Skip to content

Commit b833622

Browse files
jldohmannjldohmann
authored
Merge pull request #62228 from ekristova/RHDEVDOCS-4110
RHDEVDOCS-4110: GitOps Operator to configure secure communication wit…
2 parents 5e92afb + 65cd1ca commit b833622

File tree

4 files changed

+372
-0
lines changed

4 files changed

+372
-0
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1925,6 +1925,8 @@ Topics:
19251925
File: deploying-a-spring-boot-application-with-argo-cd
19261926
- Name: Argo CD custom resource properties
19271927
File: argo-cd-custom-resource-properties
1928+
- Name: Configuring secure communication with Redis
1929+
File: configuring-secure-communication-with-redis
19281930
- Name: Monitoring application health status
19291931
File: health-information-for-resources-deployment
19301932
- Name: Configuring SSO for Argo CD using Dex

‎cicd/gitops/configuring-secure-communication-with-redis.adoc

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
:_content-type: ASSEMBLY
2+
[id="configuring-secure-communication-with-redis"]
3+
= Configuring secure communication with Redis
4+
include::_attributes/common-attributes.adoc[]
5+
:context: configuring-secure-communication-with-redis
6+
7+
toc::[]
8+
9+
Using the Transport Layer Security (TLS) encryption with {gitops-title}, you can secure the communication between the Argo CD components and Redis cache and protect the possibly sensitive data in transit.
10+
11+
You can secure communication with Redis by using one of the following configurations:
12+
13+
* Enable the `autotls` setting to issue an appropriate certificate for TLS encryption.
14+
* Manually configure the TLS encryption by creating the `argocd-operator-redis-tls` secret with a key and certificate pair.
15+
16+
Both configurations are possible with or without the High Availability (HA) enabled.
17+
18+
.Prerequisites
19+
* You have access to the cluster with `cluster-admin` privileges.
20+
* You have access to the {product-title} web console.
21+
* {gitops-title} Operator is installed on your cluster.
22+
23+
include::modules/gitops-configuring-tls-for-redis-with-autotls-enabled.adoc[leveloffset=+1]
24+
25+
include::modules/gitops-configuring-tls-for-redis-with-autotls-disabled.adoc[leveloffset=+1]
26+
27+

‎modules/gitops-configuring-tls-for-redis-with-autotls-disabled.adoc

Lines changed: 232 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,232 @@
1+
// Module is included in the following assemblies:
2+
//
3+
// * /cicd/gitops/configuring-secure-communication-with-redis.adoc
4+
5+
[id="gitops-configuring-tls-for-redis-with-autotls-disabled_{context}"]
6+
= Configuring TLS for Redis with autotls disabled
7+
8+
You can manually configure TLS encryption for Redis by creating the `argocd-operator-redis-tls` secret with a key and certificate pair. In addition, you must annotate the secret to indicate that it belongs to the appropriate Argo CD instance. The steps to create a certificate and secret vary for instances with High Availability (HA) enabled.
9+
10+
.Procedure
11+
12+
. Log in to the {product-title} web console.
13+
14+
. Create an Argo CD instance:
15+
16+
.. In the *Administrator* perspective of the web console, use the left navigation panel to go to *Administration* -> *CustomResourceDefinitions*.
17+
18+
.. Search for `argocds.argoproj.io` and click `ArgoCD` custom resource definition (CRD).
19+
20+
.. On the *CustomResourceDefinition details* page, click the *Instances* tab, and then click *Create ArgoCD*.
21+
22+
.. Edit or replace the YAML similar to the following example:
23+
+
24+
.Example ArgoCD CR with autotls disabled
25+
[source,yaml]
26+
----
27+
apiVersion: argoproj.io/v1alpha1
28+
kind: ArgoCD
29+
metadata:
30+
name: argocd <1>
31+
namespace: openshift-gitops <2>
32+
spec:
33+
ha:
34+
enabled: true <3>
35+
----
36+
<1> The name of the Argo CD instance.
37+
<2> The namespace where you want to run the Argo CD instance.
38+
<3> The flag value that enables the HA feature. If you do not want to enable HA, do not include this line or set the flag value as `false`.
39+
40+
.. Click *Create*.
41+
42+
.. Verify that the Argo CD pods are ready and running:
43+
+
44+
[source,terminal]
45+
----
46+
$ oc get pods -n <namespace> <1>
47+
----
48+
<1> Specify a namespace where the Argo CD instance is running, for example `openshift-gitops`.
49+
+
50+
.Example output with HA disabled
51+
[source,terminal]
52+
----
53+
NAME READY STATUS RESTARTS AGE
54+
argocd-application-controller-0 1/1 Running 0 26s
55+
argocd-redis-84b77d4f58-vp6zm 1/1 Running 0 37s
56+
argocd-repo-server-5b959b57f4-znxjq 1/1 Running 0 37s
57+
argocd-server-6b8787d686-wv9zh 1/1 Running 0 37s
58+
----
59+
+
60+
[NOTE]
61+
====
62+
The HA-enabled TLS configuration requires a cluster with at least three worker nodes. It can take a few minutes for the output to appear if you have enabled the Argo CD instances with HA configuration.
63+
====
64+
+
65+
.Example output with HA enabled
66+
[source,terminal]
67+
----
68+
NAME READY STATUS RESTARTS AGE
69+
argocd-application-controller-0 1/1 Running 0 10m
70+
argocd-redis-ha-haproxy-669757fdb7-5xg8h 1/1 Running 0 10m
71+
argocd-redis-ha-server-0 2/2 Running 0 9m9s
72+
argocd-redis-ha-server-1 2/2 Running 0 98s
73+
argocd-redis-ha-server-2 2/2 Running 0 53s
74+
argocd-repo-server-576499d46d-8hgbh 1/1 Running 0 10m
75+
argocd-server-9486f88b7-dk2ks 1/1 Running 0 10m
76+
----
77+
78+
. Create a self-signed certificate for the Redis server by using one of the following options depending on your HA configuration:
79+
80+
* For the Argo CD instance with HA disabled, run the following command:
81+
+
82+
[source,terminal]
83+
----
84+
$ openssl req -new -x509 -sha256 \
85+
-subj "/C=XX/ST=XX/O=Testing/CN=redis" \
86+
-reqexts SAN -extensions SAN \
87+
-config <(printf "\n[SAN]\nsubjectAltName=DNS:argocd-redis.<namespace>.svc.cluster.local\n[req]\ndistinguished_name=req") \ <1>
88+
-keyout /tmp/redis.key \
89+
-out /tmp/redis.crt \
90+
-newkey rsa:4096 \
91+
-nodes \
92+
-sha256 \
93+
-days 10
94+
----
95+
<1> Specify a namespace where the Argo CD instance is running, for example `openshift-gitops`.
96+
+
97+
.Example output
98+
[source,terminal]
99+
----
100+
Generating a RSA private key
101+
...............++++
102+
............................++++
103+
writing new private key to '/tmp/redis.key'
104+
----
105+
106+
* For the Argo CD instance with HA enabled, run the following command:
107+
+
108+
[source,terminal]
109+
----
110+
$ openssl req -new -x509 -sha256 \
111+
-subj "/C=XX/ST=XX/O=Testing/CN=redis" \
112+
-reqexts SAN -extensions SAN \
113+
-config <(printf "\n[SAN]\nsubjectAltName=DNS:argocd-redis-ha-haproxy.<namespace>.svc.cluster.local\n[req]\ndistinguished_name=req") \ <1>
114+
-keyout /tmp/redis-ha.key \
115+
-out /tmp/redis-ha.crt \
116+
-newkey rsa:4096 \
117+
-nodes \
118+
-sha256 \
119+
-days 10
120+
----
121+
<1> Specify a namespace where the Argo CD instance is running, for example `openshift-gitops`.
122+
+
123+
.Example output
124+
[source,terminal]
125+
----
126+
Generating a RSA private key
127+
...............++++
128+
............................++++
129+
writing new private key to '/tmp/redis-ha.key'
130+
----
131+
132+
. Verify that the generated certificate and key are available in the `/tmp` directory by running the following commands:
133+
+
134+
[source,terminal]
135+
----
136+
$ cd /tmp
137+
----
138+
+
139+
[source,terminal]
140+
----
141+
$ ls
142+
----
143+
+
144+
.Example output with HA disabled
145+
[source,terminal]
146+
----
147+
...
148+
redis.crt
149+
redis.key
150+
...
151+
----
152+
+
153+
.Example output with HA enabled
154+
[source,terminal]
155+
----
156+
...
157+
redis-ha.crt
158+
redis-ha.key
159+
...
160+
----
161+
162+
. Create the `argocd-operator-redis-tls` secret by using one of the following options depending on your HA configuration:
163+
164+
* For the Argo CD instance with HA disabled, run the following command:
165+
+
166+
[source,terminal]
167+
----
168+
$ oc create secret tls argocd-operator-redis-tls --key=/tmp/redis.key --cert=/tmp/redis.crt
169+
----
170+
171+
* For the Argo CD instance with HA enabled, run the following command:
172+
+
173+
[source,terminal]
174+
----
175+
$ oc create secret tls argocd-operator-redis-tls --key=/tmp/redis-ha.key --cert=/tmp/redis-ha.crt
176+
----
177+
+
178+
.Example output
179+
[source,terminal]
180+
----
181+
secret/argocd-operator-redis-tls created
182+
----
183+
184+
. Annotate the secret to indicate that it belongs to the Argo CD CR:
185+
+
186+
[source,terminal]
187+
----
188+
$ oc annotate secret argocd-operator-redis-tls argocds.argoproj.io/name=<instance-name> <1>
189+
----
190+
<1> Specify a name of the Argo CD instance, for example `argocd`.
191+
+
192+
.Example output
193+
[source,terminal]
194+
----
195+
secret/argocd-operator-redis-tls annotated
196+
----
197+
198+
. Verify that the Argo CD pods are ready and running:
199+
+
200+
[source,terminal]
201+
----
202+
$ oc get pods -n <namespace> <1>
203+
----
204+
<1> Specify a namespace where the Argo CD instance is running, for example `openshift-gitops`.
205+
+
206+
.Example output with HA disabled
207+
[source,terminal]
208+
----
209+
NAME READY STATUS RESTARTS AGE
210+
argocd-application-controller-0 1/1 Running 0 26s
211+
argocd-redis-84b77d4f58-vp6zm 1/1 Running 0 37s
212+
argocd-repo-server-5b959b57f4-znxjq 1/1 Running 0 37s
213+
argocd-server-6b8787d686-wv9zh 1/1 Running 0 37s
214+
----
215+
+
216+
[NOTE]
217+
====
218+
It can take a few minutes for the output to appear if you have enabled the Argo CD instances with HA configuration.
219+
====
220+
+
221+
.Example output with HA enabled
222+
[source,terminal]
223+
----
224+
NAME READY STATUS RESTARTS AGE
225+
argocd-application-controller-0 1/1 Running 0 10m
226+
argocd-redis-ha-haproxy-669757fdb7-5xg8h 1/1 Running 0 10m
227+
argocd-redis-ha-server-0 2/2 Running 0 9m9s
228+
argocd-redis-ha-server-1 2/2 Running 0 98s
229+
argocd-redis-ha-server-2 2/2 Running 0 53s
230+
argocd-repo-server-576499d46d-8hgbh 1/1 Running 0 10m
231+
argocd-server-9486f88b7-dk2ks 1/1 Running 0 10m
232+
----

‎modules/gitops-configuring-tls-for-redis-with-autotls-enabled.adoc

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
// Module is included in the following assemblies:
2+
//
3+
// * /cicd/gitops/configuring-secure-communication-with-redis.adoc
4+
5+
[id="gitops-configuring-tls-for-redis-with-autotls-enabled_{context}"]
6+
= Configuring TLS for Redis with autotls enabled
7+
8+
You can configure TLS encryption for Redis by enabling the `autotls` setting on a new or already existing Argo CD instance. The configuration automatically provisions the `argocd-operator-redis-tls` secret and does not require further steps. Currently, {product-title} is the only supported secret provider.
9+
10+
[NOTE]
11+
====
12+
By default, the `autotls` setting is disabled.
13+
====
14+
15+
.Procedure
16+
17+
. Log in to the {product-title} web console.
18+
19+
. Create an Argo CD instance with `autotls` enabled:
20+
21+
.. In the *Administrator* perspective of the web console, use the left navigation panel to go to *Administration* -> *CustomResourceDefinitions*.
22+
23+
.. Search for `argocds.argoproj.io` and click `ArgoCD` custom resource definition (CRD).
24+
25+
.. On the *CustomResourceDefinition details* page, click the *Instances* tab, and then click *Create ArgoCD*.
26+
27+
.. Edit or replace the YAML similar to the following example:
28+
+
29+
.Example Argo CD CR with autotls enabled
30+
[source,yaml]
31+
----
32+
apiVersion: argoproj.io/v1alpha1
33+
kind: ArgoCD
34+
metadata:
35+
name: argocd <1>
36+
namespace: openshift-gitops <2>
37+
spec:
38+
redis:
39+
autotls: openshift <3>
40+
ha:
41+
enabled: true <4>
42+
----
43+
<1> The name of the Argo CD instance.
44+
<2> The namespace where you want to run the Argo CD instance.
45+
<3> The flag that enables the `autotls` setting and creates a TLS certificate for Redis.
46+
<4> The flag value that enables the HA feature. If you do not want to enable HA, do not include this line or set the flag value as `false`.
47+
+
48+
[TIP]
49+
====
50+
Alternatively, you can enable the `autotls` setting on an already existing Argo CD instance by running the following command:
51+
52+
[source,terminal]
53+
----
54+
$ oc patch argocds.argoproj.io <instance-name> --type=merge -p '{"spec":{"redis":{"autotls":"openshift"}}}'
55+
----
56+
====
57+
58+
.. Click *Create*.
59+
60+
.. Verify that the Argo CD pods are ready and running:
61+
+
62+
[source,terminal]
63+
----
64+
$ oc get pods -n <namespace> <1>
65+
----
66+
<1> Specify a namespace where the Argo CD instance is running, for example `openshift-gitops`.
67+
+
68+
.Example output with HA disabled
69+
[source,terminal]
70+
----
71+
NAME READY STATUS RESTARTS AGE
72+
argocd-application-controller-0 1/1 Running 0 26s
73+
argocd-redis-84b77d4f58-vp6zm 1/1 Running 0 37s
74+
argocd-repo-server-5b959b57f4-znxjq 1/1 Running 0 37s
75+
argocd-server-6b8787d686-wv9zh 1/1 Running 0 37s
76+
----
77+
+
78+
[NOTE]
79+
====
80+
The HA-enabled TLS configuration requires a cluster with at least three worker nodes. It can take a few minutes for the output to appear if you have enabled the Argo CD instances with HA configuration.
81+
====
82+
+
83+
.Example output with HA enabled
84+
[source,terminal]
85+
----
86+
NAME READY STATUS RESTARTS AGE
87+
argocd-application-controller-0 1/1 Running 0 10m
88+
argocd-redis-ha-haproxy-669757fdb7-5xg8h 1/1 Running 0 10m
89+
argocd-redis-ha-server-0 2/2 Running 0 9m9s
90+
argocd-redis-ha-server-1 2/2 Running 0 98s
91+
argocd-redis-ha-server-2 2/2 Running 0 53s
92+
argocd-repo-server-576499d46d-8hgbh 1/1 Running 0 10m
93+
argocd-server-9486f88b7-dk2ks 1/1 Running 0 10m
94+
----
95+
96+
. Verify that the `argocd-operator-redis-tls` secret is created:
97+
+
98+
[source,terminal]
99+
----
100+
$ oc get secrets argocd-operator-redis-tls -n <namespace> <1>
101+
----
102+
<1> Specify a namespace where the Argo CD instance is running, for example `openshift-gitops`.
103+
+
104+
.Example output
105+
[source,terminal]
106+
----
107+
NAME TYPE DATA AGE
108+
argocd-operator-redis-tls kubernetes.io/tls 2 30s
109+
----
110+
+
111+
The secret must be of the `kubernetes.io/tls` type and a size of `2`.

0 commit comments

Comments
 (0)