Extend valid resources for project-scoped role policy #207

onematchfox · 2022-09-29T11:40:31Z

Enables the ability to create project-role policies for the resources clusters, applications, exec and logs.

Notes:

Bumping the argo-cd go dependency required dropping support for ksonnet as per the 2.4 release notes. Not sure quite how you want to handle this from the perspective of this provider given that it could definitely be seen as a breaking change. Let me know if anything is needed from my side.
Replacement for Update ArgoCD dependency to v2.4.x #203 which went stale.
I have upgraded the default Kubernetes and ArgoCD versions that are installed as part of the tests (see commit messages for more details) - happy to drop these commits if you have any issues with them.

Support for `ksonnet` was dropped in ArgoCD 2.4. As such, this has been removed from the `argocd_application` resource in this provider as well.

`1.19` is long past EOL so we should upgrade the default cluster version. I did consider `1.22` but as this is approaching EOL in 1 month (https://kubernetes.io/releases/), I figured we may as well jump straight to `1.23`.

Aligns with the minimum version run by the GitHub Actions.

Ensures that role policy can be provisioned for clusters, repositories, exec and logs.

Resolves following build error resulting from dependency updates: ``` ../../../go/pkg/mod/github.com/argoproj/argo-cd/[email protected]/pkg/apiclient/apiclient.go:53:2: //go:build comment without // +build comment ```

Spotted a warning at https://github.com/oboukili/terraform-provider-argocd/actions/runs/3151063925/jobs/5124563560 and have upgraded as per https://github.blog/changelog/2022-04-27-code-scanning-deprecation-of-codeql-action-v1/

onematchfox · 2022-09-29T13:56:56Z

@oboukili is it just me or are the tests a bit flaky? v2.1.10 passed on the previous attempt but failed on the latest attempt (for seemingly unrelated reasons).

Will leave this PR as is for now. Let me know if there's anything I need to do about the tests (in addition to any review comments of course 😄)

lchastel · 2022-10-05T10:50:32Z

I need features of 2.4 version of ArgoCD. (rbac from projects).

Could you please fix the issue and publish the new version ?

PS : I am wondering if support of 2.1 is still needed ? (it not supported anymore according to documentation)

onematchfox · 2022-10-06T04:52:05Z

Could you please fix the issue and publish the new version ?

I'm afraid there's not much I can do here - I'm waiting on a review. I'm sure @oboukili will get to this when he has the time.

PS : I am wondering if support of 2.1 is still needed ? (it not supported anymore according to documentation)

🤔 this is a fair point - even by the providers own compatibility promise versions 2.1 and 2.2 are unsupported. So, I could drop the tests for these versions. But, I would rather wait for a maintainer's thoughts on the matter than make that call myself.

oboukili · 2022-10-06T07:27:12Z

scripts/testacc_prepare_env.sh

 fi

-echo "\n--- Install ArgoCD ${ARGOCD_VERSION:-v1.8.7}\n"
-curl https://raw.githubusercontent.com/argoproj/argo-cd/${ARGOCD_VERSION:-v1.8.7}/manifests/install.yaml > manifests/install/argocd.yml &&
+echo "\n--- Install ArgoCD ${ARGOCD_VERSION:-v2.1.10}\n"


Let's drop support for 2.1.x, as per the compatibility promise, and let's raise this to the latest 2.3.x.

oboukili · 2022-10-06T07:28:42Z

argocd/resource_argocd_application.go

 		StateUpgraders: []schema.StateUpgrader{
 			{
 				Type:    resourceArgoCDApplicationV0().CoreConfigSchema().ImpliedType(),
 				Upgrade: resourceArgoCDApplicationStateUpgradeV0,
 				Version: 0,
 			},
+			{
+				Type:    resourceArgoCDApplicationV1().CoreConfigSchema().ImpliedType(),


Could you add a schemaUpgrader test? If something goes wrong, we'll have to release hotfixes under pressure (already experienced that ;) )

Good catch :) Added as requested.

oboukili · 2022-10-06T07:29:44Z

Hi there,
Apologies for the slow response time, indeed everybody is pretty busy these days. @onematchfox since you're already a long time contributor, would you mind if I added you as a repository maintainer?
Cheers and thanks,

Minimum supported version is now `2.3.x` as per ArgoCD itself.

onematchfox · 2022-10-07T09:58:12Z

Hi there, Apologies for the slow response time, indeed everybody is pretty busy these days.

Thanks so much for the review. Have now completed the changes as requested.

@onematchfox since you're already a long time contributor, would you mind if I added you as a repository maintainer? Cheers and thanks,

I'm by no means an expert in Terraform providers 😄 but yes sure, I'd be more than happy to help out wherever possible if it would lighten your load.

oboukili · 2022-10-13T11:08:22Z

argocd/utils.go

@@ -97,9 +97,17 @@ func validatePolicy(project string, role string, policy string) error {
 		return fmt.Errorf("invalid policy rule '%s': policy subject must be: '%s', not '%s'", policy, expectedSubject, subject)
 	}
 	// resource
+	// See https://github.com/muma378/argo-cd/blob/6fd4c6f44acc06f934061ce7848d72454366345b/pkg/apis/application/v1alpha1/types.go#L1555-L1561


There is a comment to refactor this using a data structure rbac.ResourceApplications data structure maintained upstream, did you consider that instead?

I hadn't... Glossed over it because of the related comment for validActions at https://github.com/argoproj/argo-cd/blob/c99669e088b5f25c8ce8faff6df25797a8beb5ba/pkg/apis/application/v1alpha1/types.go#L1527

But now that you mention it, this module won't have any "import cycle" issues. So I have gone ahead and adjusted to reference rbacpolicy instead of hard-coding the strings (handled actions as well while I was at it)

scripts/testacc_prepare_env.sh

oboukili · 2022-10-13T11:10:27Z

I'm by no means an expert in Terraform providers 😄 but yes sure, I'd be more than happy to help out wherever possible if it would lighten your load.

No worries, I'll set this up. Cheers!

Co-authored-by: Olivier Boukili <[email protected]>

onematchfox · 2022-10-13T12:57:18Z

@oboukili Changes now made. Acceptance Tests on v2.4.12 failed initially for seemingly unrelated reasons so I have relaunched them.

Edit: and all passing now. 🎉

oboukili · 2022-10-13T15:54:24Z

Awesome, thanks :)
Since there is a major breaking change, we are going to increment the major version counter.

VladoPortos · 2022-10-31T11:20:25Z

Guys how do I fix this?

Error decoding "argocd_application.gitlab" from previous state: unsupported attribute "ksonnet"

Just remove it from state file ?

onematchfox · 2022-10-31T12:00:29Z

Were/are you using ksonnet?

Just remove it from state file ?

Yes, that should do the trick.

VladoPortos · 2022-10-31T12:04:08Z

Worked, thanks @onematchfox

oboukili · 2022-10-31T12:36:03Z

Good point, we should have shipped a state migrator with the latest major release!

onematchfox added 4 commits September 29, 2022 13:41

build(deps): bump argo-cd to v2.4.12 from v2.3.0

25928f7

Support for `ksonnet` was dropped in ArgoCD 2.4. As such, this has been removed from the `argocd_application` resource in this provider as well.

tests: bump default Kubernetes version to 1.23.12

9a6fee9

`1.19` is long past EOL so we should upgrade the default cluster version. I did consider `1.22` but as this is approaching EOL in 1 month (https://kubernetes.io/releases/), I figured we may as well jump straight to `1.23`.

tests: bump default ArgoCD version to 2.1.10

43ec0f1

Aligns with the minimum version run by the GitHub Actions.

feat: extend valid resources for project-scope role policy

931d54f

Ensures that role policy can be provisioned for clusters, repositories, exec and logs.

onematchfox force-pushed the deps/argo-cd-2.4.12 branch from d0cdd7b to 931d54f Compare September 29, 2022 11:41

build(deps): bump go to 1.17 from 1.16

bdeadde

Resolves following build error resulting from dependency updates: ``` ../../../go/pkg/mod/github.com/argoproj/argo-cd/[email protected]/pkg/apiclient/apiclient.go:53:2: //go:build comment without // +build comment ```

onematchfox force-pushed the deps/argo-cd-2.4.12 branch from 6e2ec97 to bdeadde Compare September 29, 2022 11:52

build: bump codeql actions to v2

19a5417

Spotted a warning at https://github.com/oboukili/terraform-provider-argocd/actions/runs/3151063925/jobs/5124563560 and have upgraded as per https://github.blog/changelog/2022-04-27-code-scanning-deprecation-of-codeql-action-v1/

oboukili requested changes Oct 6, 2022

View reviewed changes

onematchfox added 2 commits October 7, 2022 11:43

build: drop tests for ArgoCD 2.1 and 2.2

670b4c2

Minimum supported version is now `2.3.x` as per ArgoCD itself.

tests: add tests for migration of application schema to v2

71895f2

onematchfox force-pushed the deps/argo-cd-2.4.12 branch from 6df7960 to 71895f2 Compare October 7, 2022 09:44

onematchfox requested a review from oboukili October 7, 2022 09:58

oboukili requested changes Oct 13, 2022

View reviewed changes

chore: update scripts/testacc_prepare_env.sh

18821c6

Co-authored-by: Olivier Boukili <[email protected]>

onematchfox force-pushed the deps/argo-cd-2.4.12 branch from 8a3e0e0 to 64bd2ec Compare October 13, 2022 12:03

refactor: use rbacpolicy for policy action/resource names

1b1cf8e

onematchfox force-pushed the deps/argo-cd-2.4.12 branch from 64bd2ec to 1b1cf8e Compare October 13, 2022 12:08

onematchfox requested a review from oboukili October 13, 2022 12:55

oboukili approved these changes Oct 13, 2022

View reviewed changes

oboukili merged commit 2dbefb5 into argoproj-labs:master Oct 13, 2022

oboukili mentioned this pull request Oct 13, 2022

Update ArgoCD dependency to v2.4.x #203

Closed

onematchfox deleted the deps/argo-cd-2.4.12 branch October 13, 2022 17:22

onematchfox mentioned this pull request May 17, 2023

ENHANCE_YOUR_CALM / too_many_pings #124

Closed

stephan242 mentioned this pull request Jun 15, 2023

Create state migrator for ksonnet drop #304

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Extend valid resources for project-scoped role policy #207

Extend valid resources for project-scoped role policy #207

onematchfox commented Sep 29, 2022

onematchfox commented Sep 29, 2022 •

edited

Loading

lchastel commented Oct 5, 2022

onematchfox commented Oct 6, 2022

oboukili Oct 6, 2022

onematchfox Oct 7, 2022

oboukili Oct 6, 2022

onematchfox Oct 7, 2022

oboukili commented Oct 6, 2022

onematchfox commented Oct 7, 2022

oboukili Oct 13, 2022

onematchfox Oct 13, 2022

oboukili commented Oct 13, 2022

onematchfox commented Oct 13, 2022 •

edited

Loading

oboukili commented Oct 13, 2022

VladoPortos commented Oct 31, 2022

onematchfox commented Oct 31, 2022

VladoPortos commented Oct 31, 2022

oboukili commented Oct 31, 2022

Extend valid resources for project-scoped role policy #207

Extend valid resources for project-scoped role policy #207

Conversation

onematchfox commented Sep 29, 2022

onematchfox commented Sep 29, 2022 • edited Loading

lchastel commented Oct 5, 2022

onematchfox commented Oct 6, 2022

oboukili Oct 6, 2022

Choose a reason for hiding this comment

onematchfox Oct 7, 2022

Choose a reason for hiding this comment

oboukili Oct 6, 2022

Choose a reason for hiding this comment

onematchfox Oct 7, 2022

Choose a reason for hiding this comment

oboukili commented Oct 6, 2022

onematchfox commented Oct 7, 2022

oboukili Oct 13, 2022

Choose a reason for hiding this comment

onematchfox Oct 13, 2022

Choose a reason for hiding this comment

oboukili commented Oct 13, 2022

onematchfox commented Oct 13, 2022 • edited Loading

oboukili commented Oct 13, 2022

VladoPortos commented Oct 31, 2022

onematchfox commented Oct 31, 2022

VladoPortos commented Oct 31, 2022

oboukili commented Oct 31, 2022

onematchfox commented Sep 29, 2022 •

edited

Loading

onematchfox commented Oct 13, 2022 •

edited

Loading