Repository navigation
Update argocd.md - #778
Update argocd.md#778
Conversation
WalkthroughReorganized and expanded the ArgoCD toolset docs: added Prerequisites (token generation, RBAC), split Configuration into Port Forwarding and Server URL modes, added Holmes CLI and Helm Chart usage examples, expanded capabilities list, and added security and testing notes. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Suggested reviewers
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🔭 Outside diff range comments (1)
docs/data-sources/builtin-toolsets/argocd.md (1)
12-34: Limit HolmesGPT’s Token-Generation Rights for True Read-Only AccessThe current RBAC snippet still grants HolmesGPT the ability to create API tokens, which exceeds a pure “read-only” posture and may lead to least-privilege violations if copy-pasted without review. Please either mark the token-generation rule as optional or document why it’s needed.
• File: docs/data-sources/builtin-toolsets/argocd.md
• Lines: 12–34Suggested diff:
data: policy.default: role:readonly policy.csv: | p, role:admin, *, *, *, allow p, role:admin, accounts, apiKey, *, allow - p, holmesgpt, accounts, apiKey, holmesgpt, allow + # Optional – only include if HolmesGPT must generate its own ArgoCD API token + p, holmesgpt, accounts, apiKey, holmesgpt, allow p, holmesgpt, projects, get, *, allow p, holmesgpt, applications, get, *, allow … g, admin, role:adminAdditionally, add a note above the snippet explaining why token-creation rights are required (or omit the rule for strictly read-only use).
🧹 Nitpick comments (3)
docs/data-sources/builtin-toolsets/argocd.md (3)
41-46: Indentation triggers MD046 – interpreted as an “indented code block”The four-space indent before regular text (“Set the following…”) is parsed by Markdown as a code block, causing markdownlint failure and rendering quirks outside MkDocs-Material tab syntax.
Quick fix:
- Set the following environment variable and the ArgoCD toolset will be automatically enabled: +Set the following environment variable and the ArgoCD toolset will be automatically enabled:Repeat for any non-code lines inside the tab. If you rely on the indent for tabbing, wrap the entire tab body in a fenced block (
~~~) per MkDocs-Material guidance or disable MD046 locally:<!-- markdownlint-disable-next-line MD046 -->
65-75: Same MD046 issue inside Helm Chart tabThe Helm values snippet is fenced correctly, but the surrounding explanatory text is indented four spaces, again flagged by markdownlint. Apply the same un-indent or lint-ignore pattern as above for consistency and successful CI.
43-45: Shell history leakage warningExporting
ARGOCD_AUTH_TOKENdirectly may leave the token in users’ shell history. Add a brief caution or point users toread -s/envsubst/ secret-manager alternatives (you already hint at secrets for Helm). A one-liner note here improves security hygiene.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
docs/data-sources/builtin-toolsets/argocd.md(2 hunks)
🧰 Additional context used
🧠 Learnings (3)
📚 Learning: applies to holmes/plugins/toolsets/**/*.yaml : toolsets must be placed in holmes/plugins/toolsets/{n...
Learnt from: CR
PR: robusta-dev/holmesgpt#0
File: CLAUDE.md:0-0
Timestamp: 2025-08-03T07:25:36.018Z
Learning: Applies to holmes/plugins/toolsets/**/*.yaml : Toolsets must be placed in holmes/plugins/toolsets/{name}.yaml or {name}/
Applied to files:
docs/data-sources/builtin-toolsets/argocd.md
📚 Learning: the robusta-dev/holmesgpt codebase has comprehensive existing validation for azure environment varia...
Learnt from: nherment
PR: robusta-dev/holmesgpt#610
File: .github/workflows/llm-evaluation.yaml:39-42
Timestamp: 2025-07-08T08:45:41.069Z
Learning: The robusta-dev/holmesgpt codebase has comprehensive existing validation for Azure environment variables (AZURE_API_BASE, AZURE_API_KEY, AZURE_API_VERSION) and MODEL in tests/llm/utils/classifiers.py, tests/llm/conftest.py, and holmes/core/llm.py. Don't suggest adding redundant validation logic.
Applied to files:
docs/data-sources/builtin-toolsets/argocd.md
📚 Learning: when suggesting improvements to environment variable handling in robusta-dev/holmesgpt, check first ...
Learnt from: nherment
PR: robusta-dev/holmesgpt#610
File: .github/workflows/llm-evaluation.yaml:39-42
Timestamp: 2025-07-08T08:45:41.069Z
Learning: When suggesting improvements to environment variable handling in robusta-dev/holmesgpt, check first if validation logic already exists rather than reimplementing it.
Applied to files:
docs/data-sources/builtin-toolsets/argocd.md
🪛 markdownlint-cli2 (0.17.2)
docs/data-sources/builtin-toolsets/argocd.md
41-41: Code block style
Expected: fenced; Actual: indented
(MD046, code-block-style)
65-65: Code block style
Expected: fenced; Actual: indented
(MD046, code-block-style)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Pre-commit checks
- GitHub Check: llm_evals
- GitHub Check: Pre-commit checks
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (6)
docs/data-sources/builtin-toolsets/argocd.md (6)
39-41: Clarify connection modes and env-vars; mention ARGOCD_INSECURE as an alternative.Consider explicitly labeling “Server URL (ARGOCD_SERVER)” and noting “ARGOCD_INSECURE=true” as an alternative to putting “--insecure” into ARGOCD_OPTS.
48-66: Fix markdownlint MD046: indented code blocks inside tabs.mkdocs tabs require 4-space indentation, which triggers MD046. Suppress the rule locally to keep tabs rendering correctly.
+<!-- markdownlint-disable MD046 --> === "Holmes CLI" Set the following environment variables: ```bash export ARGOCD_AUTH_TOKEN="<your-argocd-token>" export ARGOCD_OPTS="--port-forward --port-forward-namespace <your_argocd_namespace> --server <your_server_address> --grpc-web" ``` Then add the following to **~/.holmes/config.yaml**: ```yaml toolsets: argocd/core: enabled: true ``` --8<-- "snippets/toolset_refresh_warning.md" === "Robusta Helm Chart" @@ - ``` + ``` +<!-- markdownlint-enable MD046 -->Repeat the same wrapping for the “Server URL” tabbed sections.
Also applies to: 69-86, 99-116, 124-138
69-86: Use Kubernetes Secrets in Helm values with valueFrom to avoid plaintext tokens.You already note to prefer secrets. Provide a concrete example so users can copy-paste safely.
holmes: - additionalEnvVars: - - name: ARGOCD_AUTH_TOKEN - value: "<your-argocd-token>" - - name: ARGOCD_OPTS - value: "--port-forward --port-forward-namespace <your_argocd_namespace> --server <your_server_address> --grpc-web" + additionalEnvVars: + - name: ARGOCD_AUTH_TOKEN + valueFrom: + secretKeyRef: + name: holmes-argocd + key: authToken + - name: ARGOCD_OPTS + value: "--port-forward --port-forward-namespace <your_argocd_namespace> --server <your_server_address> --grpc-web"Document creating the secret:
kubectl create secret generic holmes-argocd -n <ns> --from-literal=authToken='<your-argocd-token>'
87-94: Offer ARGOCD_INSECURE as env-var alternative in the note.Add: “Alternatively, set ARGOCD_INSECURE=true instead of appending --insecure to ARGOCD_OPTS.”
124-138: Secret-based Helm values for Server URL as well.Mirror the secret-based approach here too, to keep both modes consistent.
holmes: - additionalEnvVars: - - name: ARGOCD_AUTH_TOKEN - value: "<your-argocd-token>" - - name: ARGOCD_SERVER - value: "argocd.example.com" + additionalEnvVars: + - name: ARGOCD_AUTH_TOKEN + valueFrom: + secretKeyRef: + name: holmes-argocd + key: authToken + - name: ARGOCD_SERVER + value: "argocd.example.com"
39-41: Consistency: use the canonical “Argo CD” spelling.Consider standardizing to “Argo CD” (with a space) across headings and text.
Also applies to: 95-99, 150-160
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
docs/assets/Holmes_ArgoCD_demo.gifis excluded by!**/*.gif
📒 Files selected for processing (1)
docs/data-sources/builtin-toolsets/argocd.md(2 hunks)
🧰 Additional context used
🪛 LanguageTool
docs/data-sources/builtin-toolsets/argocd.md
[style] ~139-~139: Using many exclamation marks might seem excessive (in this case: 6 exclamation marks for a text that’s 2446 characters long)
Context: ...<-- "snippets/helm_upgrade_command.md" !!! note In production, always use a K...
(EN_EXCESSIVE_EXCLAMATION)
🪛 markdownlint-cli2 (0.17.2)
docs/data-sources/builtin-toolsets/argocd.md
50-50: Code block style
Expected: fenced; Actual: indented
(MD046, code-block-style)
69-69: Code block style
Expected: fenced; Actual: indented
(MD046, code-block-style)
89-89: Code block style
Expected: fenced; Actual: indented
(MD046, code-block-style)
101-101: Code block style
Expected: fenced; Actual: indented
(MD046, code-block-style)
126-126: Code block style
Expected: fenced; Actual: indented
(MD046, code-block-style)
142-142: Code block style
Expected: fenced; Actual: indented
(MD046, code-block-style)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Pre-commit checks
- GitHub Check: llm_evals
- GitHub Check: Pre-commit checks
🔇 Additional comments (1)
docs/data-sources/builtin-toolsets/argocd.md (1)
150-160: All documented ArgoCD tool names are correctly registered
I’ve cross-checkeddocs/data-sources/builtin-toolsets/argocd.mdagainstholmes/plugins/toolsets/argocd.yamland confirmed that eachargocd_*capability listed (app_list, app_get, app_manifests, app_resources, app_diff, app_history, repo_list, proj_list, proj_get, cluster_list) exactly matches a registered tool. No discrepancies found.
2 participants
No description provided.