Merge branch 'master' into feat/set-persis-health-to-false

cmd/argocd/commands/admin/admin.go

@@ -14,15 +14,12 @@ import (
 	"k8s.io/client-go/dynamic"
 	"k8s.io/client-go/rest"
 	"k8s.io/client-go/tools/clientcmd"
-	"sigs.k8s.io/yaml"
 
 	cmdutil "github.com/argoproj/argo-cd/v3/cmd/util"
 	"github.com/argoproj/argo-cd/v3/common"
 	argocdclient "github.com/argoproj/argo-cd/v3/pkg/apiclient"
-	"github.com/argoproj/argo-cd/v3/util/errors"
-	"github.com/argoproj/argo-cd/v3/util/settings"
-
 	"github.com/argoproj/argo-cd/v3/pkg/apis/application"
+	"github.com/argoproj/argo-cd/v3/util/errors"
 )
 
 const (
@@ -95,76 +92,13 @@ func newArgoCDClientsets(config *rest.Config, namespace string) *argoCDClientset
 	}
 }
 
-// getReferencedSecrets examines the argocd-cm config for any referenced repo secrets and returns a
-// map of all referenced secrets.
-func getReferencedSecrets(un unstructured.Unstructured) map[string]bool {
-	var cm corev1.ConfigMap
-	err := runtime.DefaultUnstructuredConverter.FromUnstructured(un.Object, &cm)
-	errors.CheckError(err)
-	referencedSecrets := make(map[string]bool)
-
-	// Referenced repository secrets
-	if reposRAW, ok := cm.Data["repositories"]; ok {
-		repos := make([]settings.Repository, 0)
-		err := yaml.Unmarshal([]byte(reposRAW), &repos)
-		errors.CheckError(err)
-		for _, cred := range repos {
-			if cred.PasswordSecret != nil {
-				referencedSecrets[cred.PasswordSecret.Name] = true
-			}
-			if cred.SSHPrivateKeySecret != nil {
-				referencedSecrets[cred.SSHPrivateKeySecret.Name] = true
-			}
-			if cred.UsernameSecret != nil {
-				referencedSecrets[cred.UsernameSecret.Name] = true
-			}
-			if cred.TLSClientCertDataSecret != nil {
-				referencedSecrets[cred.TLSClientCertDataSecret.Name] = true
-			}
-			if cred.TLSClientCertKeySecret != nil {
-				referencedSecrets[cred.TLSClientCertKeySecret.Name] = true
-			}
-		}
-	}
-
-	// Referenced repository credentials secrets
-	if reposRAW, ok := cm.Data["repository.credentials"]; ok {
-		creds := make([]settings.RepositoryCredentials, 0)
-		err := yaml.Unmarshal([]byte(reposRAW), &creds)
-		errors.CheckError(err)
-		for _, cred := range creds {
-			if cred.PasswordSecret != nil {
-				referencedSecrets[cred.PasswordSecret.Name] = true
-			}
-			if cred.SSHPrivateKeySecret != nil {
-				referencedSecrets[cred.SSHPrivateKeySecret.Name] = true
-			}
-			if cred.UsernameSecret != nil {
-				referencedSecrets[cred.UsernameSecret.Name] = true
-			}
-			if cred.TLSClientCertDataSecret != nil {
-				referencedSecrets[cred.TLSClientCertDataSecret.Name] = true
-			}
-			if cred.TLSClientCertKeySecret != nil {
-				referencedSecrets[cred.TLSClientCertKeySecret.Name] = true
-			}
-		}
-	}
-	return referencedSecrets
-}
-
 // isArgoCDSecret returns whether or not the given secret is a part of Argo CD configuration
 // (e.g. argocd-secret, repo credentials, or cluster credentials)
-func isArgoCDSecret(repoSecretRefs map[string]bool, un unstructured.Unstructured) bool {
+func isArgoCDSecret(un unstructured.Unstructured) bool {
 	secretName := un.GetName()
 	if secretName == common.ArgoCDSecretName {
 		return true
 	}
-	if repoSecretRefs != nil {
-		if _, ok := repoSecretRefs[secretName]; ok {
-			return true
-		}
-	}
 	if labels := un.GetLabels(); labels != nil {
 		if _, ok := labels[common.LabelKeySecretType]; ok {
 			return true

cmd/argocd/commands/admin/backup.go

@@ -74,14 +74,14 @@ func NewExportCommand() *cobra.Command {
 			errors.CheckError(err)
 			export(writer, *acdTLSCertsConfigMap, namespace)
 
-			referencedSecrets := getReferencedSecrets(*acdConfigMap)
 			secrets, err := acdClients.secrets.List(ctx, metav1.ListOptions{})
 			errors.CheckError(err)
 			for _, secret := range secrets.Items {
-				if isArgoCDSecret(referencedSecrets, secret) {
+				if isArgoCDSecret(secret) {
 					export(writer, secret, namespace)
 				}
 			}
+
 			projects, err := acdClients.projects.List(ctx, metav1.ListOptions{})
 			errors.CheckError(err)
 			for _, proj := range projects.Items {
@@ -190,22 +190,16 @@ func NewImportCommand() *cobra.Command {
 			pruneObjects := make(map[kube.ResourceKey]unstructured.Unstructured)
 			configMaps, err := acdClients.configMaps.List(ctx, metav1.ListOptions{})
 			errors.CheckError(err)
-			// referencedSecrets holds any secrets referenced in the argocd-cm configmap. These
-			// secrets need to be imported too
-			var referencedSecrets map[string]bool
 			for _, cm := range configMaps.Items {
 				if isArgoCDConfigMap(cm.GetName()) {
 					pruneObjects[kube.ResourceKey{Group: "", Kind: "ConfigMap", Name: cm.GetName(), Namespace: cm.GetNamespace()}] = cm
 				}
-				if cm.GetName() == common.ArgoCDConfigMapName {
-					referencedSecrets = getReferencedSecrets(cm)
-				}
 			}
 
 			secrets, err := acdClients.secrets.List(ctx, metav1.ListOptions{})
 			errors.CheckError(err)
 			for _, secret := range secrets.Items {
-				if isArgoCDSecret(referencedSecrets, secret) {
+				if isArgoCDSecret(secret) {
 					pruneObjects[kube.ResourceKey{Group: "", Kind: "Secret", Name: secret.GetName(), Namespace: secret.GetNamespace()}] = secret
 				}
 			}

cmd/argocd/commands/admin/settings.go

@@ -247,19 +247,6 @@ var validatorsByGroup = map[string]settingValidator{
 		}
 		return summary, err
 	},
-	"repositories": joinValidators(func(manager *settings.SettingsManager) (string, error) {
-		repos, err := manager.GetRepositories()
-		if err != nil {
-			return "", err
-		}
-		return fmt.Sprintf("%d repositories", len(repos)), nil
-	}, func(manager *settings.SettingsManager) (string, error) {
-		creds, err := manager.GetRepositoryCredentials()
-		if err != nil {
-			return "", err
-		}
-		return fmt.Sprintf("%d repository credentials", len(creds)), nil
-	}),
 	"accounts": func(manager *settings.SettingsManager) (string, error) {
 		accounts, err := manager.GetAccounts()
 		if err != nil {

cmd/argocd/commands/admin/settings_test.go

@@ -157,15 +157,6 @@ clientSecret: aaaabbbbccccddddeee`,
 			},
 			containsSummary: "updated-options",
 		},
-		"Repositories": {
-			validator: "repositories",
-			data: map[string]string{
-				"repositories": `
-- url: https://github.com/argoproj/my-private-repository1
-- url: https://github.com/argoproj/my-private-repository2`,
-			},
-			containsSummary: "2 repositories",
-		},
 		"Accounts": {
 			validator: "accounts",
 			data: map[string]string{

docs/operator-manual/declarative-setup.md

@@ -498,43 +498,6 @@ stringData:
 
 A note on noProxy: Argo CD uses exec to interact with different tools such as helm and kustomize. Not all of these tools support the same noProxy syntax as the [httpproxy go package](https://cs.opensource.google/go/x/net/+/internal-branch.go1.21-vendor:http/httpproxy/proxy.go;l=38-50) does. In case you run in trouble with noProxy not beeing respected you might want to try using the full domain instead of a wildcard pattern or IP range to find a common syntax that all tools support.
 
-### Legacy behaviour
-
-In Argo CD version 2.0 and earlier, repositories were stored as part of the `argocd-cm` config map. For
-backward-compatibility, Argo CD will still honor repositories in the config map, but this style of repository
-configuration is deprecated and support for it will be removed in a future version.
-
-```yaml
-apiVersion: v1
-kind: ConfigMap
-data:
-  repositories: |
-    - url: https://github.com/argoproj/my-private-repository
-      passwordSecret:
-        name: my-secret
-        key: password
-      usernameSecret:
-        name: my-secret
-        key: username
-  repository.credentials: |
-    - url: https://github.com/argoproj
-      passwordSecret:
-        name: my-secret
-        key: password
-      usernameSecret:
-        name: my-secret
-        key: username
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: my-secret
-  namespace: argocd
-stringData:
-  password: my-password
-  username: my-username
-```
-
 ## Clusters
 
 Cluster credentials are stored in secrets same as repositories or repository credentials. Each secret must have label

docs/operator-manual/upgrading/2.14-3.0.md

@@ -75,6 +75,27 @@ [email protected]_conn_i%
 If authenticating with the CLI, make sure to use the new version as well to obtain an authentication token with the
 appropriate claims.
 
+### Removed support for legacy repo config in argocd-cm
+
+Before repositories were managed as Secrets, they were configured in the argocd-cm ConfigMap. The argocd-cm option has
+been deprecated for some time and is no longer available in Argo CD 3.0.
+
+#### Detection
+
+To check whether you have any repositories configured in argocd-cm, run the following command:
+
+```shell
+kubectl get cm argocd-cm -o=jsonpath="[{.data.repositories}, {.data['repository.credentials']}, {.data['helm.repositories']}]"
+```
+
+If you have no repositories configured in argocd-cm, the output will be `[, , ]`, and you are not impacted by this
+change.
+
+#### Migration
+
+To convert your repositories to Secrets, follow the documentation for
+[declarative management of repositories](../declarative-setup.md#repositories).
+
 ## Other changes
 
 ### Using `cluster.inClusterEnabled: "false"`

docs/operator-manual/upgrading/overview.md

@@ -8,12 +8,12 @@
 Argo CD uses semver-like versioning that ensures the following rules:
 
 * The patch release does not introduce any breaking changes. So if you are upgrading from v1.5.1 to v1.5.3
- there should be no special instructions to follow.
+  there should be no special instructions to follow.
 * The minor release might introduce minor changes with a workaround. If you are upgrading from v1.3.0 to v1.5.2
-please make sure to check upgrading details in  both [v1.3 to v1.4](./1.3-1.4.md)  and  [v1.4 to v1.5](./1.4-1.5.md)
- upgrading instructions.
- * The major release introduces backward incompatible behavior changes. It is recommended to take a backup of
- Argo CD settings using disaster recovery [guide](../disaster_recovery.md).
+  please make sure to check upgrading details in both [v1.3 to v1.4](./1.3-1.4.md)  and  [v1.4 to v1.5](./1.4-1.5.md)
+  upgrading instructions.
+* The major release introduces backward incompatible behavior changes. It is recommended to take a backup of
+  Argo CD settings using disaster recovery [guide](../disaster_recovery.md).
 
 After reading the relevant notes about possible breaking changes introduced in Argo CD version use the following
 command to upgrade Argo CD. Make sure to replace `<version>` with the required version number:
@@ -25,6 +25,7 @@ kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/<v
 ```
 
 **HA**:
+
 ```bash
 kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/<version>/manifests/ha/install.yaml
 ```
@@ -38,6 +39,7 @@ kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/<v
 <hr/>
 
 * [v2.14 to v3.0](./2.14-3.0.md)
+* [v2.13 to v2.14](./2.13-2.14.md)
 * [v2.12 to v2.13](./2.12-2.13.md)
 * [v2.11 to v2.12](./2.11-2.12.md)
 * [v2.10 to v2.11](./2.10-2.11.md)

test/e2e/fixture/admin/utils/backup.go

@@ -13,7 +13,7 @@ type ExportedResources []unstructured.Unstructured
 
 func GetExportedResourcesFromOutput(output string) (ExportedResources, error) {
 	var resources []unstructured.Unstructured
-	docs := strings.Split(output, "---")
+	docs := strings.Split(output, "\n---\n")
 
 	for _, doc := range docs {
 		doc = strings.TrimSpace(doc)

test/e2e/fixture/fixture.go

@@ -541,28 +541,6 @@ func SetResourceFilter(filters settings.ResourcesFilter) error {
 	})
 }
 
-func SetHelmRepos(repos ...settings.HelmRepoCredentials) error {
-	return updateSettingConfigMap(func(cm *corev1.ConfigMap) error {
-		yamlBytes, err := yaml.Marshal(repos)
-		if err != nil {
-			return err
-		}
-		cm.Data["helm.repositories"] = string(yamlBytes)
-		return nil
-	})
-}
-
-func SetRepos(repos ...settings.RepositoryCredentials) error {
-	return updateSettingConfigMap(func(cm *corev1.ConfigMap) error {
-		yamlBytes, err := yaml.Marshal(repos)
-		if err != nil {
-			return err
-		}
-		cm.Data["repositories"] = string(yamlBytes)
-		return nil
-	})
-}
-
 func SetProjectSpec(project string, spec v1alpha1.AppProjectSpec) error {
 	proj, err := AppClientset.ArgoprojV1alpha1().AppProjects(TestNamespace()).Get(context.Background(), project, metav1.GetOptions{})
 	if err != nil {