Zenn
🐙

【AKS】Argo CDをインストールしてみた

2023/10/12に公開
Azure
Argo CD
AKS
tech

はじめに

Azure Kubernetes Service (AKS)にArgo CDをインストールして、管理画面にAKSで発行したDNSゾーン使ってアクセスできるようにします。
Azure Cloud Shellで実行しています。

前準備

AKSクラスターはこんな感じで作成済みとします。AKS_NAMEはお好きな名前で作ってください。

Azure Cloud Shell
$ az group create -n $RESOURCE_GROUP_NAME -l japaneast

$ az aks create \
  --resource-group $RESOURCE_GROUP_NAME \
  --name $AKS_NAME \
  --node-count 1 \
  --enable-addons http_application_routing \
  --dns-name-prefix $AKS_NAME \
  --enable-managed-identity \
  --generate-ssh-keys \
  --node-vm-size Standard_B2s

Argo CD インストール

公式のマニフェストを使ってインストールします。

Azure Cloud Shell
$ kubectl create namespace argocd
$ kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
Warning: resource customresourcedefinitions/applications.argoproj.io is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by kubectl apply. kubectl apply should only be used on resources created declaratively by either kubectl create --save-config or kubectl apply. The missing annotation will be patched automatically.
customresourcedefinition.apiextensions.k8s.io/applications.argoproj.io configured
Warning: resource customresourcedefinitions/applicationsets.argoproj.io is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by kubectl apply. kubectl apply should only be used on resources created declaratively by either kubectl create --save-config or kubectl apply. The missing annotation will be patched automatically.
customresourcedefinition.apiextensions.k8s.io/applicationsets.argoproj.io configured
Warning: resource customresourcedefinitions/appprojects.argoproj.io is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by kubectl apply. kubectl apply should only be used on resources created declaratively by either kubectl create --save-config or kubectl apply. The missing annotation will be patched automatically.
customresourcedefinition.apiextensions.k8s.io/appprojects.argoproj.io configured
serviceaccount/argocd-application-controller created
serviceaccount/argocd-applicationset-controller created
serviceaccount/argocd-dex-server created
serviceaccount/argocd-notifications-controller created
serviceaccount/argocd-redis created
serviceaccount/argocd-repo-server created
serviceaccount/argocd-server created
role.rbac.authorization.k8s.io/argocd-application-controller created
role.rbac.authorization.k8s.io/argocd-applicationset-controller created
role.rbac.authorization.k8s.io/argocd-dex-server created
role.rbac.authorization.k8s.io/argocd-notifications-controller created
role.rbac.authorization.k8s.io/argocd-server created
clusterrole.rbac.authorization.k8s.io/argocd-application-controller created
clusterrole.rbac.authorization.k8s.io/argocd-server created
rolebinding.rbac.authorization.k8s.io/argocd-application-controller created
rolebinding.rbac.authorization.k8s.io/argocd-applicationset-controller created
rolebinding.rbac.authorization.k8s.io/argocd-dex-server created
rolebinding.rbac.authorization.k8s.io/argocd-notifications-controller created
rolebinding.rbac.authorization.k8s.io/argocd-server created
clusterrolebinding.rbac.authorization.k8s.io/argocd-application-controller created
clusterrolebinding.rbac.authorization.k8s.io/argocd-server created
configmap/argocd-cm created
configmap/argocd-cmd-params-cm created
configmap/argocd-gpg-keys-cm created
configmap/argocd-notifications-cm created
configmap/argocd-rbac-cm created
configmap/argocd-ssh-known-hosts-cm created
configmap/argocd-tls-certs-cm created
secret/argocd-notifications-secret created
secret/argocd-secret created
service/argocd-applicationset-controller created
service/argocd-dex-server created
service/argocd-metrics created
service/argocd-notifications-controller-metrics created
service/argocd-redis created
service/argocd-repo-server created
service/argocd-server created
service/argocd-server-metrics created
deployment.apps/argocd-applicationset-controller created
deployment.apps/argocd-dex-server created
deployment.apps/argocd-notifications-controller created
deployment.apps/argocd-redis created
deployment.apps/argocd-repo-server created
deployment.apps/argocd-server created
statefulset.apps/argocd-application-controller created
networkpolicy.networking.k8s.io/argocd-application-controller-network-policy created
networkpolicy.networking.k8s.io/argocd-applicationset-controller-network-policy created
networkpolicy.networking.k8s.io/argocd-dex-server-network-policy created
networkpolicy.networking.k8s.io/argocd-notifications-controller-network-policy created
networkpolicy.networking.k8s.io/argocd-redis-network-policy created
networkpolicy.networking.k8s.io/argocd-repo-server-network-policy created
networkpolicy.networking.k8s.io/argocd-server-network-policy created

$ kubectl get pod -n argocd
NAME                                                READY   STATUS    RESTARTS   AGE
argocd-application-controller-0                     1/1     Running   0          109m
argocd-applicationset-controller-5877955b59-gvl9g   1/1     Running   0          109m
argocd-dex-server-6c87968c75-hpcr8                  1/1     Running   0          109m
argocd-notifications-controller-64bb8dcf46-bwpl7    1/1     Running   0          109m
argocd-redis-7d8d46cc7f-bkjsd                       1/1     Running   0          109m
argocd-repo-server-665d6b7b59-hvsj6                 1/1     Running   0          109m
argocd-server-5986f74c99-zv8r2                      1/1     Running   0          109m

インストールできました。

管理画面のイングレスの設定

ローカルにインストールしていると、podをLBにしてポートフォワードすると http://localhost:8080 でアクセスできるよー とあるんですが、いかんせんローカルじゃないので、アクセスできません。
できたらAKSクラスター作ったときに一緒に作ったDNSゾーンを間借りしたいです。

ということで、ingress.yml を作成します。
自己証明書を自動で良しなに作ってアクセスできるようにしてくれます。たぶん。
ingressむずい。
ちなみに80と443がルーティングで有効になってますけど、HTTPはHTTPSに転送されます。
ingressむずい。

ingress.yml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: argocd-ingress
  annotations:
    kubernetes.io/ingress.class: addon-http-application-routing
    kubernetes.io/tls-acme: "true"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-issuer"
spec:
  tls:
  - hosts:
    - <DNSゾーン>.japaneast.aksapp.io
    secretName: argocd-tls
  rules:
    - host: <DNSゾーン>.japaneast.aksapp.io
      http:
        paths:
        - path: /
          pathType: Prefix
          backend:
            service:
              name: argocd-server
              port:
                number: 443

DNSゾーンは以下のコマンドで取得できます。

Azure Cloud Shell
$ az aks show \
  -g $RESOURCE_GROUP \
  -n $AKS_NAME \
  -o tsv \
  --query addonProfiles.httpApplicationRouting.config.HTTPApplicationRoutingZoneName

反映します。

Azure Cloud Shell
$ kubectl apply -f ingress.yml -n argocd

https://<DNSゾーン>.japaneast.aksapp.io/ にアクセスしてタコさんが出てくれたらOKです。

パスワードを取得する

以下のコマンドで表示されます。

Azure Cloud Shell
$ kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d

ログイン

ユーザ名：admin
パスワード：上記のコマンドで取得したもの

ログインできましたー！

おまけ：Helm を使ってインストールする

もうちょっといろいろカスタマイズする場合はHelmの方がいいのかなぁ。
と思いながら今回はマニフェストの方にしましたが。

Azure Cloud Shell
$ helm repo add argo https://argoproj.github.io/argo-helm
"argo" has been added to your repositories
$ helm repo update
Hang tight while we grab the latest from your chart repositories...
...Successfully got an update from the "argo" chart repository
...Successfully got an update from the "azure-marketplace" chart repository
Update Complete. ⎈Happy Helming!⎈
$ helm install argocd argo/argo-cd -n argocd --create-namespace
NAME: argocd
LAST DEPLOYED: Thu Oct 12 05:23:28 2023
NAMESPACE: argocd
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
In order to access the server UI you have the following options:

1. kubectl port-forward service/argocd-server -n argocd 8080:443

    and then open the browser on http://localhost:8080 and accept the certificate

2. enable ingress in the values file `server.ingress.enabled` and either
      - Add the annotation for ssl passthrough: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#option-1-ssl-passthrough
      - Set the `configs.params."server.insecure"` in the values file and terminate SSL at your ingress: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#option-2-multiple-ingress-objects-and-hosts


After reaching the UI the first time you can login with username: admin and the random password generated during the installation. You can find the password by running:

kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d

(You should delete the initial secret afterwards as suggested by the Getting Started Guide: https://argo-cd.readthedocs.io/en/stable/getting_started/#4-login-using-the-cli)

おわりに

アプリケーションの追加は次回以降に。。
運用する場合はadminのパスワードの変更はしましょう。
さていろいろ試すぞー

参考

https://argo-cd.readthedocs.io/en/stable/getting_started/
https://zenn.dev/kou_pg_0131/articles/argocd-getting-started

Discussion