Net 5229 create dedicated argocd stanza

[asheshvidyut]

Changes proposed in this PR:

• Add support for global.argocd.enabled flag in values.yaml which adds the

        "argocd.argoproj.io/hook": "Sync"
        "argocd.argoproj.io/hook-delete-policy": "HookSucceeded"

in the jobs -
server-acl-init-job

How I've tested this PR:

• Bats Tests
  Manual Tests -
• Created github pages to host helm charts following this medium article
• Forked the repo and created a new branch - https://github.com/absolutelightning/consul-minikubes/tree/test-argocd.
• Updated the repo with values from github helm charts created in step 1
• Ran bash argocd.sh
• kubectl port-forward svc/argocd-server -n argocd 8087:443
• argocd admin initial-password -n argocd
• Input username - admin and password output from previous step in UI at localhost:8087.
• Recorded video

demoargocd.mov

Checklist:

• Tests added
• CHANGELOG entry added

[Ganeshrockz]

LGTM

[lkysow]

I don't think you need those annotations on all the jobs, just the jobs that don't have helm hook annotations already: https://argo-cd.readthedocs.io/en/stable/user-guide/helm/#helm-hooks

Argo CD supports many (most?) Helm hooks by mapping the Helm annotations onto Argo CD's own hook annotations:

Also how can we ensure Jobs in the future get this hook added? Can you write a test that ensures Job's that don't have helm hook annotations also have this argocd stanza.

[asheshvidyut]

Hey @lkysow, I have trouble understanding your comment.

1. I checked this link I need argocd.argoproj.io/hook: Sync The documentation doesn't have - it only has PreSync.
2. How can I write test for job which will come in future. Is there a way?

[lkysow]

Have you tried this out? I don't think it will work as written. For example, the gateway cleanup job is marked as a pre-delete job but this change maps it to an argocd Sync hook. So previously the hook would only run right before the user deletes consul but now it's running every single time they do a deploy of the helm chart.

The gateway-resources job is marked at post-install,post-upgrade which based on the docs is automatically mapped to an argocd PostSync but your change makes it Sync. Same for server-acl-init-cleanup.

I think you don't need to touch the gateway resources or server-acl-init-cleaup jobs but would be best to test that and verify. For the gateway-cleanup job I'm not exactly sure what that does so will need to investigate.

In terms of testing, I was thinking a test similar to

consul-k8s/charts/consul/test/unit/helpers.bats

Lines 90 to 134 in e5ad447

	#--------------------------------------------------------------------
	# template consul.fullname
	#
	# This test ensures that we use {{ template "consul.fullname" }} everywhere instead of
	# {{ .Release.Name }} because that's required in order to support the name
	# override settings fullnameOverride and global.name. In some cases, we need to
	# use .Release.Name. In those cases, add your exception to this list.
	#
	# If this test fails, you're likely using {{ .Release.Name }} where you should
	# be using {{ template "consul.fullname" }}
	@test "helper/consul.fullname: used everywhere" {
	cd `chart_dir`
	# Grep for uses of .Release.Name that aren't using it as a label.
	local actual=$(grep -r '{{ .Release.Name }}' templates/*.yaml | grep -v -E 'release: |-release-name=' | tee /dev/stderr )
	[ "${actual}" = '' ]
	}
	#--------------------------------------------------------------------
	# template namespace
	#
	# This test ensures that we set "namespace: " in every file. The exceptions are files with CRDs and clusterroles and
	# clusterrolebindings.
	#
	# If this test fails, you're likely missing setting the namespace.
	@test "helper/namespace: used everywhere" {
	cd `chart_dir`
	# Grep for files that don't have 'namespace: ' in them
	local actual=$(grep -L 'namespace: ' templates/*.yaml | grep -v 'crd' | grep -v 'clusterrole' | grep -v 'gateway-gateway' | tee /dev/stderr )
	[ "${actual}" = '' ]
	}
	#--------------------------------------------------------------------
	# component label
	#
	# This test ensures that we set a "component: <blah>" in every file.
	#
	# If this test fails, you're likely missing setting that label somewhere.
	@test "helper/component-label: used everywhere" {
	cd `chart_dir`
	# Grep for files that don't have 'component: ' in them
	local actual=$(grep -L 'component: ' templates/*.yaml | tee /dev/stderr )
	[ "${actual}" = '' ]
	}

which checks that all files that have a Job either have helm hook annotations or the argocd templating. So that if someone adds a Job in the future without either of those annotations that the test will fail to remind them to add one of the annotations.

[curtbushko]

I think this needs to be tested with a Kind cluster and ArgoCD, there are too many unknowns.

Here is a script that you can use as a starting point for setting everything up...

[lkysow]

Great work!

[david-yu]

Added backports to the PR.

[david-yu]

@absolutelightning Could you make sure this gets backported? Thank you!

[asheshvidyut]

sure @david-yu will do it today. Thanks.