From 82630fb98b4796497dab6980a77d019cfbbaa735 Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Wed, 29 Apr 2026 10:38:05 -0500 Subject: [PATCH] add argocd-image-updater with forgejo registry config annotates the 4 Applications so image-updater scans git.mcintire.me on a 2min loop and writes new tags to spec.source.kustomize.images (no git commits, no CI sed-and-bump). --- home/cluster/argocd/apps/aprs.yaml | 5 + home/cluster/argocd/apps/gridmap.yaml | 5 + home/cluster/argocd/apps/prop.yaml | 7 + home/cluster/argocd/apps/towerops.yaml | 5 + .../cluster/argocd/image-updater/install.yaml | 281 ++++++++++++++++++ .../argocd/image-updater/kustomization.yaml | 26 ++ 6 files changed, 329 insertions(+) create mode 100644 home/cluster/argocd/image-updater/install.yaml create mode 100644 home/cluster/argocd/image-updater/kustomization.yaml diff --git a/home/cluster/argocd/apps/aprs.yaml b/home/cluster/argocd/apps/aprs.yaml index d1a7f20..8eeb76b 100644 --- a/home/cluster/argocd/apps/aprs.yaml +++ b/home/cluster/argocd/apps/aprs.yaml @@ -3,6 +3,11 @@ kind: Application metadata: name: aprs namespace: argocd + annotations: + argocd-image-updater.argoproj.io/image-list: aprs=git.mcintire.me/graham/aprs.me + argocd-image-updater.argoproj.io/aprs.update-strategy: newest-build + argocd-image-updater.argoproj.io/aprs.allow-tags: regexp:^main-[0-9]+-[0-9a-f]+$ + argocd-image-updater.argoproj.io/write-back-method: argocd finalizers: - resources-finalizer.argocd.argoproj.io spec: diff --git a/home/cluster/argocd/apps/gridmap.yaml b/home/cluster/argocd/apps/gridmap.yaml index 0021113..ddcd19e 100644 --- a/home/cluster/argocd/apps/gridmap.yaml +++ b/home/cluster/argocd/apps/gridmap.yaml @@ -3,6 +3,11 @@ kind: Application metadata: name: gridmap namespace: argocd + annotations: + argocd-image-updater.argoproj.io/image-list: gridmap=git.mcintire.me/graham/gridmap + argocd-image-updater.argoproj.io/gridmap.update-strategy: newest-build + argocd-image-updater.argoproj.io/gridmap.allow-tags: regexp:^main-[0-9]+-[0-9a-f]+$ + argocd-image-updater.argoproj.io/write-back-method: argocd finalizers: - resources-finalizer.argocd.argoproj.io spec: diff --git a/home/cluster/argocd/apps/prop.yaml b/home/cluster/argocd/apps/prop.yaml index 6111665..e296dd7 100644 --- a/home/cluster/argocd/apps/prop.yaml +++ b/home/cluster/argocd/apps/prop.yaml @@ -3,6 +3,13 @@ kind: Application metadata: name: prop namespace: argocd + annotations: + argocd-image-updater.argoproj.io/image-list: prop=git.mcintire.me/graham/prop,grid=git.mcintire.me/graham/prop-grid-rs + argocd-image-updater.argoproj.io/prop.update-strategy: newest-build + argocd-image-updater.argoproj.io/prop.allow-tags: regexp:^main-[0-9]+-[0-9a-f]+$ + argocd-image-updater.argoproj.io/grid.update-strategy: newest-build + argocd-image-updater.argoproj.io/grid.allow-tags: regexp:^main-[0-9]+-[0-9a-f]+$ + argocd-image-updater.argoproj.io/write-back-method: argocd finalizers: - resources-finalizer.argocd.argoproj.io spec: diff --git a/home/cluster/argocd/apps/towerops.yaml b/home/cluster/argocd/apps/towerops.yaml index 2de886b..ce9dd0b 100644 --- a/home/cluster/argocd/apps/towerops.yaml +++ b/home/cluster/argocd/apps/towerops.yaml @@ -3,6 +3,11 @@ kind: Application metadata: name: towerops namespace: argocd + annotations: + argocd-image-updater.argoproj.io/image-list: towerops=git.mcintire.me/graham/towerops-web + argocd-image-updater.argoproj.io/towerops.update-strategy: newest-build + argocd-image-updater.argoproj.io/towerops.allow-tags: regexp:^main-[0-9]+-[0-9a-f]+$ + argocd-image-updater.argoproj.io/write-back-method: argocd finalizers: - resources-finalizer.argocd.argoproj.io spec: diff --git a/home/cluster/argocd/image-updater/install.yaml b/home/cluster/argocd/image-updater/install.yaml new file mode 100644 index 0000000..16267ad --- /dev/null +++ b/home/cluster/argocd/image-updater/install.yaml @@ -0,0 +1,281 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: argocd-image-updater + app.kubernetes.io/part-of: argocd-image-updater + name: argocd-image-updater +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: argocd-image-updater + app.kubernetes.io/part-of: argocd-image-updater + name: argocd-image-updater +rules: +- apiGroups: + - "" + resources: + - secrets + - configmaps + verbs: + - get + - list + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: argocd-image-updater + app.kubernetes.io/part-of: argocd-image-updater + name: argocd-image-updater +rules: +- apiGroups: + - "" + resources: + - events + verbs: + - create +- apiGroups: + - argoproj.io + resources: + - applications + verbs: + - get + - list + - update + - patch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: argocd-image-updater + app.kubernetes.io/part-of: argocd-image-updater + name: argocd-image-updater +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: argocd-image-updater +subjects: +- kind: ServiceAccount + name: argocd-image-updater +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: argocd-image-updater + app.kubernetes.io/part-of: argocd-image-updater + name: argocd-image-updater +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: argocd-image-updater +subjects: +- kind: ServiceAccount + name: argocd-image-updater + namespace: argocd +--- +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/name: argocd-image-updater-config + app.kubernetes.io/part-of: argocd-image-updater + name: argocd-image-updater-config +--- +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/name: argocd-image-updater-ssh-config + app.kubernetes.io/part-of: argocd-image-updater + name: argocd-image-updater-ssh-config +--- +apiVersion: v1 +kind: Secret +metadata: + labels: + app.kubernetes.io/name: argocd-image-updater-secret + app.kubernetes.io/part-of: argocd-image-updater + name: argocd-image-updater-secret +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: argocd-image-updater + app.kubernetes.io/part-of: argocd-image-updater + name: argocd-image-updater +spec: + selector: + matchLabels: + app.kubernetes.io/name: argocd-image-updater + strategy: + type: Recreate + template: + metadata: + labels: + app.kubernetes.io/name: argocd-image-updater + spec: + containers: + - args: + - run + env: + - name: APPLICATIONS_API + valueFrom: + configMapKeyRef: + key: applications_api + name: argocd-image-updater-config + optional: true + - name: ARGOCD_GRPC_WEB + valueFrom: + configMapKeyRef: + key: argocd.grpc_web + name: argocd-image-updater-config + optional: true + - name: ARGOCD_SERVER + valueFrom: + configMapKeyRef: + key: argocd.server_addr + name: argocd-image-updater-config + optional: true + - name: ARGOCD_INSECURE + valueFrom: + configMapKeyRef: + key: argocd.insecure + name: argocd-image-updater-config + optional: true + - name: ARGOCD_PLAINTEXT + valueFrom: + configMapKeyRef: + key: argocd.plaintext + name: argocd-image-updater-config + optional: true + - name: ARGOCD_TOKEN + valueFrom: + secretKeyRef: + key: argocd.token + name: argocd-image-updater-secret + optional: true + - name: IMAGE_UPDATER_LOGLEVEL + valueFrom: + configMapKeyRef: + key: log.level + name: argocd-image-updater-config + optional: true + - name: GIT_COMMIT_USER + valueFrom: + configMapKeyRef: + key: git.user + name: argocd-image-updater-config + optional: true + - name: GIT_COMMIT_EMAIL + valueFrom: + configMapKeyRef: + key: git.email + name: argocd-image-updater-config + optional: true + - name: GIT_COMMIT_SIGNING_KEY + valueFrom: + configMapKeyRef: + key: git.commit-signing-key + name: argocd-image-updater-config + optional: true + - name: GIT_COMMIT_SIGNING_METHOD + valueFrom: + configMapKeyRef: + key: git.commit-signing-method + name: argocd-image-updater-config + optional: true + - name: GIT_COMMIT_SIGN_OFF + valueFrom: + configMapKeyRef: + key: git.commit-sign-off + name: argocd-image-updater-config + optional: true + - name: IMAGE_UPDATER_KUBE_EVENTS + valueFrom: + configMapKeyRef: + key: kube.events + name: argocd-image-updater-config + optional: true + - name: ARGOCD_LOGLEVEL + valueFrom: + configMapKeyRef: + key: log.level + name: argocd-image-updater-config + optional: true + image: quay.io/argoprojlabs/argocd-image-updater:v0.16.0 + imagePullPolicy: Always + livenessProbe: + httpGet: + path: /healthz + port: 8080 + initialDelaySeconds: 3 + periodSeconds: 30 + name: argocd-image-updater + ports: + - containerPort: 8080 + readinessProbe: + httpGet: + path: /healthz + port: 8080 + initialDelaySeconds: 3 + periodSeconds: 30 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /app/config + name: image-updater-conf + - mountPath: /app/config/ssh + name: ssh-known-hosts + - mountPath: /app/.ssh + name: ssh-config + - mountPath: /tmp + name: tmp + - mountPath: /app/ssh-keys/id_rsa + name: ssh-signing-key + readOnly: true + subPath: sshPrivateKey + serviceAccountName: argocd-image-updater + volumes: + - configMap: + items: + - key: registries.conf + path: registries.conf + - key: git.commit-message-template + path: commit.template + name: argocd-image-updater-config + optional: true + name: image-updater-conf + - configMap: + name: argocd-ssh-known-hosts-cm + optional: true + name: ssh-known-hosts + - configMap: + name: argocd-image-updater-ssh-config + optional: true + name: ssh-config + - name: ssh-signing-key + secret: + optional: true + secretName: ssh-git-creds + - emptyDir: {} + name: tmp diff --git a/home/cluster/argocd/image-updater/kustomization.yaml b/home/cluster/argocd/image-updater/kustomization.yaml new file mode 100644 index 0000000..c87bc81 --- /dev/null +++ b/home/cluster/argocd/image-updater/kustomization.yaml @@ -0,0 +1,26 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +namespace: argocd + +resources: + - install.yaml + +patches: + - target: + kind: ConfigMap + name: argocd-image-updater-config + patch: |- + apiVersion: v1 + kind: ConfigMap + metadata: + name: argocd-image-updater-config + data: + registries.conf: | + registries: + - name: Forgejo Registry + api_url: https://git.mcintire.me + prefix: git.mcintire.me + ping: yes + credentials: pullsecret:argocd/forgejo-registry + default: true