mirror of
https://github.com/hanzoai/deploy.git
synced 2026-10-07 08:44:50 +00:00
41536738c8
* feat(api): hard-fork CRD API group argoproj.io -> deploy.hanzo.ai
Hanzo CD hard-fork, phase 1.1. Single source of truth is
pkg/apis/application/register.go's Group constant (Application/AppProject/
ApplicationSet all derive their FullName from it); every other Go call-site
that hardcoded the literal group string is updated to match: the 3 generated
informer GVRs, the app-of-apps nested-Application detector in types.go, the
resource-tree Application-kind cache populator, the 3 NotFound error
constructors in server/application, and the applicationset-controller's
leader-election Lease name/ID (kept in lockstep across Go source + RBAC
resourceNames, or leader election would get RBAC-denied on startup).
CRD YAMLs (application/appproject/applicationset) and every RBAC apiGroups
rule that actually governs our 3 CRDs are repointed to deploy.hanzo.ai, across
both manifests/base/* (namespaced Roles) and manifests/cluster-rbac/* (cluster
scope). Two adjacent things that share the "argoproj.io" string but are NOT
ours are deliberately left untouched: gitops-engine's health-check dispatch
for Argo Workflows' `Workflow` kind, and argocd-server-clusterrole's second
apiGroups block granting read on Argo Workflows' `workflows` resource — both
belong to a separate, unrelated Argoproj-family project we are not forking.
Also untouched, per explicit scope: annotation/label keys (argocd.argoproj.io/*)
and finalizers (*.argoproj.io) that track already-applied live resources, and
argocd-cm.yaml's resource.customizations.ignoreResourceUpdates keys (a narrow
app-of-apps diffing nicety, not build- or RBAC-relevant).
CGO_ENABLED=0 go build ./... verified green.
* ci: wire canonical hanzo.yml + cicd.yml (Hanzo CD image build)
Phase 1.3. Follows the same one-way pattern every hanzo/lux/zoo repo uses:
hanzo.yml declares the image (root Dockerfile -> ghcr.io/hanzoai/deploy) and a
fast go-build sanity test (the multi-stage Dockerfile build is the slow, real
gate); cicd.yml is the ~10-line trigger shim importing hanzoai/ci's reusable
build workflow on the arc pool, secrets from KMS only.
No `deploy:` block yet, matching the hanzoai/cms build-only-first-cutover
pattern: this repo's own live hanzo-cd namespace runs the whole Hanzo fleet's
GitOps, so the prod image/CRD swap is a deliberate separate action (see the
[HELD] universe PR), never an automatic rollout on merge. Every PR/push still
builds and pushes an immutable ghcr.io/hanzoai/deploy:sha-<7>-amd64 image.
* feat(ui): rebrand Argo CD -> Hanzo CD (title, favicon, logo, sidebar)
Phase 1.2. User-facing "Argo CD"/"ArgoCD" text replaced with "Hanzo CD"
across the login page, help modal, settings screens, version-info panel,
sync-options warning, fullscreen-logs title, app.tsx page titles, and
index.html's <title>/noscript text (dropped the now-wrong upstream CLI
doc link rather than invent a hanzo.ai URL that doesn't exist).
Logo/favicon assets replaced with the canonical Hanzo mark (never
hand-drawn, copied from ~/work/hanzo/logo/dist): the two real usages of
Argo's logo collapse onto one Hanzo glyph (mono + white variants) at the
same 5 call sites (login icon + footer, login.scss $logoPath/
$logoNegativePath, sidebar text-logo), preserving the existing CSS
invert() filters so both the light login panel and dark sidebar still
render correctly. Old argologo.svg/argo_o.svg/argo.png deleted (no
longer referenced). favicon-{16x16,32x32}.png added at
ui/src/assets/favicon/ (index.html's links to that path were previously
dead - the directory didn't exist in this checkout). package.json name
argo-cd-ui -> hanzo-cd-ui.
Left alone, deliberately: the two Kubernetes resource-kind icon sets
under ui/src/assets/images/resources/ (unrelated to branding), and
upstream doc/project links (argoproj.io, argo-cd.readthedocs.io) since
we have no equivalent hanzo.ai docs to point to yet - except the login
footer logo's outbound link, which now points to hanzo.ai instead of
argoproj.io (a Hanzo-branded mark linking to the upstream project it
was forked from read as an obvious leftover).
* feat(module): rename Go module github.com/argoproj/argo-cd/v3 -> github.com/hanzoai/deploy
Phase 2. No version suffix on the new path (org policy: never publish our
own Go modules above v1.x.x / with a v2+ suffix) — this fork starts a fresh
v0/v1 module identity rather than carrying the v3 the upstream fork point
had reached.
Mechanical, symmetric rewrite: 704 .go files (import statements only; two
disjoint substitutions applied specific-first so the nested gitops-engine
module path never double-matches), plus go.mod (module line, the
gitops-engine require+replace pair, version reset to v0.0.0-... since a
suffix-less path can't carry a v3 semver), gitops-engine/go.mod, Makefile
(ldflags PACKAGE + 2 TEST_MODULE filters), .golangci.yaml, .goreleaser.yaml,
.mockery.yaml (+ gitops-engine's), Procfile, the codegen/proto generation
scripts (hack/generate-proto.sh, update-codegen.sh, update-openapi.sh), and
20 .proto files' go_package options. Also one OpenTelemetry tracer name
string in gitops-engine/pkg/sync/sync_context.go (a cosmestic label, not an
import, but worth keeping consistent).
CGO_ENABLED=0 go build ./... verified green for both the root module and
the nested gitops-engine module; go vet clean on both; go mod tidy run
(network available) to reconcile go.sum, dependency set unchanged.
Left alone, deliberately: doc-only mentions (docs/snyk/*.html scan reports,
gitops-engine/README.md), a comment-only reference in
.github/workflows/release.yaml, and one Renovate bot config line — none are
build- or codegen-load-bearing. Also left alone: comments citing upstream
GitHub issue URLs (github.com/argoproj/argo-cd/issues/NNNNN) and a handful
of test fixtures using "https://github.com/argoproj/argo-cd.git" as a
representative example repo URL — both are accurate historical/test-data
references, not stale self-references.
---------
Co-authored-by: Hanzo Dev <[email protected]>
306 lines
17 KiB
Go
306 lines
17 KiB
Go
package commands
|
|
|
|
import (
|
|
stderrors "errors"
|
|
"fmt"
|
|
"math"
|
|
"net"
|
|
"net/http"
|
|
"os"
|
|
"os/signal"
|
|
"runtime/debug"
|
|
"sync"
|
|
"syscall"
|
|
"time"
|
|
|
|
"github.com/argoproj/pkg/v2/stats"
|
|
"github.com/redis/go-redis/v9"
|
|
log "github.com/sirupsen/logrus"
|
|
"github.com/spf13/cobra"
|
|
"google.golang.org/grpc/health/grpc_health_v1"
|
|
"k8s.io/apimachinery/pkg/api/resource"
|
|
|
|
cmdutil "github.com/hanzoai/deploy/cmd/util"
|
|
reposervercache "github.com/hanzoai/deploy/reposerver/cache"
|
|
cacheutil "github.com/hanzoai/deploy/util/cache"
|
|
utilio "github.com/hanzoai/deploy/util/io"
|
|
|
|
"github.com/hanzoai/deploy/common"
|
|
"github.com/hanzoai/deploy/reposerver"
|
|
"github.com/hanzoai/deploy/reposerver/apiclient"
|
|
"github.com/hanzoai/deploy/reposerver/metrics"
|
|
"github.com/hanzoai/deploy/reposerver/repository"
|
|
"github.com/hanzoai/deploy/util/askpass"
|
|
"github.com/hanzoai/deploy/util/cli"
|
|
"github.com/hanzoai/deploy/util/env"
|
|
"github.com/hanzoai/deploy/util/errors"
|
|
"github.com/hanzoai/deploy/util/healthz"
|
|
"github.com/hanzoai/deploy/util/profile"
|
|
"github.com/hanzoai/deploy/util/sourceintegrity"
|
|
"github.com/hanzoai/deploy/util/tls"
|
|
traceutil "github.com/hanzoai/deploy/util/trace"
|
|
|
|
ctls "crypto/tls"
|
|
)
|
|
|
|
var (
|
|
gnuPGSourcePath = env.StringFromEnv(common.EnvGPGDataPath, "/app/config/gpg/source")
|
|
pauseGenerationAfterFailedGenerationAttempts = env.ParseNumFromEnv(common.EnvPauseGenerationAfterFailedAttempts, 3, 0, math.MaxInt32)
|
|
pauseGenerationOnFailureForMinutes = env.ParseNumFromEnv(common.EnvPauseGenerationMinutes, 60, 0, math.MaxInt32)
|
|
pauseGenerationOnFailureForRequests = env.ParseNumFromEnv(common.EnvPauseGenerationRequests, 0, 0, math.MaxInt32)
|
|
gitSubmoduleEnabled = env.ParseBoolFromEnv(common.EnvGitSubmoduleEnabled, true)
|
|
helmUserAgent = env.StringFromEnv(common.EnvHelmUserAgent, "")
|
|
)
|
|
|
|
func NewCommand() *cobra.Command {
|
|
var (
|
|
parallelismLimit int64
|
|
listenPort int
|
|
listenHost string
|
|
metricsPort int
|
|
metricsHost string
|
|
otlpAddress string
|
|
otlpInsecure bool
|
|
otlpHeaders map[string]string
|
|
otlpAttrs []string
|
|
otlpSampleRatio float64
|
|
cacheSrc func() (*reposervercache.Cache, error)
|
|
tlsConfigCustomizer tls.ConfigCustomizer
|
|
tlsConfigCustomizerSrc func() (tls.ConfigCustomizer, error)
|
|
redisClient *redis.Client
|
|
maxCombinedDirectoryManifestsSize string
|
|
cmpTarExcludedGlobs []string
|
|
allowOutOfBoundsSymlinks bool
|
|
streamedManifestMaxTarSize string
|
|
streamedManifestMaxExtractedSize string
|
|
helmManifestMaxExtractedSize string
|
|
helmRegistryMaxIndexSize string
|
|
ociManifestMaxExtractedSize string
|
|
disableOCIManifestMaxExtractedSize bool
|
|
disableManifestMaxExtractedSize bool
|
|
includeHiddenDirectories bool
|
|
cmpUseManifestGeneratePaths bool
|
|
ociMediaTypes []string
|
|
enableBuiltinGitConfig bool
|
|
clientCAPath string
|
|
disableTLS bool
|
|
)
|
|
command := cobra.Command{
|
|
Use: common.CommandRepoServer,
|
|
Short: "Run ArgoCD Repository Server",
|
|
Long: "ArgoCD Repository Server is an internal service which maintains a local cache of the Git repository holding the application manifests, and is responsible for generating and returning the Kubernetes manifests. This command runs Repository Server in the foreground. It can be configured by following options.",
|
|
DisableAutoGenTag: true,
|
|
RunE: func(c *cobra.Command, _ []string) error {
|
|
ctx := c.Context()
|
|
|
|
vers := common.GetVersion()
|
|
vers.LogStartupInfo(
|
|
"ArgoCD Repository Server",
|
|
map[string]any{
|
|
"port": listenPort,
|
|
},
|
|
)
|
|
|
|
cli.SetLogFormat(cmdutil.LogFormat)
|
|
cli.SetLogLevel(cmdutil.LogLevel)
|
|
|
|
// Recover from panic and log the error using the configured logger instead of the default.
|
|
defer func() {
|
|
if r := recover(); r != nil {
|
|
log.WithField("trace", string(debug.Stack())).Fatal("Recovered from panic: ", r)
|
|
}
|
|
}()
|
|
|
|
if !disableTLS {
|
|
var err error
|
|
tlsConfigCustomizer, err = tlsConfigCustomizerSrc()
|
|
errors.CheckError(err)
|
|
}
|
|
|
|
cache, err := cacheSrc()
|
|
errors.CheckError(err)
|
|
repoCacheExpiration := cache.GetRepoCacheExpiration()
|
|
maxCombinedDirectoryManifestsQuantity, err := resource.ParseQuantity(maxCombinedDirectoryManifestsSize)
|
|
errors.CheckError(err)
|
|
|
|
streamedManifestMaxTarSizeQuantity, err := resource.ParseQuantity(streamedManifestMaxTarSize)
|
|
errors.CheckError(err)
|
|
|
|
streamedManifestMaxExtractedSizeQuantity, err := resource.ParseQuantity(streamedManifestMaxExtractedSize)
|
|
errors.CheckError(err)
|
|
|
|
helmManifestMaxExtractedSizeQuantity, err := resource.ParseQuantity(helmManifestMaxExtractedSize)
|
|
errors.CheckError(err)
|
|
|
|
ociManifestMaxExtractedSizeQuantity, err := resource.ParseQuantity(ociManifestMaxExtractedSize)
|
|
errors.CheckError(err)
|
|
|
|
helmRegistryMaxIndexSizeQuantity, err := resource.ParseQuantity(helmRegistryMaxIndexSize)
|
|
errors.CheckError(err)
|
|
|
|
askPassServer := askpass.NewServer(askpass.SocketPath)
|
|
metricsServer := metrics.NewMetricsServer()
|
|
cacheutil.CollectMetrics(redisClient, metricsServer, nil)
|
|
if disableTLS && clientCAPath != "" {
|
|
return stderrors.New("--client-ca-path cannot be used when --disable-tls is enabled")
|
|
}
|
|
|
|
server, err := reposerver.NewServer(metricsServer, cache, tlsConfigCustomizer, repository.RepoServerInitConstants{
|
|
ParallelismLimit: parallelismLimit,
|
|
PauseGenerationAfterFailedGenerationAttempts: pauseGenerationAfterFailedGenerationAttempts,
|
|
PauseGenerationOnFailureForMinutes: pauseGenerationOnFailureForMinutes,
|
|
PauseGenerationOnFailureForRequests: pauseGenerationOnFailureForRequests,
|
|
SubmoduleEnabled: gitSubmoduleEnabled,
|
|
MaxCombinedDirectoryManifestsSize: maxCombinedDirectoryManifestsQuantity,
|
|
CMPTarExcludedGlobs: cmpTarExcludedGlobs,
|
|
AllowOutOfBoundsSymlinks: allowOutOfBoundsSymlinks,
|
|
StreamedManifestMaxExtractedSize: streamedManifestMaxExtractedSizeQuantity.ToDec().Value(),
|
|
StreamedManifestMaxTarSize: streamedManifestMaxTarSizeQuantity.ToDec().Value(),
|
|
HelmManifestMaxExtractedSize: helmManifestMaxExtractedSizeQuantity.ToDec().Value(),
|
|
HelmRegistryMaxIndexSize: helmRegistryMaxIndexSizeQuantity.ToDec().Value(),
|
|
OCIManifestMaxExtractedSize: ociManifestMaxExtractedSizeQuantity.ToDec().Value(),
|
|
DisableOCIManifestMaxExtractedSize: disableOCIManifestMaxExtractedSize,
|
|
IncludeHiddenDirectories: includeHiddenDirectories,
|
|
CMPUseManifestGeneratePaths: cmpUseManifestGeneratePaths,
|
|
OCIMediaTypes: ociMediaTypes,
|
|
EnableBuiltinGitConfig: enableBuiltinGitConfig,
|
|
HelmUserAgent: helmUserAgent,
|
|
HelmChartCacheExpiration: repoCacheExpiration,
|
|
}, askPassServer, clientCAPath, disableTLS)
|
|
errors.CheckError(err)
|
|
|
|
if otlpAddress != "" {
|
|
var closer func()
|
|
var err error
|
|
closer, err = traceutil.InitTracer(ctx, "argocd-repo-server", otlpAddress, otlpInsecure, otlpHeaders, otlpAttrs, otlpSampleRatio)
|
|
if err != nil {
|
|
log.Fatalf("failed to initialize tracing: %v", err)
|
|
}
|
|
defer closer()
|
|
}
|
|
|
|
grpc := server.CreateGRPC()
|
|
lc := &net.ListenConfig{}
|
|
listener, err := lc.Listen(ctx, "tcp", fmt.Sprintf("%s:%d", listenHost, listenPort))
|
|
errors.CheckError(err)
|
|
|
|
healthCheckTLSConfig := buildHealthCheckTLSConfig(server.GetHealthCheckClientCert(), disableTLS)
|
|
|
|
mux := http.NewServeMux()
|
|
healthz.ServeHealthCheck(mux, func(r *http.Request) error {
|
|
if val, ok := r.URL.Query()["full"]; ok && len(val) > 0 && val[0] == "true" {
|
|
// connect to itself to make sure the repo server is able to serve the connection
|
|
// used by liveness probe to auto-restart repo server
|
|
// see https://github.com/argoproj/argo-cd/issues/5110 for more information
|
|
conn, err := apiclient.NewConnection(fmt.Sprintf("localhost:%d", listenPort), 60, healthCheckTLSConfig)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer utilio.Close(conn)
|
|
client := grpc_health_v1.NewHealthClient(conn)
|
|
res, err := client.Check(r.Context(), &grpc_health_v1.HealthCheckRequest{})
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if res.Status != grpc_health_v1.HealthCheckResponse_SERVING {
|
|
return fmt.Errorf("grpc health check status is '%v'", res.Status)
|
|
}
|
|
return nil
|
|
}
|
|
return nil
|
|
})
|
|
mux.Handle("/metrics", metricsServer.GetHandler())
|
|
profile.RegisterProfiler(mux)
|
|
go func() { errors.CheckError(http.ListenAndServe(fmt.Sprintf("%s:%d", metricsHost, metricsPort), mux)) }()
|
|
go func() { errors.CheckError(askPassServer.Run()) }()
|
|
|
|
if sourceintegrity.IsGPGEnabled() {
|
|
log.Infof("Initializing GnuPG keyring at %s", common.GetGnuPGHomePath())
|
|
err = sourceintegrity.InitializeGnuPG()
|
|
errors.CheckError(err)
|
|
|
|
log.Infof("Populating GnuPG keyring with keys from %s", gnuPGSourcePath)
|
|
added, removed, err := sourceintegrity.SyncKeyRingFromDirectory(gnuPGSourcePath)
|
|
errors.CheckError(err)
|
|
log.Infof("Loaded %d (and removed %d) keys from keyring", len(added), len(removed))
|
|
|
|
go func() { errors.CheckError(reposerver.StartGPGWatcher(gnuPGSourcePath)) }()
|
|
}
|
|
|
|
log.Infof("argocd-repo-server is listening on %s", listener.Addr())
|
|
stats.RegisterStackDumper()
|
|
stats.StartStatsTicker(10 * time.Minute)
|
|
stats.RegisterHeapDumper("memprofile")
|
|
|
|
// Graceful shutdown code adapted from https://gist.github.com/embano1/e0bf49d24f1cdd07cffad93097c04f0a
|
|
sigCh := make(chan os.Signal, 1)
|
|
signal.Notify(sigCh, os.Interrupt, syscall.SIGTERM)
|
|
wg := sync.WaitGroup{}
|
|
wg.Go(func() {
|
|
s := <-sigCh
|
|
log.Printf("got signal %v, attempting graceful shutdown", s)
|
|
grpc.GracefulStop()
|
|
})
|
|
|
|
log.Println("starting grpc server")
|
|
err = grpc.Serve(listener)
|
|
if err != nil {
|
|
log.Fatalf("could not serve: %v", err)
|
|
}
|
|
wg.Wait()
|
|
log.Println("clean shutdown")
|
|
|
|
return nil
|
|
},
|
|
}
|
|
command.Flags().StringVar(&cmdutil.LogFormat, "logformat", env.StringFromEnv("ARGOCD_REPO_SERVER_LOGFORMAT", "json"), "Set the logging format. One of: json|text")
|
|
command.Flags().StringVar(&cmdutil.LogLevel, "loglevel", env.StringFromEnv("ARGOCD_REPO_SERVER_LOGLEVEL", "info"), "Set the logging level. One of: debug|info|warn|error")
|
|
command.Flags().Int64Var(¶llelismLimit, "parallelismlimit", int64(env.ParseNumFromEnv("ARGOCD_REPO_SERVER_PARALLELISM_LIMIT", 0, 0, math.MaxInt32)), "Limit on number of concurrent manifests generate requests. Any value less the 1 means no limit.")
|
|
command.Flags().StringVar(&listenHost, "address", env.StringFromEnv("ARGOCD_REPO_SERVER_LISTEN_ADDRESS", common.DefaultAddressRepoServer), "Listen on given address for incoming connections")
|
|
command.Flags().IntVar(&listenPort, "port", common.DefaultPortRepoServer, "Listen on given port for incoming connections")
|
|
command.Flags().StringVar(&metricsHost, "metrics-address", env.StringFromEnv("ARGOCD_REPO_SERVER_METRICS_LISTEN_ADDRESS", common.DefaultAddressRepoServerMetrics), "Listen on given address for metrics")
|
|
command.Flags().IntVar(&metricsPort, "metrics-port", common.DefaultPortRepoServerMetrics, "Start metrics server on given port")
|
|
command.Flags().StringVar(&otlpAddress, "otlp-address", env.StringFromEnv("ARGOCD_REPO_SERVER_OTLP_ADDRESS", ""), "OpenTelemetry collector address to send traces to")
|
|
command.Flags().BoolVar(&otlpInsecure, "otlp-insecure", env.ParseBoolFromEnv("ARGOCD_REPO_SERVER_OTLP_INSECURE", true), "OpenTelemetry collector insecure mode")
|
|
command.Flags().StringToStringVar(&otlpHeaders, "otlp-headers", env.ParseStringToStringFromEnv("ARGOCD_REPO_SERVER_OTLP_HEADERS", map[string]string{}, ","), "List of OpenTelemetry collector extra headers sent with traces, headers are comma-separated key-value pairs(e.g. key1=value1,key2=value2)")
|
|
command.Flags().StringSliceVar(&otlpAttrs, "otlp-attrs", env.StringsFromEnv("ARGOCD_REPO_SERVER_OTLP_ATTRS", []string{}, ","), "List of OpenTelemetry collector extra attrs when send traces, each attribute is separated by a colon(e.g. key:value)")
|
|
cli.BoundedFloat64Var(command.Flags(), &otlpSampleRatio, "otlp-sample-ratio", env.ParseFloat64FromEnv("ARGOCD_REPO_SERVER_OTLP_SAMPLE_RATIO", 1.0, 0.0, 1.0), 0.0, 1.0, "Fraction of traces to sample, from 0.0 (none) to 1.0 (all). Parent-based, so downstream services honor the upstream sampling decision")
|
|
command.Flags().StringVar(&maxCombinedDirectoryManifestsSize, "max-combined-directory-manifests-size", env.StringFromEnv("ARGOCD_REPO_SERVER_MAX_COMBINED_DIRECTORY_MANIFESTS_SIZE", "10M"), "Max combined size of manifest files in a directory-type Application")
|
|
command.Flags().StringArrayVar(&cmpTarExcludedGlobs, "plugin-tar-exclude", env.StringsFromEnv("ARGOCD_REPO_SERVER_PLUGIN_TAR_EXCLUSIONS", []string{}, ";"), "Globs to filter when sending tarballs to plugins.")
|
|
command.Flags().BoolVar(&allowOutOfBoundsSymlinks, "allow-oob-symlinks", env.ParseBoolFromEnv("ARGOCD_REPO_SERVER_ALLOW_OUT_OF_BOUNDS_SYMLINKS", false), "Allow out-of-bounds symlinks in repositories (not recommended)")
|
|
command.Flags().StringVar(&streamedManifestMaxTarSize, "streamed-manifest-max-tar-size", env.StringFromEnv("ARGOCD_REPO_SERVER_STREAMED_MANIFEST_MAX_TAR_SIZE", "100M"), "Maximum size of streamed manifest archives")
|
|
command.Flags().StringVar(&streamedManifestMaxExtractedSize, "streamed-manifest-max-extracted-size", env.StringFromEnv("ARGOCD_REPO_SERVER_STREAMED_MANIFEST_MAX_EXTRACTED_SIZE", "1G"), "Maximum size of streamed manifest archives when extracted")
|
|
command.Flags().StringVar(&helmManifestMaxExtractedSize, "helm-manifest-max-extracted-size", env.StringFromEnv("ARGOCD_REPO_SERVER_HELM_MANIFEST_MAX_EXTRACTED_SIZE", "1G"), "Maximum size of helm manifest archives when extracted")
|
|
command.Flags().StringVar(&helmRegistryMaxIndexSize, "helm-registry-max-index-size", env.StringFromEnv("ARGOCD_REPO_SERVER_HELM_MANIFEST_MAX_INDEX_SIZE", "1G"), "Maximum size of registry index file")
|
|
command.Flags().StringVar(&ociManifestMaxExtractedSize, "oci-manifest-max-extracted-size", env.StringFromEnv("ARGOCD_REPO_SERVER_OCI_MANIFEST_MAX_EXTRACTED_SIZE", "1G"), "Maximum size of oci manifest archives when extracted")
|
|
command.Flags().BoolVar(&disableOCIManifestMaxExtractedSize, "disable-oci-manifest-max-extracted-size", env.ParseBoolFromEnv("ARGOCD_REPO_SERVER_DISABLE_OCI_MANIFEST_MAX_EXTRACTED_SIZE", false), "Disable maximum size of oci manifest archives when extracted")
|
|
command.Flags().BoolVar(&disableManifestMaxExtractedSize, "disable-helm-manifest-max-extracted-size", env.ParseBoolFromEnv("ARGOCD_REPO_SERVER_DISABLE_HELM_MANIFEST_MAX_EXTRACTED_SIZE", false), "Disable maximum size of helm manifest archives when extracted")
|
|
command.Flags().BoolVar(&includeHiddenDirectories, "include-hidden-directories", env.ParseBoolFromEnv("ARGOCD_REPO_SERVER_INCLUDE_HIDDEN_DIRECTORIES", false), "Include hidden directories from Git")
|
|
command.Flags().BoolVar(&cmpUseManifestGeneratePaths, "plugin-use-manifest-generate-paths", env.ParseBoolFromEnv("ARGOCD_REPO_SERVER_PLUGIN_USE_MANIFEST_GENERATE_PATHS", false), "Pass the resources described in argocd.argoproj.io/manifest-generate-paths value to the cmpserver to generate the application manifests.")
|
|
command.Flags().StringSliceVar(&ociMediaTypes, "oci-layer-media-types", env.StringsFromEnv("ARGOCD_REPO_SERVER_OCI_LAYER_MEDIA_TYPES", []string{"application/vnd.oci.image.layer.v1.tar", "application/vnd.oci.image.layer.v1.tar+gzip", "application/vnd.cncf.helm.chart.content.v1.tar+gzip"}, ","), "Comma separated list of allowed media types for OCI media types. This only accounts for media types within layers.")
|
|
command.Flags().BoolVar(&enableBuiltinGitConfig, "enable-builtin-git-config", env.ParseBoolFromEnv("ARGOCD_REPO_SERVER_ENABLE_BUILTIN_GIT_CONFIG", true), "Enable builtin git configuration options that are required for correct argocd-repo-server operation.")
|
|
command.Flags().BoolVar(&disableTLS, "disable-tls", env.ParseBoolFromEnv("ARGOCD_REPO_SERVER_DISABLE_TLS", false), "Disable TLS for the repo-server gRPC endpoint")
|
|
command.Flags().StringVar(&clientCAPath, "client-ca-path", env.StringFromEnv("ARGOCD_REPO_SERVER_CLIENT_CA_PATH", "/app/config/reposerver/mtls/client-ca.crt"), "Path to the client CA certificate file for mTLS. Defaults to the auto-mounted Secret path; mTLS is skipped if the file does not exist.")
|
|
|
|
tlsConfigCustomizerSrc = tls.AddTLSFlagsToCmd(&command)
|
|
cacheSrc = reposervercache.AddCacheFlagsToCmd(&command, cacheutil.Options{
|
|
OnClientCreated: func(client *redis.Client) {
|
|
redisClient = client
|
|
},
|
|
})
|
|
return &command
|
|
}
|
|
|
|
func buildHealthCheckTLSConfig(healthCheckClientCert *ctls.Certificate, disableTLS bool) *tls.Configuration {
|
|
cfg := &tls.Configuration{
|
|
DisableTLS: disableTLS,
|
|
// InsecureSkipVerify=true: it is always a localhost connection, so no reason to re-verify the server
|
|
// certificate on every probe.
|
|
StrictValidation: false,
|
|
}
|
|
if healthCheckClientCert != nil {
|
|
cfg.ClientCertificates = []ctls.Certificate{*healthCheckClientCert}
|
|
}
|
|
return cfg
|
|
}
|