add argocd-image-updater with forgejo registry config

annotates the 4 Applications so image-updater scans git.mcintire.me on a 2min loop and writes new tags to spec.source.kustomize.images (no git commits, no CI sed-and-bump).
2026-04-29 10:38:05 -05:00 · 2026-04-29 10:38:05 -05:00 · 82630fb98b
commit 82630fb98b
parent ae5ceebf44
6 changed files with 329 additions and 0 deletions
--- a/home/cluster/argocd/apps/aprs.yaml
+++ b/home/cluster/argocd/apps/aprs.yaml
@ -3,6 +3,11 @@ kind: Application
 metadata:
  name: aprs
  namespace: argocd
+  annotations:
+    argocd-image-updater.argoproj.io/image-list: aprs=git.mcintire.me/graham/aprs.me
+    argocd-image-updater.argoproj.io/aprs.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/aprs.allow-tags: regexp:^main-[0-9]+-[0-9a-f]+$
+    argocd-image-updater.argoproj.io/write-back-method: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
 spec:
--- a/home/cluster/argocd/apps/gridmap.yaml
+++ b/home/cluster/argocd/apps/gridmap.yaml
@ -3,6 +3,11 @@ kind: Application
 metadata:
  name: gridmap
  namespace: argocd
+  annotations:
+    argocd-image-updater.argoproj.io/image-list: gridmap=git.mcintire.me/graham/gridmap
+    argocd-image-updater.argoproj.io/gridmap.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/gridmap.allow-tags: regexp:^main-[0-9]+-[0-9a-f]+$
+    argocd-image-updater.argoproj.io/write-back-method: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
 spec:
--- a/home/cluster/argocd/apps/prop.yaml
+++ b/home/cluster/argocd/apps/prop.yaml
@ -3,6 +3,13 @@ kind: Application
 metadata:
  name: prop
  namespace: argocd
+  annotations:
+    argocd-image-updater.argoproj.io/image-list: prop=git.mcintire.me/graham/prop,grid=git.mcintire.me/graham/prop-grid-rs
+    argocd-image-updater.argoproj.io/prop.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/prop.allow-tags: regexp:^main-[0-9]+-[0-9a-f]+$
+    argocd-image-updater.argoproj.io/grid.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/grid.allow-tags: regexp:^main-[0-9]+-[0-9a-f]+$
+    argocd-image-updater.argoproj.io/write-back-method: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
 spec:
--- a/home/cluster/argocd/apps/towerops.yaml
+++ b/home/cluster/argocd/apps/towerops.yaml
@ -3,6 +3,11 @@ kind: Application
 metadata:
  name: towerops
  namespace: argocd
+  annotations:
+    argocd-image-updater.argoproj.io/image-list: towerops=git.mcintire.me/graham/towerops-web
+    argocd-image-updater.argoproj.io/towerops.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/towerops.allow-tags: regexp:^main-[0-9]+-[0-9a-f]+$
+    argocd-image-updater.argoproj.io/write-back-method: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
 spec:
--- a/home/cluster/argocd/image-updater/install.yaml
+++ b/home/cluster/argocd/image-updater/install.yaml
@ -0,0 +1,281 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: argocd-image-updater
+    app.kubernetes.io/part-of: argocd-image-updater
+  name: argocd-image-updater
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: argocd-image-updater
+    app.kubernetes.io/part-of: argocd-image-updater
+  name: argocd-image-updater
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  - configmaps
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: argocd-image-updater
+    app.kubernetes.io/part-of: argocd-image-updater
+  name: argocd-image-updater
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+- apiGroups:
+  - argoproj.io
+  resources:
+  - applications
+  verbs:
+  - get
+  - list
+  - update
+  - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: argocd-image-updater
+    app.kubernetes.io/part-of: argocd-image-updater
+  name: argocd-image-updater
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: argocd-image-updater
+subjects:
+- kind: ServiceAccount
+  name: argocd-image-updater
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: argocd-image-updater
+    app.kubernetes.io/part-of: argocd-image-updater
+  name: argocd-image-updater
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: argocd-image-updater
+subjects:
+- kind: ServiceAccount
+  name: argocd-image-updater
+  namespace: argocd
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/name: argocd-image-updater-config
+    app.kubernetes.io/part-of: argocd-image-updater
+  name: argocd-image-updater-config
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/name: argocd-image-updater-ssh-config
+    app.kubernetes.io/part-of: argocd-image-updater
+  name: argocd-image-updater-ssh-config
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    app.kubernetes.io/name: argocd-image-updater-secret
+    app.kubernetes.io/part-of: argocd-image-updater
+  name: argocd-image-updater-secret
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: argocd-image-updater
+    app.kubernetes.io/part-of: argocd-image-updater
+  name: argocd-image-updater
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: argocd-image-updater
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: argocd-image-updater
+    spec:
+      containers:
+      - args:
+        - run
+        env:
+        - name: APPLICATIONS_API
+          valueFrom:
+            configMapKeyRef:
+              key: applications_api
+              name: argocd-image-updater-config
+              optional: true
+        - name: ARGOCD_GRPC_WEB
+          valueFrom:
+            configMapKeyRef:
+              key: argocd.grpc_web
+              name: argocd-image-updater-config
+              optional: true
+        - name: ARGOCD_SERVER
+          valueFrom:
+            configMapKeyRef:
+              key: argocd.server_addr
+              name: argocd-image-updater-config
+              optional: true
+        - name: ARGOCD_INSECURE
+          valueFrom:
+            configMapKeyRef:
+              key: argocd.insecure
+              name: argocd-image-updater-config
+              optional: true
+        - name: ARGOCD_PLAINTEXT
+          valueFrom:
+            configMapKeyRef:
+              key: argocd.plaintext
+              name: argocd-image-updater-config
+              optional: true
+        - name: ARGOCD_TOKEN
+          valueFrom:
+            secretKeyRef:
+              key: argocd.token
+              name: argocd-image-updater-secret
+              optional: true
+        - name: IMAGE_UPDATER_LOGLEVEL
+          valueFrom:
+            configMapKeyRef:
+              key: log.level
+              name: argocd-image-updater-config
+              optional: true
+        - name: GIT_COMMIT_USER
+          valueFrom:
+            configMapKeyRef:
+              key: git.user
+              name: argocd-image-updater-config
+              optional: true
+        - name: GIT_COMMIT_EMAIL
+          valueFrom:
+            configMapKeyRef:
+              key: git.email
+              name: argocd-image-updater-config
+              optional: true
+        - name: GIT_COMMIT_SIGNING_KEY
+          valueFrom:
+            configMapKeyRef:
+              key: git.commit-signing-key
+              name: argocd-image-updater-config
+              optional: true
+        - name: GIT_COMMIT_SIGNING_METHOD
+          valueFrom:
+            configMapKeyRef:
+              key: git.commit-signing-method
+              name: argocd-image-updater-config
+              optional: true
+        - name: GIT_COMMIT_SIGN_OFF
+          valueFrom:
+            configMapKeyRef:
+              key: git.commit-sign-off
+              name: argocd-image-updater-config
+              optional: true
+        - name: IMAGE_UPDATER_KUBE_EVENTS
+          valueFrom:
+            configMapKeyRef:
+              key: kube.events
+              name: argocd-image-updater-config
+              optional: true
+        - name: ARGOCD_LOGLEVEL
+          valueFrom:
+            configMapKeyRef:
+              key: log.level
+              name: argocd-image-updater-config
+              optional: true
+        image: quay.io/argoprojlabs/argocd-image-updater:v0.16.0
+        imagePullPolicy: Always
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 8080
+          initialDelaySeconds: 3
+          periodSeconds: 30
+        name: argocd-image-updater
+        ports:
+        - containerPort: 8080
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: 8080
+          initialDelaySeconds: 3
+          periodSeconds: 30
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts:
+        - mountPath: /app/config
+          name: image-updater-conf
+        - mountPath: /app/config/ssh
+          name: ssh-known-hosts
+        - mountPath: /app/.ssh
+          name: ssh-config
+        - mountPath: /tmp
+          name: tmp
+        - mountPath: /app/ssh-keys/id_rsa
+          name: ssh-signing-key
+          readOnly: true
+          subPath: sshPrivateKey
+      serviceAccountName: argocd-image-updater
+      volumes:
+      - configMap:
+          items:
+          - key: registries.conf
+            path: registries.conf
+          - key: git.commit-message-template
+            path: commit.template
+          name: argocd-image-updater-config
+          optional: true
+        name: image-updater-conf
+      - configMap:
+          name: argocd-ssh-known-hosts-cm
+          optional: true
+        name: ssh-known-hosts
+      - configMap:
+          name: argocd-image-updater-ssh-config
+          optional: true
+        name: ssh-config
+      - name: ssh-signing-key
+        secret:
+          optional: true
+          secretName: ssh-git-creds
+      - emptyDir: {}
+        name: tmp
--- a/home/cluster/argocd/image-updater/kustomization.yaml
+++ b/home/cluster/argocd/image-updater/kustomization.yaml
@ -0,0 +1,26 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: argocd
+
+resources:
+  - install.yaml
+
+patches:
+  - target:
+      kind: ConfigMap
+      name: argocd-image-updater-config
+    patch: |-
+      apiVersion: v1
+      kind: ConfigMap
+      metadata:
+        name: argocd-image-updater-config
+      data:
+        registries.conf: |
+          registries:
+          - name: Forgejo Registry
+            api_url: https://git.mcintire.me
+            prefix: git.mcintire.me
+            ping: yes
+            credentials: pullsecret:argocd/forgejo-registry
+            default: true