|
| 1 | +# argocd_project |
| 2 | + |
| 3 | +Creates an ArgoCD project. |
| 4 | + |
| 5 | +## Example Usage |
| 6 | + |
| 7 | +```hcl |
| 8 | +resource "argocd_project" "myproject" { |
| 9 | + metadata { |
| 10 | + name = "myproject" |
| 11 | + namespace = "argocd" |
| 12 | + labels = { |
| 13 | + acceptance = "true" |
| 14 | + } |
| 15 | + annotations = { |
| 16 | + "this.is.a.really.long.nested.key" = "yes, really!" |
| 17 | + } |
| 18 | + } |
| 19 | +
|
| 20 | + spec { |
| 21 | + description = "simple project" |
| 22 | + source_repos = ["*"] |
| 23 | +
|
| 24 | + destination { |
| 25 | + server = "https://kubernetes.default.svc" |
| 26 | + namespace = "default" |
| 27 | + } |
| 28 | + destination { |
| 29 | + server = "https://kubernetes.default.svc" |
| 30 | + namespace = "foo" |
| 31 | + } |
| 32 | + cluster_resource_whitelist { |
| 33 | + group = "rbac.authorization.k8s.io" |
| 34 | + kind = "ClusterRoleBinding" |
| 35 | + } |
| 36 | + cluster_resource_whitelist { |
| 37 | + group = "rbac.authorization.k8s.io" |
| 38 | + kind = "ClusterRole" |
| 39 | + } |
| 40 | + namespace_resource_blacklist { |
| 41 | + group = "networking.k8s.io" |
| 42 | + kind = "Ingress" |
| 43 | + } |
| 44 | + orphaned_resources = { |
| 45 | + warn = true |
| 46 | + } |
| 47 | + role { |
| 48 | + name = "testrole" |
| 49 | + policies = [ |
| 50 | + "p, proj:myproject:testrole, applications, override, myproject/*, allow", |
| 51 | + "p, proj:myproject:testrole, applications, sync, myproject/*, allow", |
| 52 | + ] |
| 53 | + } |
| 54 | + role { |
| 55 | + name = "anotherrole" |
| 56 | + policies = [ |
| 57 | + "p, proj:myproject:testrole, applications, get, myproject/*, allow", |
| 58 | + "p, proj:myproject:testrole, applications, sync, myproject/*, deny", |
| 59 | + ] |
| 60 | + } |
| 61 | + sync_window { |
| 62 | + kind = "allow" |
| 63 | + applications = ["api-*"] |
| 64 | + clusters = ["*"] |
| 65 | + namespaces = ["*"] |
| 66 | + duration = "3600s" |
| 67 | + schedule = "10 1 * * *" |
| 68 | + manual_sync = true |
| 69 | + } |
| 70 | + sync_window { |
| 71 | + kind = "deny" |
| 72 | + applications = ["foo"] |
| 73 | + clusters = ["in-cluster"] |
| 74 | + namespaces = ["default"] |
| 75 | + duration = "12h" |
| 76 | + schedule = "22 1 5 * *" |
| 77 | + manual_sync = false |
| 78 | + } |
| 79 | + } |
| 80 | +} |
| 81 | +
|
| 82 | +``` |
| 83 | + |
| 84 | +## Argument Reference |
| 85 | + |
| 86 | +* `metadata` - (Required) Standard Kubernetes API service's metadata. For more info see the [Kubernetes reference](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata). |
| 87 | +* `spec` - (Required) The project specification, the nested attributes are documented below. |
| 88 | + |
| 89 | +The `metadata` block can have the following attributes: |
| 90 | + |
| 91 | +* `name` - (Required) The project name, must be unique, cannot be updated. |
| 92 | +* `annotations` - (Optional) An unstructured key value map stored with the config map that may be used to store arbitrary metadata. **By default, the provider ignores any annotations whose key names end with kubernetes.io. This is necessary because such annotations can be mutated by server-side components and consequently cause a perpetual diff in the Terraform plan output. If you explicitly specify any such annotations in the configuration template then Terraform will consider these as normal resource attributes and manage them as expected (while still avoiding the perpetual diff problem)**. For more info see [Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/). |
| 93 | +* `labels` - (Optional) Map of string keys and values that can be used to organize and categorize (scope and select) the config map. May match selectors of replication controllers and services. **By default, the provider ignores any labels whose key names end with kubernetes.io. This is necessary because such labels can be mutated by server-side components and consequently cause a perpetual diff in the Terraform plan output. If you explicitly specify any such labels in the configuration template then Terraform will consider these as normal resource attributes and manage them as expected (while still avoiding the perpetual diff problem).** For more info see [Kubernetes reference](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/). |
| 94 | + |
| 95 | +The `spec` block can have the following attributes: |
| 96 | + |
| 97 | +* `destination` - (Required) The allowed cluster/namespace project destination, can be repeated multiple times. |
| 98 | +* `source_repos` - (Required) List of strings containing allowed application repositories URLs for the project. Can be set to `["*"]` to allow all configured repositories configured in ArgoCD. |
| 99 | +* `cluster_resource_whitelist` - (Optional) Cluster-scoped resource allowed to be managed by the project applications, can be repeated multiple times. |
| 100 | +* `description` - (Optional) |
| 101 | +* `orphaned_resources` - (Optional) A key value map to control orphaned resources monitoring, |
| 102 | +* `namespace_resource_blacklist` - (Optional) Namespaced-scoped resources allowed to be managed by the project applications, can be repeated multiple times. |
| 103 | +* `role` - (Optional) can be repeated multiple times. |
| 104 | +* `sync_window` - (Optional) can be repeated multiple times. |
| 105 | + |
| 106 | +Each `cluster_resource_whitelist` block can have the following attributes: |
| 107 | +* `group` - (Optional) The Kubernetes resource Group to match for. |
| 108 | +* `kind` - (Optional) The Kubernetes resource Kind to match for. |
| 109 | + |
| 110 | +The `orphaned_resources` map can have the following attributes: |
| 111 | +* `warn` - Boolean, defaults to `false`. |
| 112 | + |
| 113 | +Each `namespace_resource_blacklist` block can have the following attributes: |
| 114 | +* `group` - (Optional) The Kubernetes resource Group to match for. |
| 115 | +* `kind` - (Optional) The Kubernetes resource Kind to match for. |
| 116 | + |
| 117 | +Each `role` block can have the following attributes: |
| 118 | +* `name` - (Required) Name of the role. |
| 119 | +* `policies` - (Required) list of Casbin formated strings that define access policies for the role in the project, For more information, read the [ArgoCD RBAC reference](https://argoproj.github.io/argo-cd/operator-manual/rbac/#rbac-permission-structure). |
| 120 | +* `description` - (Optional) |
| 121 | +* `groups` - (Optional) List of OIDC group claims bound to this role. |
| 122 | + |
| 123 | +Each `sync_window` block can have the following attributes: |
| 124 | +* `applications` - (Optional) List of applications the window will apply to. |
| 125 | +* `clusters` - (Optional) List of clusters the window will apply to. |
| 126 | +* `duration` - (Optional) amount of time the sync window will be open. |
| 127 | +* `kind` - (Optional) Defines if the window allows or blocks syncs, allowed values are `allow` or `deny`. |
| 128 | +* `manual_sync` - (Optional) Boolean, enables manual syncs when they would otherwise be blocked. |
| 129 | +* `namespaces` - (Optional) List of namespaces that the window will apply to. |
| 130 | +* `schedule` - (Optional) Time the window will begin, specified in cron format. |
0 commit comments