From 40d7f794aae40347bb3eff1e71a42972deb86de0 Mon Sep 17 00:00:00 2001
From: duynguyen <huonghaiduynhim@gmail.com>
Date: Sun, 14 Jun 2026 18:10:39 +0700
Subject: [PATCH] store bcrypt hash in .env, pass to helm via --set at install
 time

---
 .env.example |  3 ++-
 README.md    | 28 ++++++++++++++++++----------
 2 files changed, 20 insertions(+), 11 deletions(-)

diff --git a/.env.example b/.env.example
index a93fc39..afe6aee 100644
--- a/.env.example
+++ b/.env.example
@@ -1 +1,2 @@
-ARGOCD_ADMIN_PASSWORD=
+# Generate with: htpasswd -nbBC 10 "" YOUR_PASSWORD | tr -d ':\n' | sed 's/$2y/$2a/'
+ARGOCD_ADMIN_PASSWORD_HASH=
diff --git a/README.md b/README.md
index 88b6147..12d1373 100644
--- a/README.md
+++ b/README.md
@@ -51,18 +51,22 @@ helm version
 cp .env.example .env
 ```
 
-Edit `.env` and set `ARGOCD_ADMIN_PASSWORD` to your desired password. This file is gitignored — never commit it.
-
----
-
-## Phase 3 — Install ArgoCD
-
-Install `httpd-tools` for bcrypt hash generation (one-time):
+Generate a bcrypt hash of your password and paste it into `.env`:
 
 ```bash
 sudo dnf install -y httpd-tools
 ```
 
+```bash
+htpasswd -nbBC 10 "" YOUR_PASSWORD | tr -d ':\n' | sed 's/$2y/$2a/'
+```
+
+Set `ARGOCD_ADMIN_PASSWORD_HASH` in `.env` to the output. This file is gitignored — never commit it.
+
+---
+
+## Phase 3 — Install ArgoCD
+
 Add Helm repo:
 
 ```bash
@@ -73,10 +77,14 @@ helm repo add argo https://argoproj.github.io/argo-helm
 helm repo update
 ```
 
-Install ArgoCD with your password from `.env`:
+Install ArgoCD:
 
 ```bash
-source .env && BCRYPT=$(htpasswd -nbBC 10 "" "$ARGOCD_ADMIN_PASSWORD" | tr -d ':\n' | sed 's/$2y/$2a/') && helm install argocd argo/argo-cd -n argocd --create-namespace -f manifests/argocd/values.yaml --set configs.secret.argocdServerAdminPassword="$BCRYPT" --set configs.secret.argocdServerAdminPasswordMtime="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+source .env
+```
+
+```bash
+helm install argocd argo/argo-cd -n argocd --create-namespace -f manifests/argocd/values.yaml --set configs.secret.argocdServerAdminPassword="$ARGOCD_ADMIN_PASSWORD_HASH" --set configs.secret.argocdServerAdminPasswordMtime="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
 ```
 
 Wait for ArgoCD to be ready:
@@ -91,7 +99,7 @@ Port-forward to access UI (MetalLB + Envoy not running yet):
 kubectl port-forward svc/argocd-server -n argocd 8080:443
 ```
 
-Open `https://localhost:8080` — login with `admin` and the password from your `.env`.
+Open `https://localhost:8080` — login with `admin` and the password you chose.
 
 ---