Create default passwords when dev mode is set. #441 #442

cmoulliard · 2024-11-08T13:25:20Z

Add new parameter to enable/disable: dev mode
Set the default password for gitea
[Feature] Have a --dev parameter able to configure gitea and argocd with default: username/password #441

Signed-off-by: cmoulliard <[email protected]>

…a new password. cnoe-io#441 Signed-off-by: cmoulliard <[email protected]>

cmoulliard · 2024-11-08T13:57:03Z

Question: Is it the best place to add the code able to generate a new password (= developer) when devMode is enabled -

idpbuilder/pkg/controllers/localbuild/argo.go

Line 53 in 71fefc7

    
           if result, err := argocd.Install(ctx, resource, r.Client, r.Scheme, r.Config); err != nil {

? @nabuskey

nabuskey · 2024-11-08T14:45:39Z

Yeah after install() comes back with no errors.

… - developer. Create a kubeClient part of the k8s util package. cnoe-io#441 Signed-off-by: cmoulliard <[email protected]>

Signed-off-by: cmoulliard <[email protected]>

cmoulliard · 2024-11-09T11:56:59Z

If what I did cannot work, we have 2 options:

Create an Argocd PR to propose to use password instead of generating one usng a new parameter --dev or --insecure-password or --dev-password`
OR
Add to our project the 2 Kube secrets (argocd-secret and argocd-initial-admin-secret) with content populated and where we set the property adminAccount.Enabled to false

nabuskey · 2024-11-09T15:40:12Z

I am still not sure if the flag name is what we want to go with.

Is proving static password the only thing needed for dev mode? Does it describe what it does? If we add more config changes for dev mode in the future, do we want to provide ways to control each change?

If the names I proposed in the issue are too long, can we get away with a short flag?

I do like the idea of having a static default passwords for sure.

cmoulliard · 2024-11-10T08:42:08Z

Is proving static password the only thing needed for dev mode? Does it describe what it does? If we add more config changes for dev mode in the future, do we want to provide ways to control each change?

If we continue to develop idpbuilder, having a devMode help a lot as we do for quarkus devMode able to launch testcontainers: backstage, DB, argocd, gitea, etc and where developers can access many information using dev UI - https://quarkus.io/guides/dev-mode-differences#dev-mode-features :-)

cmoulliard · 2024-11-10T08:42:46Z

If the names I proposed in the issue are too long, can we get away with a short flag?

Let's review that later when we have a PR which is working as --dev is short, enough to test the PR

cmoulliard · 2024-11-10T08:43:01Z

I do like the idea of having a static default passwords for sure.

I will make a try to see if that works

cmoulliard · 2024-11-12T09:05:00Z

Apparently, we should be (to be investigated of course) to set the accounts directly within the argocd secret as discussed here: argoproj/argo-cd#4096 (comment)

I was able to play with a user developer where I installed or customized some resources.

RBAC

apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/name: argocd-rbac-cm
    app.kubernetes.io/part-of: argocd
  name: argocd-rbac-cm
  namespace: argocd
data:
  policy.csv: |
    p, role:developer, applications, *, *, allow
    g, developer, role:developer

ConfigMap

apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/name: argocd-cm
    app.kubernetes.io/part-of: argocd
  name: argocd-cm
  namespace: argocd
data:
  accounts.developer: apiKey, login
  application.resourceTrackingMethod: annotation
  resource.exclusions: |
    - kinds:
        - ProviderConfigUsage
      apiGroups:
        - "*"
  timeout.reconciliation: 60s

As the following secret is created on the flight by argocd when admin.enabled and generate an admin password using bcrypt, we should find a way to patch it with the developer password

Argocd Secret

apiVersion: v1
kind: Secret
metadata:
  labels:
    app.kubernetes.io/name: argocd-secret
    app.kubernetes.io/part-of: argocd
  name: argocd-secret
  namespace: argocd
type: Opaque
data:
  accounts.developer.password: JDJhJDEwJEYwakhFSmJMYTEvREQzWUZsOWtxN2U0TUZXUXdDclhZWXZNTXhYVXEwdGhVWWUuLi9WWUZL
  accounts.developer.passwordMtime: MjAyNC0xMS0xMlQwODo1NDoyNVo=
...

…veloper's password. cnoe-io#441 Signed-off-by: cmoulliard <[email protected]>

cmoulliard · 2024-11-12T10:20:13Z

The PR supports now to log on to the UI of Argocd using (developer/developer) with RBAC Applications - Admin or gitea (developer/developer)

Can you please review it ?
@nabuskey

Signed-off-by: cmoulliard <[email protected]>

…oper Signed-off-by: cmoulliard <[email protected]>

cmoulliard · 2024-11-12T10:56:36Z

Apparently we cannot use for gitea developer/developer as we got such an error reported when we create a cluster

Nov 12 11:52:39 ERROR Reconciler error controller=gitrepository controllerGroup=idpbuilder.cnoe.io controllerKind=GitRepository name=argocd namespace=idpbuilder-dabou namespace=idpbuilder-dabou name=argocd reconcileID=1f80e800-276a-4b74-a868-b54ff4a26de5 err=creating repository: failed to create git repository: The repository with the same name already exists. 
Nov 12 11:52:39 ERROR Reconciler error controller=gitrepository controllerGroup=idpbuilder.cnoe.io controllerKind=GitRepository name=nginx namespace=idpbuilder-dabou namespace=idpbuilder-dabou name=nginx reconcileID=798effc7-600a-4035-8e39-eb8bcdcb79b3 err=creating repository: failed to create git repository: The repository with the same name already exists. 
Nov 12 11:52:39 ERROR Reconciler error controller=gitrepository controllerGroup=idpbuilder.cnoe.io controllerKind=GitRepository name=gitea namespace=idpbuilder-dabou namespace=idpbuilder-dabou name=gitea reconcileID=bbb8fbdd-2803-4904-b0c5-c680e2a9c0b9 err=creating repository: failed to create git repository: The repository with the same name already exists.

I will then revert to the user giteaAdmin in the meantime

… fails Signed-off-by: cmoulliard <[email protected]>

…for argocd Signed-off-by: cmoulliard <[email protected]>

nabuskey

If you are having problems setting passwords on install, we can change them through APIs after install.

nabuskey · 2024-11-19T22:17:37Z

hack/argo-cd/argocd-rbac-dev.yaml

+  namespace: argocd
+data:
+  policy.csv: |
+    p, role:developer, applications, *, *, allow


What's the purpose of having a separate account that has a very similar permissions as admin?

This is an account for the developers and it only allows to handle applications

Can you tell me if this is inline with what you are thinking?

Use a random password for the developer and admin account if the dev password flag is unset.

Use a static, known password for the developer and admin account if the dev password flag is set.

Option 2 => Use a known password for the developer and admin account if the dev password flag is set

Ok that sounds good to me. Looks like Gitea static password isn't working for some reason?

Ok that sounds good to me. Looks like Gitea static password isn't working for some reason?

For gitea when using dev-mode, we should still use as user: giteaAdmin and password = developer

Since you are adding a user called developer to argocd, we may as well add the developer user in Gitea.

nabuskey · 2024-11-19T22:25:54Z

pkg/controllers/localbuild/argo.go

+			return ctrl.Result{}, fmt.Errorf("Error marshalling patch data: %w", err)
+		}
+
+		kubeClient, err := k8s.GetKubeClient()


The reconciler has client already. You can just use that instead. e.g. r.Client.. You can also change passwords through ArgoCD api.

You can also change passwords through ArgoCD api.

That will require to be done in a 2nd step while here the idea is to have the account developer/developer available when packages are installed too

r.Client fixed. See: 7d81b27

You can also change passwords through ArgoCD api.

That will require to be done in a 2nd step while here the idea is to have the account developer/developer available when packages are installed too

Yeah I am starting to think we should set them through API for both Gitea and ArgoCD in every invocation of idpbuilder. Instead of relying on manifests.

We should then (maybe) create some job(s) which are applied post installation of the core package like gitea or argocd and able to execute some additional steps based on parameters passed.

Until now, the first action could be to create a new user: developer able to log on using as user/pwd => developer/developer or idpbuilder/developer if the parameter passed is --dev-mode.

A second job could also patch existing resources if by example we pass a different DNS domain = --host

etc

flag renamed from "dev" to "dev-mode". See: a8c3016

nabuskey · 2024-11-19T22:28:18Z

pkg/controllers/localbuild/argo.go

+		err = kubeClient.Get(ctx, client.ObjectKey{Name: argocdAdminSecretName, Namespace: argocdNamespace}, &s)
+		if err != nil {
+			return ctrl.Result{}, fmt.Errorf("getting argocd secret: %w", err)
+		}
+
+		// Patching the argocd-secret with the user's hashed password
+		err = kubeClient.Patch(ctx, &s, client.RawPatch(types.StrategicMergePatchType, patchBytes))
+		if err != nil {
+			return ctrl.Result{}, fmt.Errorf("Error patching the Secret: %w", err)
+		}


You can use server side apply instead here to simplify this process.

Ok. I will review

What do you mean by "server side" ? My code is similar to what we do here with the Gitea -

idpbuilder/pkg/controllers/localbuild/gitea.go

Line 189 in f31a08e

return r.Client.Patch(ctx, &u, client.Apply, client.ForceOwnership, client.FieldOwner(v1alpha1.FieldManager))

...

The way it's done in Gitea is server side apply. If you look further up, you'll see it's working with unstructured object to avoid having ownership of fields we do not care about. Sometimes we see errors like "object has been updated and version doesn't match". Server side apply avoids that.

This talks about it: https://eng.d2iq.com/blog/conflict-resolution-kubernetes-server-side-apply/

Here's where unstructured object is used:

idpbuilder/pkg/controllers/localbuild/gitea.go

Lines 163 to 166 in f31a08e

u := unstructured.Unstructured{}

u.SetName(giteaAdminSecret)

u.SetNamespace(giteaNamespace)

u.SetGroupVersionKind(corev1.SchemeGroupVersion.WithKind("Secret"))

Here's another example:

idpbuilder/pkg/util/util.go

Lines 78 to 86 in d14289a

func ApplyAnnotation(ctx context.Context, kubeClient client.Client, obj client.Object, annotations map[string]string, opts ...client.PatchOption) error {

// MUST be unstructured to avoid managing fields we do not care about.

u := unstructured.Unstructured{}

u.SetAnnotations(annotations)

u.SetName(obj.GetName())

u.SetNamespace(obj.GetNamespace())

u.SetGroupVersionKind(obj.GetObjectKind().GroupVersionKind())

return kubeClient.Patch(ctx, &u, client.Apply, opts...)

}

Fixed. See: 80a785b

nabuskey · 2024-11-19T22:29:23Z

pkg/controllers/localbuild/argo.go

+	argocdDevModePassword         = "developer"
+	argocdAdminSecretName         = "argocd-secret"
+	argocdInitialAdminSecretName  = "argocd-initial-admin-secret"
+	argocdInitialAdminPasswordKey = "argocd-initial-admin-secret"
+	argocdNamespace               = "argocd"


These are already defined in other packages I think. Either export them or move them to globals or APIs

Ok. I will review

I removed 2 non used constants and others are non declared in another go file or package. See: 78e1e40

nabuskey · 2024-11-19T22:35:23Z

pkg/cmd/create/root.go

@@ -20,6 +20,7 @@ import (
 const (
 	recreateClusterUsage   = "Delete cluster first if it already exists."
 	buildNameUsage         = "Name for build (Prefix for kind cluster name, pod names, etc)."
+	devModeUsage           = "When enabled, the platform will run the core packages with developer password."


I am just not sold on the name dev mode. idpbuilder is primary used for development and testing purposes already. I think we should use more explicit name with a short flag.

Even if we accept dev mode, we shouldn't limit the flag name to just passwords. dev mode could mean a lot of different things. This should be a meta flag.

idpbuilder is primary used for development and testing purposes already. I think we should use more explicit name with a short flag.

If this is the case, then we should install gitea and argocd using a non generated password ;-)

2. Even if we accept dev mode, we shouldn't limit the flag name to just passwords. dev mode could mean a lot of different things. This should be a meta flag.

What about using the the parameter: --devPwd or --devPassword as boolean @nabuskey

I am ok with dev-pwd or dev-password since we use snake case for our flags. We can also have --dev-mode flag that is essentially a convenient flag that enables dev passwords and any other QOL stuff for dev purposes.

Finally we aligned our paths => I will then use --dev-mode

To be clear, I meant to have two flags. (--dev-password OR --dev-pwd ) AND --dev-mode because we could enable other QOL features under --dev-mode other than static passwords.

To be fair is the --dev- prefix needed? I would imagine we could just have a --static-creds parameter or --static-credentials to set the password statically rather then dynamically? Unless there's a reason why we feel --dev- prefix is valuable?

The only argument I could maybe gather is that since it is no longer than admin credentials and it is developer credentials that --dev- prefix gives clarity to that but I think a good description here could explain that.

--dev-mode is a pretty common parameter used by many developer's tools and CLI which could also be used to support different additional features in the future. On the opposite --static-creds or --static-credentials parameters are probably too restrictive, don't help the users as they have no idea about what static word means

To be clear, I meant to have two flags. (--dev-password OR --dev-pwd ) AND --dev-mode because we could enable other QOL features under --dev-mode other than static passwords.

I still think this needs to be the case.

nabuskey · 2024-11-19T22:41:52Z

pkg/k8s/util.go


 	"github.com/cnoe-io/idpbuilder/pkg/util"
 	"k8s.io/apimachinery/pkg/runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )

+var (
+	setupLog = ctrl.Log.WithName("k8s")


I would rather not produce log messages in utility functions. Let's wrap the error instead. e.g. fmt.Errorf("Error creating kubernetes client: %w"

Fixed with: 8158551

…orf() Signed-off-by: cmoulliard <[email protected]>

Signed-off-by: cmoulliard <[email protected]>

nabuskey · 2024-12-04T02:41:16Z

https://cd.apps.argoproj.io/swagger-ui#operation/AccountService_UpdatePassword

It's available through the rest api. We should be able to make a request for this I think.

cmoulliard · 2024-12-04T07:22:50Z

It's available through the rest api. We should be able to make a request for this I think.

This is the request used by the argocd CLI but there is no command or REST API to create a new user.

I did a test using the update password command and even if we can change the password the initial-admin-secret is not changed and then you will continue to get as value the original value except if we update it in our code

❯ argocd account update-password --account admin
2024/12/04 09:10:49 maxprocs: Leaving GOMAXPROCS=12: CPU quota undefined
*** Enter password of currently logged in user (admin):
*** Enter new password for user admin:
*** Confirm new password for user admin:
Password updated
Context 'argocd.cnoe.localtest.me:9443' updated

~/code/cnoe/fork-idpbuilder on dev-mode •
❯ idp  get secrets -p argocd
---------------------------
Name: argocd-initial-admin-secret
Namespace: argocd
Data:
  password : aXoAmYg2y3dNvFi4
  username : admin

nabuskey · 2024-12-04T16:19:43Z

It is a rest API reference page. There's an instruction here too: https://argo-cd.readthedocs.io/en/latest/developer-guide/api-docs/

I tested it and it does work.

# get initial token
curl -ik https://argocd.cnoe.localtest.me:8443/api/v1/session -d $'{"username":"admin","password":"dMQW00CssVXZWz7t"}' -H "Content-Type:application/json"

# update password
curl -X PUT -ik https://argocd.cnoe.localtest.me:8443/api/v1/account/password -d $'{"currentPassword":"dMQW00CssVXZWz7t","newPassword":"password", "name":"admin"}' -H "Content-Type:application/json" -H "Authorization: Bearer $ARGOCD_TOKEN"

# verify
curl -ik https://argocd.cnoe.localtest.me:8443/api/v1/session -d $'{"username":"admin","password":"password"}' -H "Content-Type:application/json"

The get secrets command looks at the initial admin secret generated by ArgoCD. If we are are to change passwords, we should make our own secrets and reference that instead.

cmoulliard · 2024-12-04T16:37:18Z

The get secrets command looks at the initial admin secret generated by ArgoCD. If we are are to change passwords, we should make our own secrets and reference that instead.

We should then align argocd with gitea to name the secret using the same convention

secret name
gitea-credential
argocd-credential

cmoulliard · 2024-12-04T17:02:24Z

What I meant was to do this in post-install (e.g. the core packages are ready) during the reconciliation loop. Essentially around here:

idpbuilder/pkg/controllers/localbuild/controller.go

Line 81 in 03559e6

go r.installCorePackages(instCtx, req, &localBuild, errChan)

Is it the right place to put such post-installation step here as the code is part of a loop which is executed several times ....

nabuskey · 2024-12-06T19:48:43Z

Probably here:

idpbuilder/pkg/controllers/localbuild/controller.go

Line 94 in 03559e6

logger.V(1).Info("done installing core packages. passing control to argocd")

There's a possibility that ArgoCD is not yet reachable through Ingress-nginx. In that case, we need to retry a few times.

…noe-io#441 Signed-off-by: cmoulliard <[email protected]>

nabuskey

Thanks for this. Looks like there are issues with build too. Please take a look.

nabuskey · 2024-12-10T22:32:12Z

pkg/controllers/localbuild/controller.go

+			return ctrl.Result{RequeueAfter: defaultRequeueTime}, nil
+		}
+
+		logger.Info("Initial argocd admin secret found ...")


Should be a debug message. This gets printed every loop.

Fixed: 86b26a2

nabuskey · 2024-12-10T22:32:17Z

pkg/controllers/localbuild/controller.go

@@ -89,6 +104,48 @@ func (r *LocalbuildReconciler) Reconcile(ctx context.Context, req ctrl.Request)
 		}
 	}

+	if r.Config.DevMode {
+		logger.Info("DevMode is enabled")


Should be a debug message. This gets printed every loop.

Fixed: 86b26a2

nabuskey · 2024-12-10T22:40:46Z

api/v1alpha1/localbuild_types.go

@@ -53,6 +53,7 @@ type BuildCustomizationSpec struct {
 	Port           string `json:"port,omitempty"`
 	UsePathRouting bool   `json:"usePathRouting,omitempty"`
 	SelfSignedCert string `json:"selfSignedCert,omitempty"`
+	DevMode        bool   `json:"devMode,omitempty"`


This field should be StaticPasswords. We need to make an effort to make what these fields do.

Fixed: 35fc902

nabuskey · 2024-12-10T22:41:09Z

pkg/build/build.go

@@ -28,6 +28,7 @@ var (

 type Build struct {
 	name                 string
+	devMode              bool


Should be staticPasswords

Fixed: 35fc902

This is still set as devMode

nabuskey · 2024-12-10T22:45:24Z

pkg/cmd/create/root.go

@@ -20,6 +20,7 @@ import (
 const (
 	recreateClusterUsage   = "Delete cluster first if it already exists."
 	buildNameUsage         = "Name for build (Prefix for kind cluster name, pod names, etc)."
+	devModeUsage           = "When enabled, the platform will run the core packages with developer password."


To be clear, I meant to have two flags. (--dev-password OR --dev-pwd ) AND --dev-mode because we could enable other QOL features under --dev-mode other than static passwords.

I still think this needs to be the case.

nabuskey · 2024-12-10T23:35:54Z

pkg/controllers/localbuild/controller.go

+		req, err := http.NewRequest("PUT", argocdEndpoint+"/account/password", bytes.NewBuffer(payloadBytes))
+		req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", argocdSession.Token))
+		req.Header.Set("Content-Type", "application/json")
+
+		resp, err := client.Do(req)


Variable names shadow. I really do not like shadowing in longer blocks.

Is it better or do you expect something else 5830b22 ?

nabuskey · 2024-12-10T23:38:00Z

pkg/controllers/localbuild/controller.go

+		if resp.StatusCode == 200 {
+			// Password verification succeeded !
+			return nil, "succeeded"
+		} else {


This else is not needed.

Fixed: e4c78de

nabuskey · 2024-12-10T23:38:55Z

pkg/controllers/localbuild/controller.go

+	} else {
+		return fmt.Errorf("HTTP Error: %d", resp.StatusCode), "failed"
+	}
+	return nil, "failed"


What is the meaning of returning nil (indicating no error) but failed?

Fixed: 700a841

nabuskey · 2024-12-10T23:40:17Z

pkg/controllers/localbuild/gitea.go

@@ -43,7 +45,7 @@ func RawGiteaInstallResources(templateData any, config v1alpha1.PackageCustomiza
 	return k8s.BuildCustomizedManifests(config.FilePath, "resources/gitea/k8s", installGiteaFS, scheme, templateData)
 }

-func giteaAdminSecretObject() corev1.Secret {
+func (r *LocalbuildReconciler) GiteaAdminSecretObject() corev1.Secret {


This doesn't need to be a method. Better to move to the utils package because it's probably needed in the get command.

What do you think about this f0754f7 ?

nabuskey · 2024-12-10T23:42:13Z

pkg/controllers/localbuild/gitea.go

@@ -212,7 +215,7 @@ func getGiteaToken(ctx context.Context, baseUrl, username, password string) (str
 	return token.Token, nil
 }

-func giteaBaseUrl(config v1alpha1.BuildCustomizationSpec) string {
+func (r *LocalbuildReconciler) GiteaBaseUrl(config v1alpha1.BuildCustomizationSpec) string {


This doesn't need to be a method and doesn't need to be exported.

See: 3ab4fd3

Signed-off-by: cmoulliard <[email protected]>

… issues with log format of the messages Signed-off-by: cmoulliard <[email protected]>

Signed-off-by: cmoulliard <[email protected]>

…ion(s) Signed-off-by: cmoulliard <[email protected]>

Signed-off-by: cmoulliard <[email protected]>

…gocd Signed-off-by: cmoulliard <[email protected]>

Signed-off-by: cmoulliard <[email protected]>

…ssword which is only used internally Signed-off-by: cmoulliard <[email protected]>

nabuskey

It's fine to have the dev-mode and dev-password flags. It needs to be represented with clear intent internally in code. The flag names are user friendly but it isn't really descriptive of what it does when referring to the option internally.

When we think about the name dev-password or dev-mode, it's not clear what that means internally. Does dev-password mean we are relaxing password rules? e.g. no special char requirements. Does dev-mode mean we disable TLS?
What we want is to set a static password for all core packages. So we should make this intent clear in code.

nabuskey · 2024-12-12T19:27:05Z

pkg/build/build.go

@@ -28,6 +28,7 @@ var (

 type Build struct {
 	name                 string
+	devMode              bool


This is still set as devMode

nabuskey · 2024-12-12T19:27:36Z

pkg/cmd/create/root.go

@@ -67,6 +69,7 @@ func init() {
 	CreateCmd.PersistentFlags().StringVar(&buildName, "build-name", "localdev", buildNameUsage)
 	CreateCmd.PersistentFlags().MarkDeprecated("build-name", "use --name instead.")
 	CreateCmd.PersistentFlags().StringVar(&buildName, "name", "localdev", buildNameUsage)
+	CreateCmd.PersistentFlags().BoolVar(&devMode, "dev-mode", false, devModeUsage)


add another flag here with the name dev-password.

ok but then what will be the purpose of the flag dev-mode if now we have 2 flags: dev-mode and dev-password ? @nabuskey

Removed devMode from build.go as non used: 1cd1773

Fixed: 70e3d37 @nabuskey

nabuskey · 2024-12-12T19:29:01Z

pkg/controllers/gitrepository/controller.go

@@ -143,6 +143,10 @@ func (r *RepositoryReconciler) reconcileGitRepo(ctx context.Context, repo *v1alp
 		return ctrl.Result{}, fmt.Errorf("getting git provider credentials: %w", err)
 	}

+	if r.Config.StaticPassword {
+		creds.password = "developer"


We use the string developer in different places. We should define it somewhere and reference it from everywhere it's used.

Fixed: 570ca30

nabuskey · 2024-12-12T19:29:53Z

pkg/controllers/localbuild/argo.go

@@ -57,3 +66,20 @@ func (r *LocalbuildReconciler) ReconcileArgo(ctx context.Context, req ctrl.Reque
 	resource.Status.ArgoCD.Available = true
 	return ctrl.Result{}, nil
 }
+
+func (r *LocalbuildReconciler) ArgocdInitialAdminSecretObject() corev1.Secret {


This needs to be moved to utils.

nabuskey · 2024-12-12T19:33:38Z

pkg/controllers/localbuild/controller.go

+	return nil, "succeeded"
+}
+
+func (r *LocalbuildReconciler) updateArgocdDevPassword(ctx context.Context, adminPassword string) (error, string) {


Change the signature to (ctx context.Context, adminPassword string) error. If it tails for some reason, return an error. If there's an error while updating the password, we should not continue.

nabuskey · 2024-12-12T19:36:07Z

pkg/controllers/localbuild/controller.go

+	return nil, "succeeded"
+}
+
+func (r *LocalbuildReconciler) updateArgocdDevPassword(ctx context.Context, adminPassword string) (error, string) {


Change the name to updateArgocdPassword. The word dev doesn't mean much internally.

nabuskey · 2024-12-12T19:36:32Z

pkg/controllers/localbuild/controller.go

+	return string(sec.Data["password"]), nil
+}
+
+func (r *LocalbuildReconciler) updateGiteaDevPassword(ctx context.Context, adminPassword string) (error, string) {


Suggested change

func (r *LocalbuildReconciler) updateGiteaDevPassword(ctx context.Context, adminPassword string) (error, string) {

func (r *LocalbuildReconciler) updateGiteaPassword(ctx context.Context, adminPassword string) error {

Fixed: e4831cd

nabuskey · 2024-12-12T19:41:56Z

pkg/controllers/localbuild/controller.go

+			// Gitea admin secret is not yet available ...
+			return ctrl.Result{RequeueAfter: defaultRequeueTime}, nil
+		}
+		logger.Info("Gitea admin secret found ...")


Let's make this a debug message. It's not useful for normal operations.

Fixed: e4831cd

nabuskey · 2024-12-12T19:43:28Z

pkg/controllers/localbuild/controller.go

@@ -89,6 +104,48 @@ func (r *LocalbuildReconciler) Reconcile(ctx context.Context, req ctrl.Request)
 		}
 	}

+	if r.Config.StaticPassword {
+		logger.V(1).Info("Dev mode is enabled")


Suggested change

logger.V(1).Info("Dev mode is enabled")

logger.V(1).Info("static passwords enabled")

Fixed: e4831cd

nabuskey · 2024-12-12T19:44:15Z

pkg/util/argocd.go

+)
+
+const (
+	ArgocdDevModePassword        = "developer"


Suggested change

ArgocdDevModePassword = "developer"

ArgocdStaticPassword = "developer"

Signed-off-by: cmoulliard <[email protected]>

…ile of the util package Signed-off-by: cmoulliard <[email protected]>

…e of the functions using it. Convert some messages to log debug messages Signed-off-by: cmoulliard <[email protected]>

Signed-off-by: cmoulliard <[email protected]>

cmoulliard added 3 commits November 8, 2024 14:24

WIP. Create default passwords when dev mode is set. cnoe-io#441

3a974cb

Signed-off-by: cmoulliard <[email protected]>

Set the devMode to BuildCustomization

a9c683f

Signed-off-by: cmoulliard <[email protected]>

Pass the proper object containing devMode to the function populating …

6d85851

…a new password. cnoe-io#441 Signed-off-by: cmoulliard <[email protected]>

cmoulliard added 3 commits November 8, 2024 16:10

Adding the code to patch the argocd-secret to use the hashed password…

8dedc1e

… - developer. Create a kubeClient part of the k8s util package. cnoe-io#441 Signed-off-by: cmoulliard <[email protected]>

Use cost 0 as argocd code cnoe-io#441

704bc78

Signed-off-by: cmoulliard <[email protected]>

Re-creating too the inital admin secret for argocd. cnoe-io#441

ee9dc06

Signed-off-by: cmoulliard <[email protected]>

This comment was marked as resolved.

Sign in to view

Move the current time function. Generate the missing field. cnoe-io#441

d392287

Signed-off-by: cmoulliard <[email protected]>

cmoulliard marked this pull request as ready for review November 8, 2024 17:21

cmoulliard requested a review from nabuskey November 8, 2024 17:32

This comment was marked as resolved.

Sign in to view

Include needed argocd k8s resources and change the code to set the de…

0c62564

…veloper's password. cnoe-io#441 Signed-off-by: cmoulliard <[email protected]>

cmoulliard added 2 commits November 12, 2024 11:20

Fix wrong key as account should be accounts

1e1b980

Signed-off-by: cmoulliard <[email protected]>

Change the gitea user from giteaAdmin to developer for a user's devel…

3d884da

…oper Signed-off-by: cmoulliard <[email protected]>

cmoulliard added 2 commits November 12, 2024 11:58

Reverting to giteaAdmin till we know why a different user - developer…

f31a08e

… fails Signed-off-by: cmoulliard <[email protected]>

Change the number from 58 to 59 as we install a new ConfigMap - RBAC …

c355ba1

…for argocd Signed-off-by: cmoulliard <[email protected]>

nabuskey reviewed Nov 19, 2024

View reviewed changes

cmoulliard added 3 commits November 21, 2024 15:22

Remove from the util go file the setupLog and replace it with fmt.Err…

8158551

…orf() Signed-off-by: cmoulliard <[email protected]>

Removed non used argocd constants

78e1e40

Signed-off-by: cmoulliard <[email protected]>

Use r.client instead of k8s.GetKubeClient()

7d81b27

Signed-off-by: cmoulliard <[email protected]>

cmoulliard added 2 commits December 9, 2024 18:34

Refactor the code to update the argocd password post reconciliation. c…

bf8e2cc

…noe-io#441 Signed-off-by: cmoulliard <[email protected]>

Refactor the code to update the gitea password post reconciliation. c…

f76db50

…noe-io#441 Signed-off-by: cmoulliard <[email protected]>

nabuskey requested changes Dec 10, 2024

View reviewed changes

cmoulliard added 13 commits December 11, 2024 15:31

Change the logging level from info to debug

86b26a2

Signed-off-by: cmoulliard <[email protected]>

Rename devMode, dev-mode to staticPasswords and static-passwords. Fix…

35fc902

… issues with log format of the messages Signed-off-by: cmoulliard <[email protected]>

Remove else block not needed when we verify if the password changed

e4c78de

Signed-off-by: cmoulliard <[email protected]>

Improve the code and remove the non needed return statement

700a841

Signed-off-by: cmoulliard <[email protected]>

Improve code and variables

5830b22

Signed-off-by: cmoulliard <[email protected]>

Remove non used functions

d1ed81a

Signed-off-by: cmoulliard <[email protected]>

Created a new util package for gitea and moved there: const and funct…

f0754f7

…ion(s) Signed-off-by: cmoulliard <[email protected]>

Move GiteaBaseUrl to the util package of gitea

3ab4fd3

Signed-off-by: cmoulliard <[email protected]>

Fix error r.r.GiteaBaseUrl => util.r.GiteaBaseUrl

c8ac946

Signed-off-by: cmoulliard <[email protected]>

Refactor the code to also patch the secret's password of gitea and ar…

e02a5d2

…gocd Signed-off-by: cmoulliard <[email protected]>

Regenerate the token for gitea

f67a91c

Signed-off-by: cmoulliard <[email protected]>

Fix wrong call to the function: GetGiteaToken

dbf56c2

Signed-off-by: cmoulliard <[email protected]>

Reverting the change to use as user arg: dev-mode instead of staticPa…

d029f62

…ssword which is only used internally Signed-off-by: cmoulliard <[email protected]>

cmoulliard requested review from blakeromano and nabuskey December 12, 2024 09:20

nabuskey requested changes Dec 12, 2024

View reviewed changes

cmoulliard added 5 commits December 13, 2024 11:58

Define an util const: StaticPassword

570ca30

Signed-off-by: cmoulliard <[email protected]>

Move the function ArgocdInitialAdminSecretObject() to the argocd.go f…

2fe31a3

…ile of the util package Signed-off-by: cmoulliard <[email protected]>

Rename functions. Remove the var about status and change the signatur…

e4831cd

…e of the functions using it. Convert some messages to log debug messages Signed-off-by: cmoulliard <[email protected]>

Remove devMode as not used

1cd1773

Signed-off-by: cmoulliard <[email protected]>

Rename dev-mode to dev-password

70e3d37

Signed-off-by: cmoulliard <[email protected]>

	u := unstructured.Unstructured{}
	u.SetName(giteaAdminSecret)
	u.SetNamespace(giteaNamespace)
	u.SetGroupVersionKind(corev1.SchemeGroupVersion.WithKind("Secret"))

	func ApplyAnnotation(ctx context.Context, kubeClient client.Client, obj client.Object, annotations map[string]string, opts ...client.PatchOption) error {
	// MUST be unstructured to avoid managing fields we do not care about.
	u := unstructured.Unstructured{}
	u.SetAnnotations(annotations)
	u.SetName(obj.GetName())
	u.SetNamespace(obj.GetNamespace())
	u.SetGroupVersionKind(obj.GetObjectKind().GroupVersionKind())
	return kubeClient.Patch(ctx, &u, client.Apply, opts...)
	}

	func (r *LocalbuildReconciler) updateGiteaDevPassword(ctx context.Context, adminPassword string) (error, string) {
	func (r *LocalbuildReconciler) updateGiteaPassword(ctx context.Context, adminPassword string) error {

	logger.V(1).Info("Dev mode is enabled")
	logger.V(1).Info("static passwords enabled")

	ArgocdDevModePassword = "developer"
	ArgocdStaticPassword = "developer"

Create default passwords when dev mode is set. #441 #442

Are you sure you want to change the base?

Create default passwords when dev mode is set. #441 #442

Conversation

cmoulliard commented Nov 8, 2024

cmoulliard commented Nov 8, 2024

nabuskey commented Nov 8, 2024

This comment was marked as resolved.

cmoulliard commented Nov 9, 2024

nabuskey commented Nov 9, 2024

cmoulliard commented Nov 10, 2024

cmoulliard commented Nov 10, 2024

cmoulliard commented Nov 10, 2024

This comment was marked as resolved.

cmoulliard commented Nov 12, 2024 • edited Loading

cmoulliard commented Nov 12, 2024 • edited Loading

cmoulliard commented Nov 12, 2024

nabuskey left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nabuskey Nov 21, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nabuskey Nov 21, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nabuskey commented Dec 4, 2024

cmoulliard commented Dec 4, 2024 • edited Loading

nabuskey commented Dec 4, 2024

cmoulliard commented Dec 4, 2024

cmoulliard commented Dec 4, 2024

nabuskey commented Dec 6, 2024

nabuskey left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cmoulliard commented Nov 12, 2024 •

edited

Loading

cmoulliard commented Nov 12, 2024 •

edited

Loading

nabuskey Nov 21, 2024 •

edited

Loading

nabuskey Nov 21, 2024 •

edited

Loading

cmoulliard commented Dec 4, 2024 •

edited

Loading

cmoulliard Dec 13, 2024 •

edited

Loading