From 2e5037d6f44f41b52e7137033f047a5d38886250 Mon Sep 17 00:00:00 2001 From: duynguyen Date: Tue, 14 Jul 2026 19:35:34 +0700 Subject: [PATCH] docs: trim README explanations, keep steps short --- README.md | 28 +++++++++------------------- 1 file changed, 9 insertions(+), 19 deletions(-) diff --git a/README.md b/README.md index 71fa09a..cb9a206 100644 --- a/README.md +++ b/README.md @@ -52,7 +52,7 @@ helm version sudo dnf install -y httpd-tools ``` -`htpasswd` is used in Phase 3.1 to generate the admin password hash. No `.env` file, no `envsubst` — the password never touches Git. +`htpasswd` generates the admin password hash used in Phase 3.1. --- @@ -68,31 +68,23 @@ helm repo add argo https://argoproj.github.io/argo-helm helm repo update ``` -Install ArgoCD: +Install ArgoCD (`values.yaml` has no `configs.secret` block — chart auto-generates a random admin password): ```bash helm install argocd argo/argo-cd -n argocd --create-namespace -f manifests/argocd/values.yaml ``` -`values.yaml` deliberately has no `configs.secret` block — the chart auto-generates a random admin password, stored in `argocd-initial-admin-secret`. That's replaced with your own in 3.1. - -Wait for ArgoCD to be ready: +Wait for ready: ```bash kubectl wait --for=condition=available deployment/argocd-server -n argocd --timeout=120s ``` -Check pods are up: +(Optional) inspect manually: `kubectl port-forward svc/argocd-server -n argocd 8080:443` → `https://localhost:8080`. Not needed for bootstrap. -```bash -kubectl get pods -n argocd -``` +### 3.1 Set admin password on the Secret -> UI login isn't needed for bootstrap (Phase 4 applies the root Application via `kubectl`). Only port-forward if you want to inspect ArgoCD manually: `kubectl port-forward svc/argocd-server -n argocd 8080:443`, then open `https://localhost:8080` with `admin` / your chosen password. - -### 3.1 Set your own admin password directly on the Secret - -Set it once, straight on `argocd-secret` (the Secret ArgoCD actually reads) — never in `values.yaml`, never committed to Git: +Patched directly on `argocd-secret`, never in `values.yaml`/Git — keeps `configs.secret` absent so self-heal (wave -1) never touches it, password stays stable forever: ```bash read -s -p "ArgoCD admin password: " PW; echo @@ -102,21 +94,19 @@ kubectl patch secret argocd-secret -n argocd --type merge -p \ unset PW HASH ``` -**Why this stays stable across self-management:** `values.yaml` never declares `configs.secret.argocdServerAdminPassword`, so the Helm chart's rendered manifest never includes `admin.password`/`admin.passwordMtime`. Once ArgoCD self-manages (wave -1, `selfHeal: true`), it only reconciles fields present in its own rendered output — it has no opinion on keys it never declared, so your patched hash survives every sync, forever. If that block is ever added back to `values.yaml`, the next self-heal overwrites it — don't add it. - -To rotate later: repeat the same `kubectl patch` with a new hash and a new `admin.passwordMtime` (ArgoCD only accepts the change if the Mtime also changes). +Rotate: repeat with new hash + new `admin.passwordMtime` (required for ArgoCD to accept the change). --- ## Phase 4 — Apply the root bootstrap Application -`bootstrap-app.yaml` (repo root) is the one seed manifest — it lives in Git, not created ad-hoc via UI/CLI. Per GitOps practice, every Application ArgoCD runs must be recreatable from Git; a UI-created app that's stored nowhere can't survive a rebuild. This is the only manifest ever applied by hand — everything downstream (including ArgoCD managing itself, wave -1) is reached by ArgoCD syncing `bootstrap/apps/` from here. +`bootstrap-app.yaml` (repo root) is the seed manifest, committed to Git — not created via UI/CLI. Only manifest ever applied by hand: ```bash kubectl apply -f bootstrap-app.yaml ``` -ArgoCD syncs all child Applications in wave order automatically, including self-managing itself via `bootstrap/apps/argocd.yaml` (wave -1). +ArgoCD syncs all child Applications in wave order automatically, including self-managing itself (`bootstrap/apps/argocd.yaml`, wave -1). Monitor progress: