From ced5dc45bbfced9540f6c463cebbda6894acd471 Mon Sep 17 00:00:00 2001 From: Venkata Mutyala Date: Thu, 17 Sep 2026 16:56:02 +0000 Subject: [PATCH 1/3] feat: prepare the values for Argo CD v3.4.9 on argo-helm chart 10.2.2 - Extension installer: chart >= 9.4.18 ships argocd-extension-installer v1.0.1, which exits non-zero when the tarball download fails and blocks argocd-server from starting. Set IGNORE_FAILURE=true to keep the pre-v1 fail-open behaviour (a missing extension renders nothing in the UI). - global.networkPolicy.create: true made explicit. Chart 10.0.0 flipped the default as the fix for GHSA-47m3-95c7-g2g8 (repo-server reachable from any pod); pinning it means a chart bump cannot flip it silently. Note: on the current chart 9.3.7 this already renders the same five NetworkPolicies. - Remove server.ingress.hosts/paths, ignored since chart 6.0.0 (the Ingress host comes from global.domain, path defaults to /); render unchanged. - README: CRDs come from platform-crds and must be applied server-side (the ApplicationSet CRD exceeds the client-side-apply limit since 3.3); example chart 10.2.2 and argocd_app_version v3.4.9. Rendered with chart 10.2.2 + v3.4.9, old tpl vs new tpl: the only diff is the IGNORE_FAILURE env on the otel-extension init container. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01FSau4e6nS8Y7eM1nQHwq6k --- README.md | 8 +++++--- argocd.yaml.tpl | 17 +++++++++++++---- 2 files changed, 18 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index 57425e6..7205af6 100644 --- a/README.md +++ b/README.md @@ -25,9 +25,11 @@ wget -O argocd.yaml https://raw.githubusercontent.com/GlueOps/docs-argocd/main/a - Install ArgoCD ```bash -kubectl apply -k "https://github.com/argoproj/argo-cd/tree/v2.8.6/manifests/crds" # You need to install the CRD's that match the version of the app in the helm chart. +# CRDs are shipped by GlueOps/platform-crds (glueops.dev/pin.argo-cd) and MUST be applied server-side: +# the ApplicationSet CRD exceeds the client-side-apply annotation limit since Argo CD 3.3. +kubectl apply --server-side --force-conflicts -k "https://github.com/argoproj/argo-cd/manifests/crds?ref=v3.4.9" helm repo add argo https://argoproj.github.io/argo-helm # Adds the argo helm repository to your local environment -helm install argocd argo/argo-cd --skip-crds --version 5.50.0 -f argocd.yaml --namespace=glueops-core --create-namespace #this command includes --skip-crds but the way the chart works we also have a value we need to set to false so that the CRD's do not work. This value is in the argocd.yaml +helm install argocd argo/argo-cd --skip-crds --version 10.2.2 -f argocd.yaml --namespace=glueops-core --create-namespace #this command includes --skip-crds but the way the chart works we also have a value we need to set to false so that the CRD's do not work. This value is in the argocd.yaml ``` - Check to see if all ArgoCD pods are in a good state with: @@ -49,7 +51,7 @@ module "argocd_helm_values" { client_secret = "" glueops_root_domain = "onglueops.com" argocd_rbac_policies = " g, glueops-rocks:super_admins, role:admin\n" - argocd_app_version = "v3.2.12" + argocd_app_version = "v3.4.9" gatekeeper_tag = "v0.1.1" # Optional. Defaults to v0.1.5. diff --git a/argocd.yaml.tpl b/argocd.yaml.tpl index 3f05fd9..40791b4 100644 --- a/argocd.yaml.tpl +++ b/argocd.yaml.tpl @@ -9,6 +9,12 @@ notifications: # @ignored global: domain: "argocd.placeholder_cluster_environment.placeholder_tenant_key.placeholder_glueops_root_domain" + # Chart >= 10.0.0 (GHSA-47m3-95c7-g2g8) renders NetworkPolicies for every component: + # argocd-server allows all ingress; the controllers allow only :metrics from any + # namespace; argocd-repo-server:8081 is reachable ONLY from the argocd-* pods in this + # namespace; redis-ha gets no policy. Explicit here so a chart bump cannot flip it silently. + networkPolicy: + create: true image: repository: "quay.repo.gpkg.io/argoproj/argocd" tag: "placeholder_argocd_app_version" @@ -242,6 +248,11 @@ server: env: - name: EXTENSION_URL value: "https://github.com/GlueOps/argo-cd-ui-extention/releases/download/placeholder_otel_extension_version/extension.tar.gz" + # Installer >= v1.0.0 (chart >= 9.4.18) exits non-zero when the tarball download + # fails, which blocks argocd-server from starting. Keep the pre-v1 fail-open + # behaviour: a missing extension just renders nothing in the UI. + - name: IGNORE_FAILURE + value: "true" # @ignored metrics: enabled: true @@ -279,10 +290,8 @@ server: #nginx.ingress.kubernetes.io/auth-url: "https://oauth2.placeholder_cluster_environment.placeholder_tenant_key.placeholder_glueops_root_domain/oauth2/auth" #nginx.ingress.kubernetes.io/auth-response-headers: "x-auth-request-user, x-auth-request-email, authorization" - hosts: - - argocd.placeholder_cluster_environment.placeholder_tenant_key.placeholder_glueops_root_domain - paths: - - / + # host comes from global.domain and the path defaults to "/": server.ingress.hosts and + # server.ingress.paths were removed in chart 6.0.0 and had been ignored since. extraObjects: From 6d2a24489b138a12eac06c51ef1b957ba964505c Mon Sep 17 00:00:00 2001 From: Venkata Mutyala Date: Thu, 17 Sep 2026 17:07:18 +0000 Subject: [PATCH 2/3] chore: drop the explanatory comments; the PR description carries the rationale Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01FSau4e6nS8Y7eM1nQHwq6k --- README.md | 2 -- argocd.yaml.tpl | 9 --------- 2 files changed, 11 deletions(-) diff --git a/README.md b/README.md index 7205af6..c28d622 100644 --- a/README.md +++ b/README.md @@ -25,8 +25,6 @@ wget -O argocd.yaml https://raw.githubusercontent.com/GlueOps/docs-argocd/main/a - Install ArgoCD ```bash -# CRDs are shipped by GlueOps/platform-crds (glueops.dev/pin.argo-cd) and MUST be applied server-side: -# the ApplicationSet CRD exceeds the client-side-apply annotation limit since Argo CD 3.3. kubectl apply --server-side --force-conflicts -k "https://github.com/argoproj/argo-cd/manifests/crds?ref=v3.4.9" helm repo add argo https://argoproj.github.io/argo-helm # Adds the argo helm repository to your local environment helm install argocd argo/argo-cd --skip-crds --version 10.2.2 -f argocd.yaml --namespace=glueops-core --create-namespace #this command includes --skip-crds but the way the chart works we also have a value we need to set to false so that the CRD's do not work. This value is in the argocd.yaml diff --git a/argocd.yaml.tpl b/argocd.yaml.tpl index 40791b4..8002c4d 100644 --- a/argocd.yaml.tpl +++ b/argocd.yaml.tpl @@ -9,10 +9,6 @@ notifications: # @ignored global: domain: "argocd.placeholder_cluster_environment.placeholder_tenant_key.placeholder_glueops_root_domain" - # Chart >= 10.0.0 (GHSA-47m3-95c7-g2g8) renders NetworkPolicies for every component: - # argocd-server allows all ingress; the controllers allow only :metrics from any - # namespace; argocd-repo-server:8081 is reachable ONLY from the argocd-* pods in this - # namespace; redis-ha gets no policy. Explicit here so a chart bump cannot flip it silently. networkPolicy: create: true image: @@ -248,9 +244,6 @@ server: env: - name: EXTENSION_URL value: "https://github.com/GlueOps/argo-cd-ui-extention/releases/download/placeholder_otel_extension_version/extension.tar.gz" - # Installer >= v1.0.0 (chart >= 9.4.18) exits non-zero when the tarball download - # fails, which blocks argocd-server from starting. Keep the pre-v1 fail-open - # behaviour: a missing extension just renders nothing in the UI. - name: IGNORE_FAILURE value: "true" # @ignored @@ -290,8 +283,6 @@ server: #nginx.ingress.kubernetes.io/auth-url: "https://oauth2.placeholder_cluster_environment.placeholder_tenant_key.placeholder_glueops_root_domain/oauth2/auth" #nginx.ingress.kubernetes.io/auth-response-headers: "x-auth-request-user, x-auth-request-email, authorization" - # host comes from global.domain and the path defaults to "/": server.ingress.hosts and - # server.ingress.paths were removed in chart 6.0.0 and had been ignored since. extraObjects: From b71bedcb6db24a2276ec4a5de4abb837e6a94414 Mon Sep 17 00:00:00 2001 From: Venkata Mutyala Date: Thu, 17 Sep 2026 17:09:14 +0000 Subject: [PATCH 3/3] feat: fetch the OTEL UI extension through the raw-github proxy Same repo.gpkg.io/repository/raw-github/ pattern GlueKube uses for GitHub release assets, so argocd-server no longer depends on direct egress to github.com at startup. The proxy serves the tarball byte-identical to GitHub. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01FSau4e6nS8Y7eM1nQHwq6k --- argocd.yaml.tpl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/argocd.yaml.tpl b/argocd.yaml.tpl index 8002c4d..0f4bbad 100644 --- a/argocd.yaml.tpl +++ b/argocd.yaml.tpl @@ -243,7 +243,7 @@ server: - name: otel-extension env: - name: EXTENSION_URL - value: "https://github.com/GlueOps/argo-cd-ui-extention/releases/download/placeholder_otel_extension_version/extension.tar.gz" + value: "https://repo.gpkg.io/repository/raw-github/GlueOps/argo-cd-ui-extention/releases/download/placeholder_otel_extension_version/extension.tar.gz" - name: IGNORE_FAILURE value: "true" # @ignored