feat: move kubectl config setup to init-container

Reviewed-on: #14

.ci/README.md

@@ -14,7 +14,7 @@ include .ci/podman.mk
 
 Add subtree to your project:
 ```
-git subtree add --prefix .ci https://git.zero-downtime.net/ZeroDownTime/ci-tools-lib.git master --squash
+git subtree add --prefix .ci https://git.zero-downtime.net/ZeroDownTime/ci-tools-lib.git main --squash
 ```
 
 

.ci/ecr_public_lifecycle.py

@@ -41,7 +41,8 @@ for image in sorted(images, key=lambda d: d['imagePushedAt'], reverse=True):
         _delete = True
         for tag in image["imageTags"]:
             # Look for at least one tag NOT beign a SemVer dev tag
-            if "-" not in tag:
+            # untagged dev builds get tagged as <tag>-g<commit>
+            if "-g" not in tag and "dirty" not in tag:
                 _delete = False
         if _delete:
             print("Deleting development image {}".format(image["imageTags"]))

.ci/podman.mk

@@ -8,8 +8,8 @@ SHELL := bash
 .PHONY: all # All targets are accessible for user
 .DEFAULT: help # Running Make will run the help target
 
-# Parse version from latest git semver tag
-GIT_TAG ?= $(shell git describe --tags --match v*.*.* 2>/dev/null || git rev-parse --short HEAD 2>/dev/null)
+# Parse version from latest git semver tag, use short commit otherwise
+GIT_TAG ?= $(shell git describe --tags --match v*.*.* --dirty 2>/dev/null || git describe --match="" --always --dirty 2>/dev/null)
 GIT_BRANCH ?= $(shell git rev-parse --abbrev-ref HEAD 2>/dev/null)
 
 TAG ::= $(GIT_TAG)
@@ -49,7 +49,7 @@ test:: ## test built artificats
 
 scan: ## Scan image using trivy
 	echo "Scanning $(IMAGE):$(TAG)-$(_ARCH) using Trivy $(TRIVY_REMOTE)"
-	trivy image $(TRIVY_OPTS) --quiet --no-progress --ignorefile ./.trivyignore.yaml localhost/$(IMAGE):$(TAG)-$(_ARCH)
+	trivy image $(TRIVY_OPTS) --quiet --no-progress localhost/$(IMAGE):$(TAG)-$(_ARCH)
 
 # first tag and push all actual images
 # create new manifest for each tag and add all available TAG-ARCH before pushing

Dockerfile

@@ -1,11 +1,11 @@
-FROM quay.io/argoproj/argocd:v2.14.9
+FROM quay.io/argoproj/argocd:v3.0.9
 
 # renovate: datasource=github-releases depName=sops packageName=getsops/sops
-ARG SOPS_VERSION=v3.10.1
+ARG SOPS_VERSION=v3.10.2
 # renovate: datasource=github-releases depName=vals packageName=helmfile/vals
-ARG VALS_VERSION=v0.40.1
+ARG VALS_VERSION=v0.41.2
 # renovate: datasource=github-releases depName=helm-secrets packageName=jkroepke/helm-secrets
-ARG HELM_SECRETS_VERSION=v4.6.3
+ARG HELM_SECRETS_VERSION=v4.6.5
 
 ARG ARGOCD_USER_ID="999"
 
@@ -17,7 +17,7 @@ ENV HELM_SECRETS_BACKEND="vals" \
     HELM_SECRETS_VALUES_ALLOW_ABSOLUTE_PATH=true \
     HELM_SECRETS_VALUES_ALLOW_PATH_TRAVERSAL=false \
     HELM_SECRETS_WRAPPER_ENABLED=true \
-    KUBECONFIG=/tmp/kubectl.config
+    KUBECONFIG=/home/argocd/cmp-server/plugins/kubectl.config
 
 # Optionally, set default gpg key for sops files
 # ENV HELM_SECRETS_LOAD_GPG_KEYS=/path/to/gpg.key
@@ -44,13 +44,10 @@ RUN mkdir -p /home/argocd/.local/share/helm/plugins && \
     | tar -C /home/argocd/.local/share/helm/plugins -xzf- && \
     chown -R root: /home/argocd/.local/share/helm && \
     ln -sf /home/argocd/.local/share/helm/plugins/helm-secrets/scripts/wrapper/helm.sh /usr/local/sbin/helm && \
-    sed -i -e 's/secrets/secrets --evaluate-templates/' /home/argocd/.local/share/helm/plugins/helm-secrets/scripts/wrapper/helm.sh && \
-    rm -f /usr/local/bin/argocd-repo-server
+    sed -i -e 's/secrets/secrets --evaluate-templates/' /home/argocd/.local/share/helm/plugins/helm-secrets/scripts/wrapper/helm.sh
 
-
-
-# replace argocd-repo-server with wrapper to install kubectl config
-ADD argocd-repo-server-wrapper.sh /usr/local/bin/argocd-repo-server
+# Add tools scripts for the init-container
+ADD create-kubectl-config.sh /usr/local/bin/create-kubectl-config.sh
 
 # register vals "cmp plugin"
 ADD plugin.yaml /home/argocd/cmp-server/config/plugin.yaml

create-kubectl-config.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 
-KUBECONFIG=/tmp/kubectl.config
+KUBECONFIG=/home/argocd/cmp-server/plugins/kubectl.config
 SA_NAME=argo-argocd-repo-server
 
 CA64=$(cat /run/secrets/kubernetes.io/serviceaccount/ca.crt | base64 -w0)
@@ -28,4 +28,4 @@ EOF
 
 chmod 600 $KUBECONFIG
 
-ARGOCD_BINARY_NAME=argocd-repo-server /usr/local/bin/argocd $@
+# ARGOCD_BINARY_NAME=argocd-cmp-server /usr/local/bin/argocd $@