duynguyen/cluster-bootstrap
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: never store argocd admin password hash in git

Browse Source 
Drop .env/envsubst/bake-hash-into-values.yaml flow entirely. Chart's
configs.secret block is removed for good, so the rendered manifest
never declares admin.password/admin.passwordMtime. Password hash is
set once directly on the live argocd-secret via kubectl patch, and
survives every self-heal sync since ArgoCD never owns those fields.
This commit is contained in:
duynguyen
2026-07-14 18:52:46 +07:00
parent cffaa7449d
commit c2c265c898
3 changed files with 18 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

53
README.md
View File

@@ -46,27 +46,13 @@ helm version
---
## Phase 2 — Set credentials
Install tools (one-time):
## Phase 2 — Install tools
```bash
sudo dnf install -y httpd-tools gettext
sudo dnf install -y httpd-tools
```
Copy and fill in `.env`:
```bash
cp .env.example .env
```
Generate bcrypt hash and set it in `.env`:
```bash
htpasswd -nbBC 10 "" YOUR_PASSWORD | tr -d ':\n' | sed 's/$2y/$2a/'
```
`.env` is gitignored — never commit it.
`htpasswd` is used in Phase 3.1 to generate the admin password hash. No `.env` file, no `envsubst` — the password never touches Git.
---
@@ -82,15 +68,13 @@ helm repo add argo https://argoproj.github.io/argo-helm
helm repo update
```
Install ArgoCD (`envsubst` fills `$ARGOCD_ADMIN_PASSWORD_HASH` from `.env` before helm reads the values):
Install ArgoCD:
```bash
source .env
helm install argocd argo/argo-cd -n argocd --create-namespace -f manifests/argocd/values.yaml
```
```bash
envsubst < manifests/argocd/values.yaml | helm install argocd argo/argo-cd -n argocd --create-namespace -f -
```
`values.yaml` deliberately has no `configs.secret` block — the chart auto-generates a random admin password, stored in `argocd-initial-admin-secret`. That's replaced with your own in 3.1.
Wait for ArgoCD to be ready:
@@ -98,30 +82,29 @@ Wait for ArgoCD to be ready:
kubectl wait --for=condition=available deployment/argocd-server -n argocd --timeout=120s
```
Port-forward to access UI (MetalLB + Envoy not running yet):
Check pods are up:
```bash
kubectl port-forward svc/argocd-server -n argocd 8080:443
kubectl get pods -n argocd
```
Open `https://localhost:8080` — login with `admin` and the password you chose.
> UI login isn't needed for bootstrap (Phase 4 applies the root Application via `kubectl`). Only port-forward if you want to inspect ArgoCD manually: `kubectl port-forward svc/argocd-server -n argocd 8080:443`, then open `https://localhost:8080` with `admin` / your chosen password.
### 3.1 Bake the hash into values.yaml for self-management
### 3.1 Set your own admin password directly on the Secret
ArgoCD won't run `envsubst` when it self-manages — replace the placeholder with the real hash so future syncs work:
Set it once, straight on `argocd-secret` (the Secret ArgoCD actually reads) — never in `values.yaml`, never committed to Git:
```bash
source .env
sed -i "s|\$ARGOCD_ADMIN_PASSWORD_HASH|$ARGOCD_ADMIN_PASSWORD_HASH|" manifests/argocd/values.yaml
read -s -p "ArgoCD admin password: " PW; echo
HASH=$(htpasswd -nbBC 12 "" "$PW" | tr -d ':\n' | sed 's/$2y/$2a/')
kubectl patch secret argocd-secret -n argocd --type merge -p \
"{\"stringData\":{\"admin.password\":\"$HASH\",\"admin.passwordMtime\":\"$(date -u +%FT%TZ)\"}}"
unset PW HASH
```
```bash
git add manifests/argocd/values.yaml && git commit -m "set argocd admin password hash"
```
**Why this stays stable across self-management:** `values.yaml` never declares `configs.secret.argocdServerAdminPassword`, so the Helm chart's rendered manifest never includes `admin.password`/`admin.passwordMtime`. Once ArgoCD self-manages (wave -1, `selfHeal: true`), it only reconciles fields present in its own rendered output — it has no opinion on keys it never declared, so your patched hash survives every sync, forever. If that block is ever added back to `values.yaml`, the next self-heal overwrites it — don't add it.
```bash
git push origin main
```
To rotate later: repeat the same `kubectl patch` with a new hash and a new `admin.passwordMtime` (ArgoCD only accepts the change if the Mtime also changes).
---