ArgoCD快速入门 - 云原生基站

1 部署 ArgoCD#

官方提供四种部署方式,分别是:

无高可用集群权限 > 指定命名空间权限默认只有 argocd 命名空间权限,增加别的命名空间权限参考:Applications in any namespace - Argo CD - Declarative GitOps CD for Kubernetes > 需要单独安装 crds

高可用集群权限 > 指定命名空间权限高可用配置参考

此文档后面补充了下,所以会出现图片对不上的情况,但不影响观看

1.1 argo 配置#

1
# 这里用的高可用配置
2
wget https://github.com/argoproj/argo-cd/blob/master/manifests/install.yaml
3
vim install.yaml
4

5
# 添加gitlab解析,避免访问不了gitlab
6
spec:
7
......
8
    spec:
9
      hostAliases:
10
      - ip: 10.99.205.6
11
        hostnames:
12
        - gitlab.xpaas.ccops.com
13
# 配置持久化, argocd-redis-ha-server配置文件里删除字段
14
      - emptyDir: {}
15
        name: data
16
# 删除,不然出现 failed exit status 2 参考: https://github.com/argoproj/argo-cd/issues/9809
17
        securityContext:
18
          allowPrivilegeEscalation: false
19
          capabilities:
20
            drop:
21
            - ALL
22
          readOnlyRootFilesystem: true
23
          runAsNonRoot: true
24
          seccompProfile:
25
            type: RuntimeDefault
26
# 添加持久化
27
    volumeClaimTemplates:
28
      - metadata:
29
          name: data
30
          labels:
31
            app: "redis"
32
        spec:
33
          accessModes:
34
            - "ReadWriteOnce"
35
          resources:
36
            requests:
37
              storage: "8Gi"
38
          storageClassName: "rbd-csi"
39
# 添加 http访问,默认强制https
40
apiVersion: v1
41
data:
42
  redis.server:  argocd-redis-ha-haproxy:6379
43
  server.insecure: "true" #要添加的
44
kind: ConfigMap
45
metadata:
46
  labels:
47
    app.kubernetes.io/name: argocd-cmd-params-cm
48
    app.kubernetes.io/part-of: argocd
49
  name: argocd-cmd-params-cm

1.2 查看pod是否正常#

1
kubectl get pod -n argocd
2
NAME                                                READY   STATUS    RESTARTS   AGE
3
argocd-application-controller-0                     1/1     Running   0          48m
4
argocd-application-controller-1                     1/1     Running   0          48m
5
argocd-application-controller-2                     1/1     Running   0          49m
6
argocd-applicationset-controller-84c8548bf6-2p244   1/1     Running   0          33m
7
argocd-applicationset-controller-84c8548bf6-9gq5h   1/1     Running   0          33m
8
argocd-applicationset-controller-84c8548bf6-bvlkg   1/1     Running   0          33m
9
argocd-dex-server-65cb45687-5bxdb                   1/1     Running   0          49m
10
argocd-dex-server-65cb45687-hzvlw                   1/1     Running   0          49m
11
argocd-dex-server-65cb45687-kl24l                   1/1     Running   0          49m
12
argocd-notifications-controller-7854c8cd9b-cjzbl    1/1     Running   0          33m
13
argocd-notifications-controller-7854c8cd9b-csqbb    1/1     Running   0          33m
14
argocd-notifications-controller-7854c8cd9b-xs874    1/1     Running   0          33m
15
argocd-redis-ha-haproxy-56546c5467-9mjrx            1/1     Running   0          48m
16
argocd-redis-ha-haproxy-56546c5467-bgmld            1/1     Running   0          49m
17
argocd-redis-ha-haproxy-56546c5467-ttccs            1/1     Running   0          48m
18
argocd-redis-ha-server-0                            3/3     Running   0          44m
19
argocd-redis-ha-server-1                            3/3     Running   0          46m
20
argocd-redis-ha-server-2                            3/3     Running   0          48m
21
argocd-repo-server-5646948fd4-lvhl2                 1/1     Running   0          50m
22
argocd-repo-server-5646948fd4-pklbb                 1/1     Running   0          50m
23
argocd-repo-server-5646948fd4-xdt8h                 1/1     Running   0          50m
24
argocd-server-7b7744ff5d-dtmn4                      1/1     Running   0          48m
25
argocd-server-7b7744ff5d-t7t4q                      1/1     Running   0          49m
26

27
# 查看密码
28
kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d

2 argocd-server 配置与使用#

2.1 配置项目#

命名空间可以使用简单对正则,比如 !xxx,表示不能部署到xxx命名空间

2.2 添加 git 仓库#

没问题会显示 Successful

2.3 添加集群#

2.3.1 查看添加的集群信息#

集群添加 kubeconfig 参考[[Kubernetes自定义权限]],如果不想自定义权限也可以拷贝/root/.kube/config 比较重要的是 name

1
# 获取集群名称
2
kubectl config get-contexts
3
CURRENT   NAME         CLUSTER      AUTHINFO   NAMESPACE
4
*         kubernetes   kubernetes   admin

2.3.2 argocd 添加集群#

1
# 拷贝刚才对kubeconfig
2
kubectl cp  tstconfig -n argocd   $(kubectl get pods -n argocd -l app.kubernetes.io/name=argocd-server -o jsonpath='{.items[0].metadata.name}'):/home/argocd
3

4
# 查看密码
5
kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d
6

7
# 进入argo容器添加集群
8
# 进入容器
9
kubectl exec -it -n argocd $(kubectl get pods -n argocd -l app.kubernetes.io/name=argocd-server -o jsonpath='{.items[0].metadata.name}') bash
10
# 登陆argocd
11
argocd login 127.0.0.1:8080 --username admin --password qweasd123 (查看密码结果)
12
WARNING: server certificate had error: x509: cannot validate certificate for 127.0.0.1 because it doesn't contain any IP SANs. Proceed insecurely (y/n)? y
13
'admin:login' logged in successfully
14
Context '127.0.0.1:8080' updated
15

16
# 添加集群
17
argocd cluster add kubernetes --kubeconfig tstconfig --name test-env
18

19
# 查看集群信息
20
# 没有配置app.所以集群状态Unknown
21
argocd cluster list
22
SERVER                          NAME              VERSION  STATUS      MESSAGE                                                  PROJECT
23
https://kubernetes.default.svc  ceph-tst-cluster  1.22     Successful
24
https://10.1.1.1:443      test-env                   Unknown     Cluster has no applications and is not being monitored.

2.3.3 查看集群#

2.4 添加应用#

2.5 配置权限#

这里创建了俩账户,一个管理员权限,一个只读应用权限

kubectl edit configmap argocd-cm -n argocd

1
data:
2
  accounts.argocd: login
3
  accounts.argocd.enabled: "true"
4
  accounts.argocd-admin: login
5
  accounts.argocd-admin.enabled: "true"
6
  admin.enabled: "true"

kubectl edit configmap argocd-rbac-cm -n argocd

1
data:
2
  # 定义默认用户是只读用户角色
3
  policy.default: role:readonly
4
  # 定义管理员角色
5
  policy.csv: |
6
    g, argocd-admin, role:admin

2.5.1 登录 argo 服务#

1
argocd login 127.0.0.1:8080 --username admin --password qweasd123 (查看密码结果)
2
# 查看用户
3
argocd account list
4
NAME          ENABLED  CAPABILITIES
5
admin         true     login
6
argocd        true     login
7
argocd-admin  true     login

2.5.2 修改密码#

argocd account update-password --account admin --new-password qweasd 回车后输入上面步骤查到的root密码

2.5.3 测试#

普通账户同步会报错

管理员账户不会

2.6 备份与恢复#

1
kubectl exec -it -n argocd $(kubectl get pods -n argocd -l app.kubernetes.io/name=argocd-server -o jsonpath='{.items[0].metadata.name}') bash
2
# 备份
3
argocd admin export > backup.yaml
4
# 恢复
5
argocd admin import - < backup.yaml

详细文档参考

3 web 使用#

3.1 这里可以选择不同的展示#

3.2 查看服务的所有日志，不同的实例会有不同的颜色标记#

3.3 看某个实例的日志#

4 监控#

参考官网,默认监控接口已经打开了