Initial: Add all homelab manifests
This commit is contained in:
226
docs/07-argocd.md
Normal file
226
docs/07-argocd.md
Normal file
@@ -0,0 +1,226 @@
|
||||
# 07 — ArgoCD
|
||||
|
||||
**Datum:** 2026-03-17
|
||||
**Version:** ArgoCD v3.3.4 (Helm Chart argo-cd-9.4.12)
|
||||
**Namespace:** argocd
|
||||
**URL:** https://argocd.192.168.11.170.nip.io
|
||||
|
||||
---
|
||||
|
||||
## Übersicht
|
||||
|
||||
ArgoCD ist ein deklarativer GitOps Continuous Delivery Controller für
|
||||
Kubernetes. Es synchronisiert Kubernetes-Manifeste aus Git-Repositories
|
||||
automatisch in den Cluster. Änderungen im Git → ArgoCD erkennt Drift →
|
||||
automatisches oder manuelles Sync in den Cluster.
|
||||
|
||||
---
|
||||
|
||||
## Voraussetzungen
|
||||
|
||||
- Traefik Ingress Controller aktiv (`04-traefik.md`)
|
||||
- cert-manager installiert (`05-cert-manager.md`)
|
||||
- Alle 3 Nodes `Ready`
|
||||
|
||||
---
|
||||
|
||||
## Installation
|
||||
|
||||
### 1. Argo Helm Repository hinzufügen
|
||||
|
||||
```bash
|
||||
helm repo add argo https://argoproj.github.io/argo-helm
|
||||
helm repo update
|
||||
```
|
||||
|
||||
Ausgabe:
|
||||
```
|
||||
"argo" has been added to your repositories
|
||||
...Successfully got an update from the "argo" chart repository
|
||||
```
|
||||
|
||||
### 2. Namespace erstellen
|
||||
|
||||
```bash
|
||||
kubectl create namespace argocd
|
||||
```
|
||||
|
||||
### 3. ArgoCD per Helm installieren
|
||||
|
||||
```bash
|
||||
helm install argocd argo/argo-cd \
|
||||
--namespace argocd \
|
||||
--version 9.4.12 \
|
||||
--set server.ingress.enabled=true \
|
||||
--set server.ingress.ingressClassName=traefik \
|
||||
--set "server.ingress.hostname=argocd.192.168.11.170.nip.io" \
|
||||
--set "server.ingress.tls=true" \
|
||||
--set configs.params."server\.insecure"=true \
|
||||
--set "server.ingress.annotations.traefik\.ingress\.kubernetes\.io/router\.entrypoints=websecure" \
|
||||
--set "server.ingress.annotations.traefik\.ingress\.kubernetes\.io/router\.tls=true" \
|
||||
--wait \
|
||||
--timeout 10m
|
||||
```
|
||||
|
||||
**Wichtige Flags:**
|
||||
- `configs.params."server\.insecure"=true` — ArgoCD Server läuft ohne eigenes
|
||||
TLS, da TLS durch Traefik terminiert wird (SSL-Termination am Ingress)
|
||||
- `server.ingress.tls=true` — Traefik stellt HTTPS bereit
|
||||
- Traefik-Annotations erzwingen HTTPS-Entrypoint
|
||||
|
||||
### Hinweis: Hostname-Parameter
|
||||
|
||||
Der Helm-Chart verwendet `server.ingress.hostname` (nicht `hosts[0]`).
|
||||
Bei Verwendung von `hosts[0]` wird der Default-Hostname `argocd.example.com`
|
||||
nicht überschrieben. Korrekte Variante ist `hostname`.
|
||||
|
||||
---
|
||||
|
||||
## Pod-Status
|
||||
|
||||
```bash
|
||||
kubectl get pods -n argocd -o wide
|
||||
```
|
||||
|
||||
```
|
||||
NAME READY STATUS NODE
|
||||
argocd-application-controller-0 1/1 Running rnk-wrk02
|
||||
argocd-applicationset-controller-6fdf946c79-28mzq 1/1 Running rnk-wrk02
|
||||
argocd-dex-server-855967dc45-q4l6n 1/1 Running rnk-wrk02
|
||||
argocd-notifications-controller-75cd85cdc-6zmqg 1/1 Running rnk-wrk02
|
||||
argocd-redis-75b6f7c5cf-hjkhc 1/1 Running rnk-wrk02
|
||||
argocd-redis-secret-init-xn472 0/1 Completed rnk-wrk02
|
||||
argocd-repo-server-59d5dccbf7-d5s99 1/1 Running rnk-wrk01
|
||||
argocd-server-56f7f5d5d9-ll626 1/1 Running rnk-wrk01
|
||||
```
|
||||
|
||||
Alle 7 Pods laufen stabil. `argocd-redis-secret-init` ist ein einmaliger
|
||||
Init-Job (Status `Completed` = korrekt).
|
||||
|
||||
**Komponenten:**
|
||||
|
||||
| Pod | Funktion |
|
||||
|---|---|
|
||||
| `argocd-server` | Web-UI + API Server |
|
||||
| `argocd-application-controller` | Überwacht Cluster-State vs. Git-State |
|
||||
| `argocd-repo-server` | Git-Repository-Zugriff, Manifest-Rendering |
|
||||
| `argocd-applicationset-controller` | Automatisierte Application-Sets |
|
||||
| `argocd-dex-server` | SSO / OIDC Identity Provider |
|
||||
| `argocd-redis` | Cache für Application State |
|
||||
| `argocd-notifications-controller` | Benachrichtigungen (Slack, Email etc.) |
|
||||
|
||||
---
|
||||
|
||||
## Ingress
|
||||
|
||||
```bash
|
||||
kubectl get ingress -n argocd
|
||||
```
|
||||
|
||||
```
|
||||
NAME CLASS HOSTS ADDRESS PORTS
|
||||
argocd-server traefik argocd.192.168.11.170.nip.io 192.168.11.170,192.168.11.171,192.168.11.172 80, 443
|
||||
```
|
||||
|
||||
TLS wird von Traefik terminiert. ArgoCD selbst läuft im `insecure`-Modus
|
||||
(HTTP intern), was bei Ingress-TLS-Terminierung der empfohlene Ansatz ist.
|
||||
|
||||
---
|
||||
|
||||
## Erster Login
|
||||
|
||||
### URL
|
||||
|
||||
```
|
||||
https://argocd.192.168.11.170.nip.io
|
||||
```
|
||||
|
||||
> Browser zeigt Zertifikatswarnung (Traefik self-signed) → "Trotzdem fortfahren"
|
||||
|
||||
### Zugangsdaten
|
||||
|
||||
| Feld | Wert |
|
||||
|---|---|
|
||||
| Benutzername | `admin` |
|
||||
| Passwort (initial) | `T8T1rLY0ac2MqWiC` |
|
||||
|
||||
### Admin-Passwort abrufen (jederzeit)
|
||||
|
||||
```bash
|
||||
kubectl -n argocd get secret argocd-initial-admin-secret \
|
||||
-o jsonpath="{.data.password}" | base64 -d && echo
|
||||
```
|
||||
|
||||
> **Sicherheitshinweis:** Nach dem ersten Login und Passwortänderung das
|
||||
> Initial-Secret löschen:
|
||||
> ```bash
|
||||
> kubectl delete secret argocd-initial-admin-secret -n argocd
|
||||
> ```
|
||||
|
||||
---
|
||||
|
||||
## Helm Release Info
|
||||
|
||||
```
|
||||
NAME NAMESPACE REVISION STATUS CHART APP VERSION
|
||||
argocd argocd 2 deployed argo-cd-9.4.12 v3.3.4
|
||||
```
|
||||
|
||||
Revision 2: Hostname-Fix von `argocd.example.com` → `argocd.192.168.11.170.nip.io`
|
||||
|
||||
---
|
||||
|
||||
## ArgoCD CLI (optional)
|
||||
|
||||
```bash
|
||||
# CLI installieren
|
||||
curl -sSL -o /usr/local/bin/argocd \
|
||||
https://github.com/argoproj/argo-cd/releases/latest/download/argocd-linux-amd64
|
||||
chmod +x /usr/local/bin/argocd
|
||||
|
||||
# Login
|
||||
argocd login argocd.192.168.11.170.nip.io \
|
||||
--username admin \
|
||||
--password T8T1rLY0ac2MqWiC \
|
||||
--insecure
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Erste Application deployen (Beispiel)
|
||||
|
||||
```yaml
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: my-app
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://github.com/mein-user/mein-repo.git
|
||||
targetRevision: HEAD
|
||||
path: k8s/
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: default
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true
|
||||
selfHeal: true
|
||||
```
|
||||
|
||||
```bash
|
||||
kubectl apply -f my-app.yaml
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Nächste Schritte
|
||||
|
||||
- [ ] Erstes Git-Repository in ArgoCD registrieren
|
||||
- [ ] Admin-Passwort ändern und Initial-Secret löschen
|
||||
- [ ] Homelab-Manifeste in Git-Repository ablegen
|
||||
- [ ] ArgoCD App für Longhorn/cert-manager Konfiguration erstellen
|
||||
- [ ] SSO via Dex konfigurieren (optional)
|
||||
- [ ] Notifications für Sync-Status einrichten (optional)
|
||||
Reference in New Issue
Block a user