85 lines
2.3 KiB
Markdown
85 lines
2.3 KiB
Markdown
# Argo CD examples
|
|
|
|
This directory is excluded from the packaged Helm chart. Its files are examples
|
|
for managing the chart from Argo CD.
|
|
|
|
## Application
|
|
|
|
[`application.yaml`](application.yaml) deploys:
|
|
|
|
- three Redis shards;
|
|
- one replica per shard;
|
|
- authenticated Redis with a chart-generated initial password;
|
|
- persistent volumes using the cluster's default StorageClass;
|
|
- internal-only Redis Services;
|
|
- RedisInsight connected automatically to the balanced bootstrap endpoint.
|
|
|
|
Apply it once:
|
|
|
|
```sh
|
|
kubectl apply -f argocd/application.yaml
|
|
```
|
|
|
|
Edit the destination namespace, target revision, and inline `valuesObject` as
|
|
needed. Because this file is not a Helm template, changing it in the Redis
|
|
Application's own repository does not change the live Application spec during a
|
|
normal sync. Reapply it, or manage it from an app-of-apps/ApplicationSet.
|
|
|
|
## Password Secret
|
|
|
|
For production GitOps, use an externally managed Secret and set:
|
|
|
|
```yaml
|
|
auth:
|
|
enabled: true
|
|
existingSecret: redis-auth
|
|
existingSecretKey: redis-password
|
|
```
|
|
|
|
[`redis-auth-secret.example.yaml`](redis-auth-secret.example.yaml) documents the
|
|
required Secret shape. Do not commit an actual cleartext password.
|
|
|
|
If the chart generates the password, retain
|
|
`RespectIgnoreDifferences=true` and the Secret ignore rule from
|
|
`application.yaml`; Argo's Helm renderer cannot use `lookup` to read the live
|
|
Secret while comparing desired state.
|
|
|
|
## Enabling external access
|
|
|
|
Add this to `valuesObject`:
|
|
|
|
```yaml
|
|
externalAccess:
|
|
enabled: true
|
|
loadBalancerClass: ""
|
|
loadBalancerSourceRanges:
|
|
- 203.0.113.0/24
|
|
```
|
|
|
|
This creates one balanced bootstrap LoadBalancer and one LoadBalancer per Redis
|
|
member. Every advertised member address must be routable from external clients.
|
|
|
|
## Exposing RedisInsight with Istio
|
|
|
|
Add:
|
|
|
|
```yaml
|
|
redisInsight:
|
|
enabled: true
|
|
ingress:
|
|
enabled: true
|
|
host: redisinsight.example.com
|
|
tls:
|
|
enabled: true
|
|
credentialName: redisinsight-tls
|
|
certificate:
|
|
create: true
|
|
issuerName: letsencrypt-production
|
|
issuerKind: ClusterIssuer
|
|
secretNamespace: istio-system
|
|
```
|
|
|
|
Replace the hostname, issuer, gateway selector, and Secret namespace with values
|
|
from your environment. RedisInsight has no built-in ingress authentication; add
|
|
an identity-aware proxy or Istio authorization policy before exposing it.
|