Skip to content

Commit c6827f9

Browse files
aali309aali309
authored
feat: declarative management of Argo CD webhook secrets (GitHub) (#2149)
* add declarative webhook secret reference schema in ArgoCD CR Signed-off-by: Atif Ali <atali@redhat.com> * Implement operator logic to reconcile webhook secret references for GitHub Signed-off-by: Atif Ali <atali@redhat.com> * run make generate Signed-off-by: Atif Ali <atali@redhat.com> * remove namespace field Signed-off-by: Atif Ali <atali@redhat.com> * read secret failures && run make bundle Signed-off-by: Atif Ali <atali@redhat.com> * remove argocdSecret.Data when declaration is missing Signed-off-by: Atif Ali <atali@redhat.com> * apply Oliver’s simplification review Signed-off-by: Atif Ali <atali@redhat.com> --------- Signed-off-by: Atif Ali <atali@redhat.com>
1 parent f69a061 commit c6827f9

12 files changed

Lines changed: 679 additions & 0 deletions

File tree

‎api/v1alpha1/argocd_conversion.go‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,7 @@ func (src *ArgoCD) ConvertTo(dstRaw conversion.Hub) error {
101101
dst.Spec.AggregatedClusterRoles = src.Spec.AggregatedClusterRoles
102102
dst.Spec.ArgoCDAgent = ConvertAlphaToBetaArgoCDAgent(src.Spec.ArgoCDAgent)
103103
dst.Spec.NamespaceManagement = ConvertAlphaToBetaNamespaceManagement(src.Spec.NamespaceManagement)
104+
dst.Spec.WebhookSecrets = ConvertAlphaToBetaWebhookSecrets(src.Spec.WebhookSecrets)
104105
dst.Spec.NetworkPolicy = v1beta1.ArgoCDNetworkPolicySpec(src.Spec.NetworkPolicy)
105106

106107
// Status conversion
@@ -177,6 +178,7 @@ func (dst *ArgoCD) ConvertFrom(srcRaw conversion.Hub) error {
177178
dst.Spec.AggregatedClusterRoles = src.Spec.AggregatedClusterRoles
178179
dst.Spec.ArgoCDAgent = ConvertBetaToAlphaArgoCDAgent(src.Spec.ArgoCDAgent)
179180
dst.Spec.NamespaceManagement = ConvertBetaToAlphaNamespaceManagement(src.Spec.NamespaceManagement)
181+
dst.Spec.WebhookSecrets = ConvertBetaToAlphaWebhookSecrets(src.Spec.WebhookSecrets)
180182

181183
// Status conversion
182184
dst.Status = ArgoCDStatus(src.Status)
@@ -1040,6 +1042,42 @@ func ConvertBetaToAlphaAgentTLS(src *v1beta1.AgentTLSSpec) *AgentTLSSpec {
10401042
return dst
10411043
}
10421044

1045+
// ConvertAlphaToBetaWebhookSecrets converts webhook secret refs from v1alpha1 to v1beta1.
1046+
func ConvertAlphaToBetaWebhookSecrets(src *ArgoCDWebhookSecretsSpec) *v1beta1.ArgoCDWebhookSecretsSpec {
1047+
if src == nil {
1048+
return nil
1049+
}
1050+
dst := &v1beta1.ArgoCDWebhookSecretsSpec{}
1051+
if src.GitHub != nil {
1052+
dst.GitHub = &v1beta1.ArgoCDWebhookSecretsGitHub{}
1053+
if src.GitHub.SecretRef != nil {
1054+
dst.GitHub.SecretRef = &v1beta1.WebhookSecretKeySelector{
1055+
Name: src.GitHub.SecretRef.Name,
1056+
Key: src.GitHub.SecretRef.Key,
1057+
}
1058+
}
1059+
}
1060+
return dst
1061+
}
1062+
1063+
// ConvertBetaToAlphaWebhookSecrets converts webhook secret refs from v1beta1 to v1alpha1.
1064+
func ConvertBetaToAlphaWebhookSecrets(src *v1beta1.ArgoCDWebhookSecretsSpec) *ArgoCDWebhookSecretsSpec {
1065+
if src == nil {
1066+
return nil
1067+
}
1068+
dst := &ArgoCDWebhookSecretsSpec{}
1069+
if src.GitHub != nil {
1070+
dst.GitHub = &ArgoCDWebhookSecretsGitHub{}
1071+
if src.GitHub.SecretRef != nil {
1072+
dst.GitHub.SecretRef = &WebhookSecretKeySelector{
1073+
Name: src.GitHub.SecretRef.Name,
1074+
Key: src.GitHub.SecretRef.Key,
1075+
}
1076+
}
1077+
}
1078+
return dst
1079+
}
1080+
10431081
func ConvertAlphaToBetaNamespaceManagement(src []ManagedNamespaces) []v1beta1.ManagedNamespaces {
10441082
var dst []v1beta1.ManagedNamespaces
10451083
for _, s := range src {

‎api/v1alpha1/argocd_types.go‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -887,6 +887,10 @@ type ArgoCDSpec struct {
887887

888888
// NamespaceManagement defines the list of namespaces that Argo CD is allowed to manage.
889889
NamespaceManagement []ManagedNamespaces `json:"namespaceManagement,omitempty"`
890+
891+
// WebhookSecrets references Kubernetes Secrets that supply webhook credentials per provider.
892+
// The operator syncs values into argocd-secret under the keys Argo CD expects.
893+
WebhookSecrets *ArgoCDWebhookSecretsSpec `json:"webhookSecrets,omitempty"`
890894
}
891895

892896
// NamespaceManagement defines the namespace management settings
@@ -898,6 +902,31 @@ type ManagedNamespaces struct {
898902
AllowManagedBy bool `json:"allowManagedBy"`
899903
}
900904

905+
// ArgoCDWebhookSecretsSpec holds declarative references to Secrets for Git provider webhook credentials.
906+
// +k8s:openapi-gen=true
907+
type ArgoCDWebhookSecretsSpec struct {
908+
// GitHub: Secret key reference for the webhook secret used to verify incoming webhook requests.
909+
GitHub *ArgoCDWebhookSecretsGitHub `json:"github,omitempty"`
910+
}
911+
912+
// ArgoCDWebhookSecretsGitHub declares where to read the GitHub webhook secret.
913+
// +k8s:openapi-gen=true
914+
type ArgoCDWebhookSecretsGitHub struct {
915+
// SecretRef points to the key holding the webhook secret value.
916+
SecretRef *WebhookSecretKeySelector `json:"secretRef,omitempty"`
917+
}
918+
919+
// WebhookSecretKeySelector references one key within a Secret.
920+
// +k8s:openapi-gen=true
921+
type WebhookSecretKeySelector struct {
922+
// Name of the Secret.
923+
// +kubebuilder:validation:Required
924+
Name string `json:"name"`
925+
// Key in the Secret whose value should be used.
926+
// +kubebuilder:validation:Required
927+
Key string `json:"key"`
928+
}
929+
901930
const (
902931
ArgoCDConditionType = "Reconciled"
903932
)

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 60 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/v1beta1/argocd_types.go‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1069,6 +1069,10 @@ type ArgoCDSpec struct {
10691069

10701070
// NamespaceManagement defines the list of namespaces that Argo CD is allowed to manage.
10711071
NamespaceManagement []ManagedNamespaces `json:"namespaceManagement,omitempty"`
1072+
1073+
// WebhookSecrets references Kubernetes Secrets that supply webhook credentials per provider.
1074+
// The operator syncs values into argocd-secret under the keys Argo CD expects.
1075+
WebhookSecrets *ArgoCDWebhookSecretsSpec `json:"webhookSecrets,omitempty"`
10721076
}
10731077

10741078
// NamespaceManagement defines the namespace management settings
@@ -1080,6 +1084,31 @@ type ManagedNamespaces struct {
10801084
AllowManagedBy bool `json:"allowManagedBy"`
10811085
}
10821086

1087+
// ArgoCDWebhookSecretsSpec holds declarative references to Secrets for Git provider webhook credentials.
1088+
// +k8s:openapi-gen=true
1089+
type ArgoCDWebhookSecretsSpec struct {
1090+
// GitHub: Secret key reference for the webhook secret used to verify incoming webhook requests.
1091+
GitHub *ArgoCDWebhookSecretsGitHub `json:"github,omitempty"`
1092+
}
1093+
1094+
// ArgoCDWebhookSecretsGitHub declares where to read the GitHub webhook secret.
1095+
// +k8s:openapi-gen=true
1096+
type ArgoCDWebhookSecretsGitHub struct {
1097+
// SecretRef points to the key holding the webhook secret value.
1098+
SecretRef *WebhookSecretKeySelector `json:"secretRef,omitempty"`
1099+
}
1100+
1101+
// WebhookSecretKeySelector references one key within a Secret.
1102+
// +k8s:openapi-gen=true
1103+
type WebhookSecretKeySelector struct {
1104+
// Name of the Secret.
1105+
// +kubebuilder:validation:Required
1106+
Name string `json:"name"`
1107+
// Key in the Secret whose value should be used.
1108+
// +kubebuilder:validation:Required
1109+
Key string `json:"key"`
1110+
}
1111+
10831112
const OpenShiftOAuthErrorMessage = "OpenShiftOAuth is not supported when external authentication is enabled on cluster, please provide OIDC config"
10841113
const (
10851114
ArgoCDConditionType = "Reconciled"

‎api/v1beta1/zz_generated.deepcopy.go‎

Lines changed: 60 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎bundle/manifests/argoproj.io_argocds.yaml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8755,6 +8755,31 @@ spec:
87558755
description: Version is the tag to use with the ArgoCD container image
87568756
for all ArgoCD components.
87578757
type: string
8758+
webhookSecrets:
8759+
description: |-
8760+
WebhookSecrets references Kubernetes Secrets that supply webhook credentials per provider.
8761+
The operator syncs values into argocd-secret under the keys Argo CD expects.
8762+
properties:
8763+
github:
8764+
description: 'GitHub: Secret key reference for the webhook secret
8765+
used to verify incoming webhook requests.'
8766+
properties:
8767+
secretRef:
8768+
description: SecretRef points to the key holding the webhook
8769+
secret value.
8770+
properties:
8771+
key:
8772+
description: Key in the Secret whose value should be used.
8773+
type: string
8774+
name:
8775+
description: Name of the Secret.
8776+
type: string
8777+
required:
8778+
- key
8779+
- name
8780+
type: object
8781+
type: object
8782+
type: object
87588783
type: object
87598784
status:
87608785
description: ArgoCDStatus defines the observed state of ArgoCD
@@ -32224,6 +32249,31 @@ spec:
3222432249
description: Version is the tag to use with the ArgoCD container image
3222532250
for all ArgoCD components.
3222632251
type: string
32252+
webhookSecrets:
32253+
description: |-
32254+
WebhookSecrets references Kubernetes Secrets that supply webhook credentials per provider.
32255+
The operator syncs values into argocd-secret under the keys Argo CD expects.
32256+
properties:
32257+
github:
32258+
description: 'GitHub: Secret key reference for the webhook secret
32259+
used to verify incoming webhook requests.'
32260+
properties:
32261+
secretRef:
32262+
description: SecretRef points to the key holding the webhook
32263+
secret value.
32264+
properties:
32265+
key:
32266+
description: Key in the Secret whose value should be used.
32267+
type: string
32268+
name:
32269+
description: Name of the Secret.
32270+
type: string
32271+
required:
32272+
- key
32273+
- name
32274+
type: object
32275+
type: object
32276+
type: object
3222732277
type: object
3222832278
x-kubernetes-validations:
3222932279
- message: spec.sso and spec.oidcConfig cannot both be set

‎common/keys.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,9 @@ const (
131131
// ArgoCDKeyServerSecretKey is the server secret key property name for the Argo secret.
132132
ArgoCDKeyServerSecretKey = "server.secretkey"
133133

134+
// ArgoCDKeyGitHubWebhookSecret is the key in argocd-secret for the GitHub webhook shared secret (see Argo CD settings).
135+
ArgoCDKeyGitHubWebhookSecret = "webhook.github.secret" // #nosec G101
136+
134137
// ArgoCDKeyServerURL is the key for server url.
135138
ArgoCDKeyServerURL = "url"
136139

0 commit comments

Comments
 (0)