openshift.enabled | bool | `false` | enables using arbitrary uid for argo repo server |
-| server.additionalApplications | list | `[]` (See [values.yaml]) | Deploy Argo CD Applications within this helm release |
-| server.additionalProjects | list | `[]` (See [values.yaml]) | Deploy Argo CD Projects within this helm release |
 
 ## Argo CD Configs
 
@@ -252,7 +336,6 @@ NAME: my-release
 | configs.knownHostsAnnotations | object | `{}` | Known Hosts configmap annotations |
 | configs.repositories | object | `{}` | Repositories list to be used by applications |
 | configs.repositoriesAnnotations | object | `{}` | Annotations to be added to `configs.repositories` Secret |
-| configs.repositoryCredentials | object | `{}` | *DEPRECATED:* Instead, use `configs.credentialTemplates` and/or `configs.repositories` |
 | configs.secret.annotations | object | `{}` | Annotations to be added to argocd-secret |
 | configs.secret.argocdServerAdminPassword | string | `""` | Bcrypt hashed admin password |
 | configs.secret.argocdServerAdminPasswordMtime | string | `""` (defaults to current time) | Admin password modification time. Eg. `"2006-01-02T15:04:05Z"` |
@@ -283,7 +366,6 @@ NAME: my-release
 | controller.clusterRoleRules.rules | list | `[]` | List of custom rules for the application controller's ClusterRole resource |
 | controller.containerPort | int | `8082` | Application controller listening port |
 | controller.containerSecurityContext | object | `{}` | Application controller container-level security context |
-| controller.enableStatefulSet | bool | `true` | Deploy the application controller as a StatefulSet instead of a Deployment, this is required for HA capability. |
 | controller.env | list | `[]` | Environment variables to pass to application controller |
 | controller.envFrom | list | `[]` (See [values.yaml]) | envFrom to pass to application controller |
 | controller.extraArgs | list | `[]` | Additional command line arguments to pass to application controller |

charts/argo-cd/README.md.gotmpl

@@ -98,6 +98,92 @@ kubectl apply -k "https://github.com/argoproj/argo-cd/manifests/crds?ref=<appVer
 kubectl apply -k "https://github.com/argoproj/argo-cd/manifests/crds?ref=v2.4.9"
 ```
 
+### 5.0.0
+
+This version **removes support for**:
+
+- deprecated repository credentials (parameter `configs.repositoryCredentials`)
+- option to run application controller as a Deployment
+- the parameters `server.additionalApplications` and `server.additionalProjects`
+
+Please carefully read the following section if you are using these parameters!
+
+In order to upgrade Applications and Projects safely against CRDs' upgrade, `server.additionalApplications` and `server.additionalProjects` are moved to [argocd-apps](../argocd-apps).
+
+If you are using `server.additionalApplications` or `server.additionalProjects`, you can adopt to [argocd-apps](../argocd-apps) as below:
+
+1. Add [helm.sh/resource-policy annotation](https://helm.sh/docs/howto/charts_tips_and_tricks/#tell-helm-not-to-uninstall-a-resource) to avoid resources being removed by upgrading Helm chart
+
+You can keep your existing CRDs by adding `"helm.sh/resource-policy": keep` on `additionalAnnotations`, under `server.additionalApplications` and `server.additionalProjects` blocks, and running `helm upgrade`.
+
+e.g:
+
+```yaml
+server:
+  additionalApplications:
+    - name: guestbook
+      namespace: argocd
+      additionalLabels: {}
+      additionalAnnotations:
+        "helm.sh/resource-policy": keep # <-- add this
+      finalizers:
+      - resources-finalizer.argocd.argoproj.io
+      project: guestbook
+      source:
+        repoURL: https://github.com/argoproj/argocd-example-apps.git
+        targetRevision: HEAD
+        path: guestbook
+        directory:
+          recurse: true
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: guestbook
+      syncPolicy:
+        automated:
+          prune: false
+          selfHeal: false
+      ignoreDifferences:
+      - group: apps
+        kind: Deployment
+        jsonPointers:
+        - /spec/replicas
+      info:
+      - name: url
+        value: https://argoproj.github.io/
+```
+
+You can also keep your existing CRDs by running the following scripts.
+
+```bash
+# keep Applications
+for app in "guestbook"; do
+  kubectl annotate --overwrite application $app helm.sh/resource-policy=keep
+done
+
+# keep Projects
+for project in "guestbook"; do
+  kubectl annotate --overwrite appproject $project helm.sh/resource-policy=keep
+done
+```
+
+2. Upgrade argo-cd Helm chart to v5.0.0
+
+3. Remove keep [helm.sh/resource-policy annotation](https://helm.sh/docs/howto/charts_tips_and_tricks/#tell-helm-not-to-uninstall-a-resource)
+
+```bash
+# delete annotations from Applications
+for app in "guestbook"; do
+  kubectl annotate --overwrite application $app helm.sh/resource-policy-
+done
+
+# delete annotations from Projects
+for project in "guestbook"; do
+  kubectl annotate --overwrite appproject $project helm.sh/resource-policy-
+done
+```
+
+4. Adopt existing resources to [argocd-apps](../argocd-apps)
+
 ### 4.9.0
 
 This version starts to use upstream image with applicationset binary. Start command was changed from `applicationset-controller` to `argocd-applicationset-controller`

charts/argo-cd/templates/NOTES.txt

@@ -1,9 +1,3 @@
-{{- if or .Values.configs.repositoryCredentials .Values.server.config.repositories }}
-WARNING: You are using `configs.repositoryCredentials` and/or `server.config.repositories` parameter that are DEPRECATED
-Instead, use `configs.repositoryTemplates` and/or `configs.repositories` parameters
-Read More about here: https://argo-cd.readthedocs.io/en/latest/operator-manual/declarative-setup/#legacy-behaviour
-
-{{- end}}
 In order to access the server UI you have the following options:
 
 1. kubectl port-forward service/{{include "argo-cd.fullname" . }}-server -n {{ .Release.Namespace }} 8080:443

charts/argo-cd/templates/argocd-application-controller/statefulset.yaml

@@ -1,6 +1,6 @@
 {{- $redisHa := (index .Values "redis-ha") -}}
 apiVersion: apps/v1
-kind: {{ .Values.controller.enableStatefulSet | ternary "StatefulSet" "Deployment" }}
+kind: StatefulSet
 metadata:
   name: {{ template "argo-cd.controller.fullname" . }}
   labels:
@@ -10,9 +10,7 @@ spec:
   selector:
     matchLabels:
       {{- include "argo-cd.selectorLabels" (dict "context" . "name" .Values.controller.name) | nindent 6 }}
-  {{- if  .Values.controller.enableStatefulSet }}
   serviceName: {{ template "argo-cd.controller.fullname" . }}
-  {{- end }}
   revisionHistoryLimit: 5
   replicas: {{ .Values.controller.replicas }}
   template:

charts/argo-cd/templates/argocd-configs/applications.yaml

@@ -1,42 +0,0 @@
-{{- range .Values.server.additionalApplications }}
----
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  {{- with .additionalAnnotations }}
-  annotations:
-    {{- range $key, $value := . }}
-    {{ $key }}: {{ $value | quote }}
-    {{- end }}
-  {{- end }}
-  {{- with .additionalLabels }}
-  labels:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  name: {{ .name }}
-  {{- with .namespace }}
-  namespace: {{ . }}
-  {{- end }}
-  {{- with .finalizers }}
-  finalizers:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  project: {{ tpl .project $ }}
-  source:
-    {{- toYaml .source | nindent 4 }}
-  destination:
-    {{- toYaml .destination | nindent 4 }}
-  {{- with .syncPolicy }}
-  syncPolicy:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .ignoreDifferences }}
-  ignoreDifferences:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .info }}
-  info:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-{{- end }}

charts/argo-cd/templates/argocd-configs/projects.yaml

@@ -1,62 +0,0 @@
-{{- range .Values.server.additionalProjects }}
----
-apiVersion: argoproj.io/v1alpha1
-kind: AppProject
-metadata:
-  {{- with .additionalAnnotations }}
-  annotations:
-    {{- range $key, $value := . }}
-    {{ $key }}: {{ $value | quote }}
-    {{- end }}
-  {{- end }}
-  {{- with .additionalLabels }}
-  labels:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  name: {{ .name }}
-  {{- with .namespace }}
-  namespace: {{ . }}
-  {{- end }}
-  {{- with .finalizers }}
-  finalizers:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  description: {{ .description }}
-  sourceRepos:
-    {{- toYaml .sourceRepos | nindent 4 }}
-  destinations:
-    {{- toYaml .destinations | nindent 4 }}
-  {{- with .clusterResourceWhitelist }}
-  clusterResourceWhitelist:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .clusterResourceBlacklist }}
-  clusterResourceBlacklist:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .namespaceResourceBlacklist }}
-  namespaceResourceBlacklist:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .namespaceResourceWhitelist }}
-  namespaceResourceWhitelist:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .orphanedResources }}
-  orphanedResources:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .roles }}
-  roles:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .syncWindows }}
-  syncWindows:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .signatureKeys }}
-  signatureKeys:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-{{- end }}

charts/argo-cd/templates/argocd-configs/repository-credentials-secret-legacy.yaml

@@ -1,13 +0,0 @@
-{{- if .Values.configs.repositoryCredentials }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: argocd-repository-credentials
-  labels:
-    {{- include "argo-cd.labels" (dict "context" . "component" .Values.server.name "name" "secret") | nindent 4 }}
-type: Opaque
-data:
-{{- range $key, $value := .Values.configs.repositoryCredentials }}
-  {{ $key }}: {{ $value | b64enc }}
-{{- end }}
-{{- end }}

charts/argo-cd/values.yaml

@@ -108,9 +108,6 @@ controller:
   # If changing the number of replicas you must pass the number as `ARGOCD_CONTROLLER_REPLICAS` as an environment variable
   replicas: 1
 
-  # -- Deploy the application controller as a StatefulSet instead of a Deployment, this is required for HA capability.
-  enableStatefulSet: true
-
   ## Application controller commandline flags
   args:
     # -- define the application controller `--status-processors`
@@ -1221,19 +1218,6 @@ server:
     # Ref: https://argo-cd.readthedocs.io/en/latest/operator-manual/rbac/#exec-resource
     exec.enabled: "false"
 
-    # DEPRECATED: Please instead use configs.credentialTemplates and configs.repositories
-    # repositories: |
-    #   - url: git@github.com:group/repo.git
-    #     sshPrivateKeySecret:
-    #       name: secret-name
-    #       key: sshPrivateKey
-    #   - type: helm
-    #     url: https://charts.helm.sh/stable
-    #     name: stable
-    #   - type: helm
-    #     url: https://argoproj.github.io/argo-helm
-    #     name: argo
-
     # admin.enabled indicates whether the admin user is enabled. It is enabled by default.
     # https://argo-cd.readthedocs.io/en/latest/faq/#how-to-disable-admin-user
     admin.enabled: "true"
@@ -1296,83 +1280,6 @@ server:
   # by something else. Argo CD will not work if there is no configMap created with the name above.
   rbacConfigCreate: true
 
-  # -- Deploy Argo CD Applications within this helm release
-  # @default -- `[]` (See [values.yaml])
-  ## Ref: https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/
-  additionalApplications: []
-  # - name: guestbook
-  #   namespace: argocd
-  #   additionalLabels: {}
-  #   additionalAnnotations: {}
-  #   finalizers:
-  #   - resources-finalizer.argocd.argoproj.io
-  #   project: guestbook
-  #   source:
-  #     repoURL: https://github.com/argoproj/argocd-example-apps.git
-  #     targetRevision: HEAD
-  #     path: guestbook
-  #     directory:
-  #       recurse: true
-  #   destination:
-  #     server: https://kubernetes.default.svc
-  #     namespace: guestbook
-  #   syncPolicy:
-  #     automated:
-  #       prune: false
-  #       selfHeal: false
-  #   ignoreDifferences:
-  #   - group: apps
-  #     kind: Deployment
-  #     jsonPointers:
-  #     - /spec/replicas
-  #   info:
-  #   - name: url
-  #     value: https://argoproj.github.io/
-
-  # -- Deploy Argo CD Projects within this helm release
-  # @default -- `[]` (See [values.yaml])
-  ## Ref: https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/
-  additionalProjects: []
-  # - name: guestbook
-  #   namespace: argocd
-  #   additionalLabels: {}
-  #   additionalAnnotations: {}
-  #   finalizers:
-  #   - resources-finalizer.argocd.argoproj.io
-  #   description: Example Project
-  #   sourceRepos:
-  #   - '*'
-  #   destinations:
-  #   - namespace: guestbook
-  #     server: https://kubernetes.default.svc
-  #   clusterResourceWhitelist: []
-  #   clusterResourceBlacklist: []
-  #   namespaceResourceBlacklist:
-  #   - group: ''
-  #     kind: ResourceQuota
-  #   - group: ''
-  #     kind: LimitRange
-  #   - group: ''
-  #     kind: NetworkPolicy
-  #     orphanedResources: {}
-  #     roles: []
-  #   namespaceResourceWhitelist:
-  #   - group: 'apps'
-  #     kind: Deployment
-  #   - group: 'apps'
-  #     kind: StatefulSet
-  #   orphanedResources: {}
-  #   roles: []
-  #   syncWindows:
-  #   - kind: allow
-  #     schedule: '10 1 * * *'
-  #     duration: 1h
-  #     applications:
-  #     - '*-prod'
-  #     manualSync: true
-  #   signatureKeys:
-  #   - keyID: ABCDEF1234567890
-
   ## Enable Admin ClusterRole resources.
   ## Enable if you would like to grant rights to Argo CD to deploy to the local Kubernetes cluster.
   clusterAdminAccess:
@@ -1865,9 +1772,6 @@ configs:
     #     XWyb96wrUlv+E8I=
     #     -----END CERTIFICATE-----
 
-  # -- *DEPRECATED:* Instead, use `configs.credentialTemplates` and/or `configs.repositories`
-  repositoryCredentials: {}
-
   # -- Repository credentials to be used as Templates for other repos
   ## Creates a secret for each key/value specified below to create repository credentials
   credentialTemplates: {}