POC - Use a GitHub App for ArgoCD repo access

[IanKWatts]

Describe the issue The 'bcgov-c' org is going to be moved into the GitHub Enterprise account and will have SSO enabled. In preparation, create a GitHub App for repo access so that we don't have to rely on a service account + SSH key. (The alternative would be to continue with the existing service account, link it to the IDIR account 'ROBOGOFR@gov.bc.ca', and link the SSH key as well.)

What is the Value/Impact? This is necessary for the continued use of ArgoCD by our users. Not doing this is not an option.

What is the plan? How will this get completed?

• Create a GitHub App and configure ArgoCD to use it to read from a test repo

Identify any dependencies

• GitHub

Definition of done

• [x] It has been determined if this will work for the migration

[IanKWatts]

In order for the GitHub App to be owned by the org and not the user, you must be logged in as an org owner and: Click user icon in upper right Click "Your organizations" --> org name Click "Developer settings" at bottom of left nav Click "New GitHub App" button App name: argocd-access-bcgov-c Description: ArgoCD read-only access to GitOps repos Homepage URL: https://gitops-shared.apps.silver.devops.gov.bc.ca Uncheck: Webhook / Active Repository permissions: Contents: Read-only Metadata: Read-only

Record app ID and client ID

In top banner, click "generate a private key" and save the PEM file Click "Install App" (left nav) --> Install Select 'All repositories' Click Install

Settings --> Applications --> click Configure Note the Installation ID in the URL

[IanKWatts]

Configure ArgoCD to use the GitHub App for repo access: https://argo-cd.readthedocs.io/en/stable/user-guide/private-repositories/#github-app-credential

[IanKWatts]

This is working. ArgoCD instances have been updated to include the HTTPS version of the GitHub URL in each AppProject's source repository list.