Cheat notes · Module 06 · Real-world delivery

Expose Argo CD safely, and upgrade it

A five-minute review for when you have done this module and want it back in your head. Open the full module for the steps and the lab, or the full text to print.

The idea

A team needs one front door (an ingress with TLS), personal accounts instead of a shared admin, and upgrades that are routine pull requests. All three are lines in Argo CD's values file or its Application.

Remember

Ingress with TLS: TLS ends at Traefik and Argo CD serves plain HTTP behind it (server.insecure: true). Safe only because nothing else can reach the server Service.
The CLI through an ingress speaks gRPC-web: argocd login HOST --grpc-web.
Accounts in Git, passwords not: accounts.alice: login and g, alice, role:admin in policy.csv are config. The password is set once with argocd account update-password and stored in argocd-secret.
policy.default: "": logged in but not listed means you see nothing.
Switch off admin (admin.enabled: false) once someone else can administer, and delete argocd-initial-admin-secret.
An upgrade is one line: read the release notes, render old and new and diff them, change targetRevision, merge, verify. Patch: routine. Minor: read the notes. Major: test first. Downgrades across minor versions are not supported.

Pitfalls

Removing the only admin from policy.csv locks everyone out of the UI. The application controller needs no login, so reverting the commit still fixes it. Keep a break-glass account and a CI check that one admin remains.
connection refused on localhost:8080 after the switch: the CLI is still logged in to the old port-forward. Log in again through the ingress.
--insecure is only for the self-signed laptop certificate. Production uses real certificates (cert-manager) and SSO.

Commands

`argocd login HOST --grpc-web --insecure --username alice --password ...`	Log in through the ingress
`argocd account update-password --account NAME --current-password ... --new-password ...`	Set a local account's password
`argocd account get-user-info`	Who am I logged in as?
`diff <(helm template ... --version OLD) <(helm template ... --version NEW)`	See what an upgrade changes before you make it
`argocd version --short`	Client and server versions after the upgrade

The values that matter

configs:
  params:
    server.insecure: true      # TLS ends at the ingress
  cm:
    admin.enabled: false
    accounts.alice: login
  rbac:
    policy.default: ""
    policy.csv: |
      g, alice, role:admin
server:
  ingress:
    enabled: true
    ingressClassName: traefik

Test yourself

Answer in your head first, then open the answer.

Why is server.insecure: true acceptable here?

TLS terminates at the ingress, and only the ingress can reach the Argo CD server.

Where does alice's password live?

In the argocd-secret Secret, set with the CLI. Git only declares that the account exists.

What is an Argo CD upgrade, technically?

A pull request changing targetRevision of the argocd Application.

You locked yourself out with an RBAC commit. How do you get back?

Revert the commit. The controller applies Git without needing a login.

Where module 06 leaves you: Argo CD answers at https://argocd.localtest.me:8443 with TLS (no more port-forward), alice is the administrator, admin is disabled, and Argo CD runs the newer chart version, upgraded by a pull request.