feat: ArgoCD upgrade to version 3.x (#158)

* upgrated argocd chart version

* updated values files

* minor fix

* fix ingress protocol and resources

* upgrated argocd version

* minor fix

* pre-commit fixs

Author: diegoitaliait

src/aks-platform/01_network.tf

@@ -16,11 +16,3 @@ resource "azurerm_subnet" "user_aks_subnet" {
   private_endpoint_network_policies_enabled     = true
   private_link_service_network_policies_enabled = true
 }
-
-resource "azurerm_private_dns_a_record" "argocd_ingress" {
-  name                = local.ingress_hostname_prefix
-  zone_name           = data.azurerm_private_dns_zone.internal.name
-  resource_group_name = local.internal_dns_zone_resource_group_name
-  ttl                 = 3600
-  records             = [var.ingress_load_balancer_ip]
-}

src/aks-platform/05_argocd.tf

@@ -182,3 +182,14 @@ resource "helm_release" "reloader_argocd" {
     value = "false"
   }
 }
+
+#
+# 🌐 Network
+#
+resource "azurerm_private_dns_a_record" "argocd_ingress" {
+  name                = local.ingress_hostname_prefix
+  zone_name           = data.azurerm_private_dns_zone.internal.name
+  resource_group_name = local.internal_dns_zone_resource_group_name
+  ttl                 = 3600
+  records             = [var.ingress_load_balancer_ip]
+}

src/aks-platform/99_variables.tf

@@ -401,24 +401,6 @@ variable "reloader_helm" {
   description = "reloader helm chart configuration"
 }
 
-#
-# Monitor
-#
-variable "law_prometheus_sku" {
-  type        = string
-  description = "Sku of the Log Analytics Workspace"
-}
-
-variable "law_prometheus_retention_in_days" {
-  type        = number
-  description = "The workspace data retention in days"
-}
-
-variable "law_prometheus_daily_quota_gb" {
-  type        = number
-  description = "The workspace daily quota for ingestion in GB."
-}
-
 # DNS
 variable "external_domain" {
   type        = string

src/aks-platform/README.md

@@ -156,9 +156,6 @@ Re-enable all the resource, commented before to complete the procedure
 | <a name="input_keda_helm_version"></a> [keda\_helm\_version](#input\_keda\_helm\_version) | n/a | `string` | n/a | yes |
 | <a name="input_key_vault_name"></a> [key\_vault\_name](#input\_key\_vault\_name) | Key Vault name | `string` | `""` | no |
 | <a name="input_key_vault_rg_name"></a> [key\_vault\_rg\_name](#input\_key\_vault\_rg\_name) | Key Vault - rg name | `string` | `""` | no |
-| <a name="input_law_prometheus_daily_quota_gb"></a> [law\_prometheus\_daily\_quota\_gb](#input\_law\_prometheus\_daily\_quota\_gb) | The workspace daily quota for ingestion in GB. | `number` | n/a | yes |
-| <a name="input_law_prometheus_retention_in_days"></a> [law\_prometheus\_retention\_in\_days](#input\_law\_prometheus\_retention\_in\_days) | The workspace data retention in days | `number` | n/a | yes |
-| <a name="input_law_prometheus_sku"></a> [law\_prometheus\_sku](#input\_law\_prometheus\_sku) | Sku of the Log Analytics Workspace | `string` | n/a | yes |
 | <a name="input_location"></a> [location](#input\_location) | n/a | `string` | n/a | yes |
 | <a name="input_location_short"></a> [location\_short](#input\_location\_short) | Location short like eg: weu, weu.. | `string` | n/a | yes |
 | <a name="input_location_westeurope"></a> [location\_westeurope](#input\_location\_westeurope) | n/a | `string` | n/a | yes |

src/aks-platform/argocd/argocd_helm_setup_values.yaml

@@ -1,5 +1,6 @@
 terraform:
   force: ${force_reinstall}
+
 global:
   addPrometheusAnnotations: true
   securityContext:
@@ -20,14 +21,13 @@ global:
 configs:
   params:
     application.namespaces: "${join(",", argocd_application_namespaces)}"
-    server.insecure: true  # Miglioramento: Abilitazione TLS a livello di ArgoCD
-
+    server.insecure: false
   cm:
     timeout.reconciliation: 30s
     application.resourceTrackingMethod: annotation
-    exec.enabled: "false"
-    admin.enabled: "true"  # Miglioramento: Disabilitazione dell'utente admin predefinito
-    statusbadge.enabled: "true"
+    exec.enabled: false
+    admin.enabled: true
+    statusbadge.enabled: true
     url: https://argocd.internal.devopslab.pagopa.it
     oidc.config: |
       name: Azure
@@ -42,21 +42,18 @@ configs:
         email:
           essential: true
       requestedScopes:
-         - openid
-         - profile
-         - email
-
+        - openid
+        - profile
+        - email
+    server.rbac.disableApplicationFineGrainedRBACInheritance: "false"
   rbac:
     policy.default: role:guest
     policy.csv: |
-      # Admin role: full access to all resources
-      p, role:admin, applications, *, */*, allow
-      p, role:admin, projects, *, *, allow
-      p, role:admin, repositories, *, *, allow
-      p, role:admin, clusters, *, *, allow
-      p, role:admin, accounts, *, *, allow
+      # --- Admin role
+      p, role:admin, *, *, */*, allow
+      p, role:admin, logs, get, */*, allow
 
-      # Developer role: can manage applications but cannot delete them or modify infrastructure-level settings
+      # --- Developer role
       p, role:developer, applications, get, */*, allow
       p, role:developer, applications, create, */*, allow
       p, role:developer, applications, update, */*, allow
@@ -66,16 +63,15 @@ configs:
       p, role:developer, clusters, get, *, allow
       p, role:developer, repositories, get, *, allow
       p, role:developer, accounts, get, *, allow
+      p, role:developer, logs, get, */*, allow
 
-      # Reader role: can only view applications and logs, but cannot access secrets
+      # --- Reader role
       p, role:reader, applications, get, */*, allow
       p, role:reader, applications, logs, */*, allow
       p, role:reader, projects, get, *, allow
-
-      # Explicitly deny access to secrets for the reader role
       p, role:reader, applications, get, */secrets, deny
 
-      # Guest role: no permissions (default for unassigned users)
+      # --- Guest role
       p, role:guest, applications, get, */*, deny
       p, role:guest, projects, get, *, deny
       p, role:guest, repositories, get, *, deny
@@ -88,7 +84,6 @@ configs:
 
     scopes: "[preferred_username, email, groups]"
 
-
 server:
   replicas: 1
   autoscaling:
@@ -118,25 +113,24 @@ server:
     enabled: true
     minAvailable: 1
   resources:
+    requests:
+      cpu: 500m
+      memory: 256Mi
     limits:
       cpu: 1000m
       memory: 1Gi
-    requests:
-      cpu: 500m
-      memory: 512Mi
   ingress:
     enabled: true
-    ingressClassName: "nginx"
+    controller: generic
+    ingressClassName: nginx
     hostname: argocd.internal.devopslab.pagopa.it
+    path: /
+    pathType: Prefix
     annotations:
-      nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
-      nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-      nginx.ingress.kubernetes.io/ssl-redirect: "true"
-      nginx.ingress.kubernetes.io/grpc-backend: "true"
+      nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
       nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
       nginx.ingress.kubernetes.io/proxy-body-size: "100m"
       nginx.ingress.kubernetes.io/proxy-read-timeout: "90"
-    tls: false
     extraTls:
       - hosts:
           - argocd.internal.devopslab.pagopa.it