mirror of
https://github.com/argoproj/argo-cd
synced 2026-04-21 17:07:16 +00:00
parent
c914ea0218
commit
09f3b45e39
10 changed files with 26 additions and 26 deletions
18
CHANGELOG.md
18
CHANGELOG.md
|
|
@ -442,7 +442,7 @@ https://youtu.be/GP7xtrnNznw
|
|||
|
||||
##### Orphan Resources
|
||||
|
||||
Some users would like to make sure that resources in a namespace are managed only by Argo CD. So we've introduced the concept of an "orphan resource" - any resource that is in namespace associated with an app, but not managed by Argo CD. This is enabled in the project settings. Once enabled, Argo CD will show in the app view any resources in the app's namepspace that is not mananged by Argo CD.
|
||||
Some users would like to make sure that resources in a namespace are managed only by Argo CD. So we've introduced the concept of an "orphan resource" - any resource that is in namespace associated with an app, but not managed by Argo CD. This is enabled in the project settings. Once enabled, Argo CD will show in the app view any resources in the app's namespace that is not managed by Argo CD.
|
||||
|
||||
https://youtu.be/9ZoTevVQf5I
|
||||
|
||||
|
|
@ -485,7 +485,7 @@ There may be instances when you want to control the times during which an Argo C
|
|||
#### Bug Fixes
|
||||
|
||||
- failed parsing on parameters with comma (#1660)
|
||||
- Statefuleset with OnDelete Update Strategy stuck progressing (#1881)
|
||||
- Statefulset with OnDelete Update Strategy stuck progressing (#1881)
|
||||
- Warning during secret diffing (#1923)
|
||||
- Error message "Unable to load data: key is missing" is confusing (#1944)
|
||||
- OIDC group bindings are truncated (#2006)
|
||||
|
|
@ -524,7 +524,7 @@ There may be instances when you want to control the times during which an Argo C
|
|||
- Creating an application from Helm repository should select "Helm" as source type (#2378)
|
||||
- The parameters of ValidateAccess GRPC method should not be logged (#2386)
|
||||
- Maintenance window meaning is confusing (#2398)
|
||||
- UI bug when targetRevision is ommited (#2407)
|
||||
- UI bug when targetRevision is omitted (#2407)
|
||||
- Too many vulnerabilities in Docker image (#2425)
|
||||
- proj windows commands not consistent with other commands (#2443)
|
||||
- Custom resource actions cannot be executed from the UI (#2448)
|
||||
|
|
@ -618,7 +618,7 @@ Support for Git LFS enabled repositories - now you can store Helm charts as tar
|
|||
+ Added 'SyncFail' to possible HookTypes in UI (#2147)
|
||||
+ Support for Git LFS enabled repositories (#1853)
|
||||
+ Server certificate and known hosts management (#1514)
|
||||
+ Client HTTPS certifcates for private git repositories (#1945)
|
||||
+ Client HTTPS certificates for private git repositories (#1945)
|
||||
+ Badge for application status (#1435)
|
||||
+ Make the health check for APIService a built in (#1841)
|
||||
+ Bitbucket Server and Gogs webhook providers (#1269)
|
||||
|
|
@ -658,7 +658,7 @@ Support for Git LFS enabled repositories - now you can store Helm charts as tar
|
|||
- Fix history api fallback implementation to support app names with dots (#2114)
|
||||
- Fixes some code issues related to Kustomize build options. (#2146)
|
||||
- Adds checks around valid paths for apps (#2133)
|
||||
- Enpoint incorrectly considered top level managed resource (#2060)
|
||||
- Endpoint incorrectly considered top level managed resource (#2060)
|
||||
- Allow adding certs for hostnames ending on a dot (#2116)
|
||||
|
||||
#### Other
|
||||
|
|
@ -981,7 +981,7 @@ Argo CD introduces some additional CLI commands:
|
|||
#### Label selector changes, dex-server rename
|
||||
|
||||
The label selectors for deployments were been renamed to use kubernetes common labels
|
||||
(`app.kuberentes.io/name=NAME` instead of `app=NAME`). Since K8s deployment label selectors are
|
||||
(`app.kubernetes.io/name=NAME` instead of `app=NAME`). Since K8s deployment label selectors are
|
||||
immutable, during an upgrade from v0.11 to v0.12, the old deployments should be deleted using
|
||||
`--cascade=false` which allows the new deployments to be created without introducing downtime.
|
||||
Once the new deployments are ready, the older replicasets can be deleted. Use the following
|
||||
|
|
@ -1078,7 +1078,7 @@ has a minimum client version of v0.12.0. Older CLI clients will be rejected.
|
|||
- Fix CRD creation/deletion handling (#1249)
|
||||
- Git cloning via SSH was not verifying host public key (#1276)
|
||||
- Fixed multiple goroutine leaks in controller and api-server
|
||||
- Fix isssue where `argocd app set -p` required repo privileges. (#1280)
|
||||
- Fix issue where `argocd app set -p` required repo privileges. (#1280)
|
||||
- Fix local diff of non-namespaced resources. Also handle duplicates in local diff (#1289)
|
||||
- Deprecated resource kinds from 'extensions' groups are not reconciled correctly (#1232)
|
||||
- Fix issue where CLI would panic after timeout when cli did not have get permissions (#1209)
|
||||
|
|
@ -1256,7 +1256,7 @@ which have a dependency to external helm repositories.
|
|||
|
||||
+ Allow more fine-grained sync (issue #508)
|
||||
+ Display init container logs (issue #681)
|
||||
+ Redirect to /auth/login instead of /login when SSO token is used for authenticaion (issue #348)
|
||||
+ Redirect to /auth/login instead of /login when SSO token is used for authentication (issue #348)
|
||||
+ Support ability to use a helm values files from a URL (issue #624)
|
||||
+ Support public not-connected repo in app creation UI (issue #426)
|
||||
+ Use ksonnet CLI instead of ksonnet libs (issue #626)
|
||||
|
|
@ -1531,7 +1531,7 @@ RBAC policy rules, need to be rewritten to include one extra column with the eff
|
|||
+ Sync/Rollback/Delete is asynchronously handled by controller
|
||||
* Refactor CRUD operation on clusters and repos
|
||||
* Sync will always perform kubectl apply
|
||||
* Synced Status considers last-applied-configuration annotatoin
|
||||
* Synced Status considers last-applied-configuration annotation
|
||||
* Server & namespace are mandatory fields (still inferred from app.yaml)
|
||||
* Manifests are memoized in repo server
|
||||
- Fix connection timeouts to SSH repos
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
Lots of issues on our issue tracker. Many of them not bugs, but questions,
|
||||
or very environment related. It's easy to lose oversight.
|
||||
|
||||
Also, it's not obvous which bugs are important. Which bugs should be fixed
|
||||
Also, it's not obvious which bugs are important. Which bugs should be fixed
|
||||
first? Can we make a new release with the current inventory of open bugs?
|
||||
Is there still a bug that should make it to the new release?
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ If you want to to submit a PR, please read this document carefully, as it contai
|
|||
|
||||
As is the case with the development process, this document is under constant change. If you notice any error, or if you think this document is out-of-date, or if you think it is missing something: Feel free to submit a PR or submit a bug to our GitHub issue tracker.
|
||||
|
||||
If you need guidance with submitting a PR, or have any other questions regarding development of ArgoCD, do not hestitate to [join our Slack](https://argoproj.github.io/community/join-slack) and get in touch with us in the `#argo-dev` channel!
|
||||
If you need guidance with submitting a PR, or have any other questions regarding development of ArgoCD, do not hesitate to [join our Slack](https://argoproj.github.io/community/join-slack) and get in touch with us in the `#argo-dev` channel!
|
||||
|
||||
## Before you start
|
||||
|
||||
|
|
@ -34,7 +34,7 @@ The Docker version must be fairly recent, and support multi-stage builds. You sh
|
|||
|
||||
When you submit a PR against ArgoCD's GitHub repository, a couple of CI checks will be run automatically to ensure your changes will build fine and meet certain quality standards. Your contribution needs to pass those checks in order to be merged into the repository.
|
||||
|
||||
In general, it might be benefical to only submit a PR for an existing issue. Especially for larger changes, an Enhancement Proposal should exist before.
|
||||
In general, it might be beneficial to only submit a PR for an existing issue. Especially for larger changes, an Enhancement Proposal should exist before.
|
||||
|
||||
!!!note
|
||||
|
||||
|
|
@ -46,7 +46,7 @@ The following read will help you to submit a PR that meets the standards of our
|
|||
|
||||
### Title of the PR
|
||||
|
||||
Please use a meaningful and consise title for your PR. This will help us to pick PRs for review quickly, and the PR title will also end up in the Changelog.
|
||||
Please use a meaningful and concise title for your PR. This will help us to pick PRs for review quickly, and the PR title will also end up in the Changelog.
|
||||
|
||||
We use the [Semantic PR title checker](https://github.com/zeke/semantic-pull-requests) to categorize your PR into one of the following categories:
|
||||
|
||||
|
|
@ -162,7 +162,7 @@ When you have developed and possibly manually tested the code you want to contri
|
|||
|
||||
### Pull in all build dependencies
|
||||
|
||||
As build dependencies change over time, you have to synchronize your development environment with the current specification. In order to pull in all required depencies, issue:
|
||||
As build dependencies change over time, you have to synchronize your development environment with the current specification. In order to pull in all required dependencies, issue:
|
||||
|
||||
* `make dep-ui`
|
||||
|
||||
|
|
@ -216,7 +216,7 @@ For development, you can either use the fully virtualized toolchain provided as
|
|||
!!!note
|
||||
The installations instructions are valid for Linux hosts only. Mac instructions will follow shortly.
|
||||
|
||||
For installing the tools required to build and test ArgoCD on your local system, we provide convinient installer scripts. By default, they will install binaries to `/usr/local/bin` on your system, which might require `root` privileges.
|
||||
For installing the tools required to build and test ArgoCD on your local system, we provide convenient installer scripts. By default, they will install binaries to `/usr/local/bin` on your system, which might require `root` privileges.
|
||||
|
||||
You can change the target location by setting the `BIN` environment before running the installer scripts. For example, you can install the binaries into `~/go/bin` (which should then be the first component in your `PATH` environment, i.e. `export PATH=~/go/bin:$PATH`):
|
||||
|
||||
|
|
|
|||
|
|
@ -447,7 +447,7 @@ tlsClientConfig:
|
|||
# PEM-encoded bytes (typically read from a client certificate key file).
|
||||
keyData: string
|
||||
# ServerName is passed to the server for SNI and is used in the client to check server
|
||||
# ceritificates against. If ServerName is empty, the hostname used to contact the
|
||||
# certificates against. If ServerName is empty, the hostname used to contact the
|
||||
# server is used.
|
||||
serverName: string
|
||||
```
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
## Overview
|
||||
Argo CD provides built-in health assessment for several standard Kubernetes types, which is then
|
||||
surfaced to the overall Application health status as a whole. The following checks are made for
|
||||
specific types of kuberentes resources:
|
||||
specific types of kubernetes resources:
|
||||
|
||||
### Deployment, ReplicaSet, StatefulSet DaemonSet
|
||||
* Observed generation is equal to desired generation.
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# Security
|
||||
|
||||
Argo CD has undergone rigourous internal security reviews and penetration testing to satisfy [PCI
|
||||
Argo CD has undergone rigorous internal security reviews and penetration testing to satisfy [PCI
|
||||
compliance](https://www.pcisecuritystandards.org) requirements. The following are some security
|
||||
topics and implementation details of Argo CD.
|
||||
|
||||
|
|
@ -17,7 +17,7 @@ in one of the following ways:
|
|||
|
||||
2. For Single Sign-On users, the user completes an OAuth2 login flow to the configured OIDC identity
|
||||
provider (either delegated through the bundled Dex provider, or directly to a self-managed OIDC
|
||||
provider). This JWT is signed & issued by the IDP, and expiration and revokation is handled by
|
||||
provider). This JWT is signed & issued by the IDP, and expiration and revocation is handled by
|
||||
the provider. Dex tokens expire after 24 hours.
|
||||
|
||||
3. Automation tokens are generated for a project using the `/api/v1/projects/{project}/roles/{role}/token`
|
||||
|
|
@ -60,7 +60,7 @@ The information is used to reconstruct a REST config and kubeconfig to the clust
|
|||
services.
|
||||
|
||||
To rotate the bearer token used by Argo CD, the token can be deleted (e.g. using kubectl) which
|
||||
causes kuberentes to generate a new secret with a new bearer token. The new token can be re-inputted
|
||||
causes kubernetes to generate a new secret with a new bearer token. The new token can be re-inputted
|
||||
to Argo CD by re-running `argocd cluster add`. Run the following commands against the *_managed_*
|
||||
cluster:
|
||||
|
||||
|
|
@ -83,7 +83,7 @@ argocd cluster rm https://your-kubernetes-cluster-addr
|
|||
<!-- markdownlint-disable MD027 -->
|
||||
> NOTE: for AWS EKS clusters, [aws-iam-authenticator](https://github.com/kubernetes-sigs/aws-iam-authenticator)
|
||||
is used to authenticate to the external cluster, which uses IAM roles in lieu of locally stored
|
||||
tokens, so token rotation is not needed, and revokation is handled through IAM.
|
||||
tokens, so token rotation is not needed, and revocation is handled through IAM.
|
||||
<!-- markdownlint-enable MD027 -->
|
||||
|
||||
## Cluster RBAC
|
||||
|
|
|
|||
|
|
@ -41,7 +41,7 @@ data:
|
|||
- openid
|
||||
- profile
|
||||
- email
|
||||
# not strictly nesscessary - but good practice:
|
||||
# not strictly necessary - but good practice:
|
||||
- 'http://your.domain/groups'
|
||||
...
|
||||
```
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ A working Single Sign-On configuration using Okta via at least two methods was a
|
|||
|
||||
1. Create a new SAML application in Okta UI.
|
||||
* 
|
||||
I've disabled `App Visibility` because Dex doesn't support Provider-initated login flows.
|
||||
I've disabled `App Visibility` because Dex doesn't support Provider-initiated login flows.
|
||||
* 
|
||||
1. Click `View setup instructions` after creating the application in Okta.
|
||||
* 
|
||||
|
|
@ -50,7 +50,7 @@ dex.config: |
|
|||
## OIDC (without Dex)
|
||||
|
||||
!!! warning "Do you want groups for RBAC later?"
|
||||
If you want `groups` scope returned from Okta you need to unforunately contact support to enable [API Access Management with Okta](https://developer.okta.com/docs/concepts/api-access-management/) or [_just use SAML above!_](#saml-with-dex)
|
||||
If you want `groups` scope returned from Okta you need to unfortunately contact support to enable [API Access Management with Okta](https://developer.okta.com/docs/concepts/api-access-management/) or [_just use SAML above!_](#saml-with-dex)
|
||||
|
||||
Next you may need the API Access Management feature, which the support team can enable for your OktaPreview domain for testing, to enable "custom scopes" and a separate endpoint to use instead of the "public" `/oauth2/v1/authorize` API Access Management endpoint. This might be a paid feature if you want OIDC unfortunately. The free alternative I found was SAML.
|
||||
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ Before enabling feature you might consider disabling warning. In this case appli
|
|||
|
||||
## Exceptions
|
||||
|
||||
Not every resource in the Kuberenetes cluster is controlled by the end user. Following resources are never considered as orphaned:
|
||||
Not every resource in the Kubernetes cluster is controlled by the end user. Following resources are never considered as orphaned:
|
||||
|
||||
* Namespaced resources blacklisted in the project. Usually, such resources are managed by cluster administrators and not supposed to be modified by namespace user.
|
||||
* `ServiceAccount` with name `default` ( and corresponding auto-generated `ServiceAccountToken` ).
|
||||
|
|
|
|||
|
|
@ -36,7 +36,7 @@ metadata:
|
|||
argocd.argoproj.io/sync-options: Validate=false
|
||||
```
|
||||
|
||||
If you want to exclude a whole class of objects globally, consider setting `resource.customizations` in [system level configuation](../user-guide/diffing.md#system-level-configuration).
|
||||
If you want to exclude a whole class of objects globally, consider setting `resource.customizations` in [system level configuration](../user-guide/diffing.md#system-level-configuration).
|
||||
|
||||
## Skip Dry Run for new custom resources types
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue