Skip to content

Commit 7bd4328

Browse files
SrivaralakshmiSrivaralakshmi
committed
Document on how to use Argo CD for managing OpenShift cluster configurations across multiple clusters
document installing cluster-scoped and namespace-scoped Operators using GitOps
1 parent aa353ad commit 7bd4328

4 files changed

+183
-2
lines changed

‎cicd/gitops/configuring-an-openshift-cluster-by-deploying-an-application-with-cluster-configurations.adoc

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,13 @@ With {gitops-title}, you can configure Argo CD to recursively sync the content o
1010

1111
.Prerequisites
1212

13-
* {gitops-title} is installed in your cluster.
14-
* Logged into Argo CD instance.
13+
* You have logged in to the `product-title` cluster as an administrator.
14+
* You have installed the `gitops-title` Operator in your cluster.
15+
* You have logged into Argo CD instance.
16+
17+
include::modules/gitops-using-argo-cd-instance-to-manage-cluster-scoped-resources.adoc[leveloffset=+1]
18+
19+
include::modules/gitops-default-permissions-of-an-argocd-instance.adoc[leveloffset=+1]
1520

1621
include::modules/go-run-argo-cd-instance-on-infrastructure-nodes.adoc[leveloffset=+1]
1722

@@ -29,3 +34,5 @@ include::modules/gitops-synchronizing-your-application-application-with-your-git
2934
include::modules/gitops-inbuilt-permissions-for-cluster-config.adoc[leveloffset=+1]
3035

3136
include::modules/gitops-additional-permissions-for-cluster-config.adoc[leveloffset=+1]
37+
38+
include::modules/gitops-installing-olm-operators-using-gitops.adoc[leveloffset=+1]

‎modules/gitops-default-permissions-of-an-argocd-instance.adoc

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
// Module included in the following assembly:
2+
//
3+
// * gitops/configuring_argo_cd_to_recursively_sync_a_git_repository_with_your_application/configuring-an-openshift-cluster-by-deploying-an-application-with-cluster-configurations.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="default-permissions-of-an-argocd-instance.adoc{context}"]
7+
8+
= Default permissions of an Argocd instance
9+
10+
By default Argo CD instance has the following permissions:
11+
12+
* Argo CD instance has the `admin` privileges to manage resources only in the namespace where it is deployed. For instance, an Argo CD instance deployed in the **foo** namespace has the `admin` privileges to manage resources only for that namespace.
13+
14+
* Argo CD has the following cluster-scoped permissions because Argo CD requires cluster-wide `read` privileges on resources to function appropriately:
15+
+
16+
[source,yaml]
17+
----
18+
- verbs:
19+
- get
20+
- list
21+
- watch
22+
apiGroups:
23+
- '*'
24+
resources:
25+
- '*'
26+
- verbs:
27+
- get
28+
- list
29+
nonResourceURLs:
30+
- '*'
31+
----
32+
33+
[NOTE]
34+
====
35+
* You can edit the cluster roles used by the `argocd-server` and `argocd-application-controller` components where Argo CD is running such that the `write` privileges are limited to only the namespaces and resources that you wish Argo CD to manage.
36+
+
37+
[source,terminal]
38+
----
39+
$ oc edit clusterrole argocd-server
40+
$ oc edit clusterrole argocd-application-controller
41+
----
42+
====
43+

‎modules/gitops-installing-olm-operators-using-gitops.adoc

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
// Module included in the following assembly:
2+
//
3+
// * configuring-an-openshift-cluster-by-deploying-an-application-with-cluster-configurations.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="gitops-installing-olm-operators-using-gitops_{context}"]
7+
= Installing OLM Operators using {gitops-title}
8+
9+
{gitops-title} with cluster configurations manages specific cluster-scoped resources and takes care of installing cluster Operators or any namespace-scoped OLM Operators.
10+
11+
Consider a case where as a cluster administrator, you have to install an OLM Operator such as Tekton. You use the {product-title} web console to manually install a Tekton Operator or the OpenShift CLI to manually install a Tekton subscription and Tekton Operator group on your cluster.
12+
13+
{gitops-title} places your Kubernetes resources in your Git repository. As a cluster administrator, use {gitops-title} to manage and automate the installation of other OLM Operators without any manual procedures. For example, after you place the Tekton subscription in your Git repository by using {gitops-title}, the {gitops-title} automatically takes this Tekton subscription from your Git repository and installs the Tekton Operator on your cluster.
14+
15+
== Installing cluster-scoped Operators
16+
17+
Operator Lifecycle Manager (OLM) uses a default `global-operators` Operator group in the `openshift-operators` namespace for cluster-scoped Operators. Hence you do not have to manage the `OperatorGroup` resource in your Gitops repository. However, for namespace-scoped Operators, you must manage the `OperatorGroup` resource in that namespace.
18+
19+
To install cluster-scoped Operators, create and place the `Subscription` resource of the required Operator in your Git repository.
20+
21+
.Example: Grafana Operator subscription
22+
23+
[source,yaml]
24+
----
25+
apiVersion: operators.coreos.com/v1alpha1
26+
kind: Subscription
27+
metadata:
28+
name: grafana
29+
spec:
30+
channel: v4
31+
installPlanApproval: Automatic
32+
name: grafana-operator
33+
source: redhat-operators
34+
sourceNamespace: openshift-marketplace
35+
----
36+
37+
== Installing namepace-scoped Operators
38+
39+
To install namespace-scoped Operators, create and place the `Subscription` and `OperatorGroup` resources of the required Operator in your Git repository.
40+
41+
.Example: Ansible Automation Platform Resource Operator
42+
43+
[source,yaml]
44+
----
45+
...
46+
apiVersion: v1
47+
kind: Namespace
48+
metadata:
49+
labels:
50+
openshift.io/cluster-monitoring: "true"
51+
name: ansible-automation-platform
52+
...
53+
apiVersion: operators.coreos.com/v1
54+
kind: OperatorGroup
55+
metadata:
56+
name: ansible-automation-platform-operator
57+
namespace: ansible-automation-platform
58+
spec:
59+
targetNamespaces:
60+
- ansible-automation-platform
61+
...
62+
apiVersion: operators.coreos.com/v1alpha1
63+
kind: Subscription
64+
metadata:
65+
name: ansible-automation-platform
66+
namespace: ansible-automation-platform
67+
spec:
68+
channel: patch-me
69+
installPlanApproval: Automatic
70+
name: ansible-automation-platform-operator
71+
source: redhat-operators
72+
sourceNamespace: openshift-marketplace
73+
...
74+
----
75+
76+
[IMPORTANT]
77+
====
78+
When deploying multiple Operators using {gitops-title}, you must create only a single Operator group in the corresponding namespace. If more than one Operator group exists in a single namespace, any CSV created in that namespace transition to a `failure` state with the `TooManyOperatorGroups` reason. After the number of Operator groups in their corresponding namespaces reaches one, all the previous `failure` state CSVs transition to `pending` state. You must manually approve the pending install plan to complete the Operator installation.
79+
====
80+

‎modules/gitops-using-argo-cd-instance-to-manage-cluster-scoped-resources.adoc

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
// Module included in the following assembly:
2+
//
3+
// * gitops/configuring_argo_cd_to_recursively_sync_a_git_repository_with_your_application/configuring-an-openshift-cluster-by-deploying-an-application-with-cluster-configurations.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="using-argo-cd-instance-to-manage-cluster-scoped-resources{context}"]
7+
8+
= Using an Argo CD instance to manage cluster-scoped resources
9+
10+
To manage cluster-scoped resources, update the existing `Subscription` object for the `gitops-title` Operator and add the namespace of the Argo CD instance to the `ARGOCD_CLUSTER_CONFIG_NAMESPACES` environment variable in the `spec` section.
11+
12+
[discrete]
13+
.Procedure
14+
. In the **Administrator** perspective of the web console, navigate to **Operators** → **Installed Operators** → **{gitops-title}** → **Subscription**.
15+
. Click the **Actions** drop-down menu then click **Edit Subscription**.
16+
. On the **openshift-gitops-operator** Subscription details page, under the **YAML** tab, edit the `Subscription` YAML file by adding the namespace of the Argo CD instance to the `ARGOCD_CLUSTER_CONFIG_NAMESPACES` environment variable in the `spec` section:
17+
+
18+
[source,yaml]
19+
----
20+
apiVersion: operators.coreos.com/v1alpha1
21+
kind: Subscription
22+
metadata:
23+
name: openshift-gitops-operator
24+
namespace: openshift-operators
25+
...
26+
spec:
27+
config:
28+
env:
29+
- name: ARGOCD_CLUSTER_CONFIG_NAMESPACES
30+
value: openshift-gitops, <list of namespaces of cluster-scoped Argo CD instances>
31+
...
32+
----
33+
+
34+
. To verify that the Argo instance is configured with a cluster role to manage cluster-scoped resources, perform the following steps:
35+
+
36+
.. Navigate to **User Management** → **Roles** and from the **Filter** drop-down menu select **Cluster-wide Roles**.
37+
.. Search for the `argocd-application-controller` by using the **Search by name** field.
38+
+
39+
The **Roles** page displays the created cluster role.
40+
+
41+
[TIP]
42+
====
43+
Alternatively, in the OpenShift CLI, run the following command:
44+
45+
[source,terminal]
46+
----
47+
oc auth can-i create oauth -n openshift-gitops --as system:serviceaccount:openshift-gitops:openshift-gitops-argocd-application-controller
48+
----
49+
50+
The output `yes` verifies that the Argo instance is configured with a cluster role to manage cluster-scoped resources. Else, check your configurations and take necessary steps as required.
51+
====

0 commit comments

Comments
 (0)