Skip to content

Commit 2397720

Browse files
bastjanbastjan
committed
Ignore CiliumIdentity resources
CiliumIdentity (https://doc.crds.dev/github.com/cilium/cilium/cilium.io/CiliumIdentity/v2) resources are completely managed by Cilium but copy labels from the resources they refer to. Cilium uses them as a KV store. This commit stops ArgoCD from purging the resources instantly after creation.
1 parent 87d0062 commit 2397720

File tree

8 files changed

+103
-0
lines changed

8 files changed

+103
-0
lines changed

‎class/defaults.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,16 @@ parameters:
8888
gitlab-dev.syn.tools ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDybOH3scUSfAJFkskpVn1VcL1mPNSiV05asrCCjDTzSJOeJuCE99KkHf7eTA29as9NaqtMtJcCxhptLfNaRzUR3zf29eUuPhkh2B5PUaqLpsbm6330QxvWsZNJyI8Cf7i78O3qe4dv7p2Fe78ayLKX/q3dRj0PZnl7kMj7YpCfY7VCndqoIKEOlIEqNjzAFhHLgHEMJ8f8cM5s4qorgc3TdCqORGVs5vqkeNm977yz2hMxB7iEET4O2jfBUHzzZ68T5h5AtrL5YVBMP0xTgaLskk7/QnoEsfKAgTXo/AaUuXbzM6N0nIjH00Ll0s6P2fWyRVXz05eauZZhBS85GQTD
8989
gitlab-dev.syn.tools ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCz/gtGxqX+WS6E9/NLYTkRLkM7r7JHU5N7vz2kJjRbjhR91JvP7NaHtuN5aPm5Wv9rtPKSackQ9B78VCkr6GLw=
9090
gitlab-dev.syn.tools ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtv4stHQjApa7wkgvgo4dB52qLzI/zN2Us+89cQXXm0
91+
92+
resource_exclusions:
93+
cilium:
94+
- apiGroups:
95+
- cilium.io
96+
kinds:
97+
- CiliumIdentity
98+
clusters:
99+
- "*"
100+
91101
operator:
92102
migrate: false
93103
conversion_webhook: false

‎component/argocd.jsonnet

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -246,6 +246,13 @@ local argocd(name) =
246246
||| + params.ssh_known_hosts,
247247
},
248248
redis: redis,
249+
resourceExclusions: std.manifestYamlDoc(
250+
std.foldl(
251+
function(acc, v) acc + std.flattenArrays([ v ]),
252+
std.filter(function(v) v != null, std.objectValues(params.resource_exclusions)),
253+
[]
254+
)
255+
),
249256
resourceIgnoreDifferences: {
250257
resourceIdentifiers: [
251258
{

‎docs/modules/ROOT/pages/references/parameters.adoc

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,48 @@ type:: string
3535

3636
SSH known hosts for Git servers.
3737

38+
39+
== `resource_exclusions`
40+
41+
[horizontal]
42+
type:: dictionary(list|dictionary)
43+
default::
44+
+
45+
[source,yaml]
46+
----
47+
cilium:
48+
- apiGroups:
49+
- cilium.io
50+
kinds:
51+
- CiliumIdentity
52+
clusters:
53+
- "*"
54+
----
55+
example::
56+
+
57+
[source,yaml]
58+
----
59+
custom:
60+
- apiGroups:
61+
- custom.io
62+
kinds:
63+
- ClusterWrecker
64+
clusters:
65+
- "*"
66+
backup: null
67+
----
68+
69+
A dictionary of resource exclusions for the ArgoCD instance.
70+
Those resources will not be managed by ArgoCD.
71+
72+
The keys are the names of the exclusion groups.
73+
Keys are not used, they are exclusively for hierarchical structuring.
74+
75+
The values are lists of resource definitions that should be excluded from the ArgoCD instance.
76+
Those lists get concatenated.
77+
78+
Check https://argo-cd.readthedocs.io/en/stable/user-guide/resource_tracking/#additional-tracking-methods-via-an-annotation[ArgoCD documentation] for more information.
79+
3880
== `network_policies.enabled`
3981
[horizontal]
4082
type:: boolean

‎tests/golden/defaults/argocd/argocd/30_argocd/10_argocd.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,13 @@ spec:
139139
sshPrivateKeySecret:
140140
name: argo-ssh-key
141141
key: sshPrivateKey
142+
resourceExclusions: |-
143+
- "apiGroups":
144+
- "cilium.io"
145+
"clusters":
146+
- "*"
147+
"kinds":
148+
- "CiliumIdentity"
142149
resourceHealthChecks:
143150
- check: |
144151
hs = {}

‎tests/golden/openshift/argocd/argocd/30_argocd/10_argocd.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,13 @@ spec:
136136
sshPrivateKeySecret:
137137
name: argo-ssh-key
138138
key: sshPrivateKey
139+
resourceExclusions: |-
140+
- "apiGroups":
141+
- "cilium.io"
142+
"clusters":
143+
- "*"
144+
"kinds":
145+
- "CiliumIdentity"
139146
resourceHealthChecks:
140147
- check: |
141148
hs = {}

‎tests/golden/params/argocd/argocd/30_argocd/10_argocd.yaml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,19 @@ spec:
118118
sshPrivateKeySecret:
119119
name: argo-ssh-key
120120
key: sshPrivateKey
121+
resourceExclusions: |-
122+
- "apiGroups":
123+
- "cilium.io"
124+
"clusters":
125+
- "*"
126+
"kinds":
127+
- "CiliumIdentity"
128+
- "apiGroups":
129+
- "custom.io"
130+
"clusters":
131+
- "*"
132+
"kinds":
133+
- "ClusterWrecker"
121134
resourceHealthChecks:
122135
- check: |
123136
hs = {}

‎tests/golden/prometheus/argocd/argocd/30_argocd/10_argocd.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,13 @@ spec:
139139
sshPrivateKeySecret:
140140
name: argo-ssh-key
141141
key: sshPrivateKey
142+
resourceExclusions: |-
143+
- "apiGroups":
144+
- "cilium.io"
145+
"clusters":
146+
- "*"
147+
"kinds":
148+
- "CiliumIdentity"
142149
resourceHealthChecks:
143150
- check: |
144151
hs = {}

‎tests/params.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,3 +86,13 @@ parameters:
8686
destinations:
8787
- namespace: other-*
8888
server: https://kubernetes.default.svc
89+
90+
resource_exclusions:
91+
custom:
92+
- apiGroups:
93+
- custom.io
94+
kinds:
95+
- ClusterWrecker
96+
clusters:
97+
- "*"
98+
nope: null

0 commit comments

Comments
 (0)