argoproj-labs / argocd-vault-plugin

An Argo CD plugin to retrieve secrets from Secret Management tools and inject them into Kubernetes secrets
https://argocd-vault-plugin.readthedocs.io
Apache License 2.0
812 stars 190 forks source link

'bash: argocd-vault-plugin: command not found' Needed help in using Azure Key Vault with ArgoCD #619

Open MeghaSuresh122 opened 6 months ago

MeghaSuresh122 commented 6 months ago

Describe the bug I'm new to DevOps and I came across ArgoCD couple weeks ago. I've been using CI/CD Azure pipelines and I would like to switch CD to ArgoCD. I followed the steps in docs to integrate Azure Key Vault with ArgoCD, but it is not fetching values from the Key Vault. I think there is something wrong with my installation, Can someone please help with it? When execing into repo-server pod, and running argocd-vault-plugin --help returns: bash: argocd-vault-plugin: command not found But ls cmp-server/plugins lists argocd-vault-plugin.sock.

To Reproduce Steps to reproduce the behavior: Argocd-vault-plugin installation: #https://argocd-vault-plugin.readthedocs.io/en/stable/installation/#initcontainer-and-configuration-via-sidecar

vault-configuration:

apiVersion: v1
kind: Secret
metadata:
  name: vault-configuration
  namespace: argo-cd
data:
  AVP_TYPE: YXp1cmVrZXl2YXVsdA== # azurekeyvault
  AZURE_TENANT_ID: <base64-tenant-id>
  AZURE_CLIENT_ID: <base64-client-id>
  AZURE_CLIENT_SECRET: <base64-client-secret>
type: Opaque   

cmp-plugin:

apiVersion: v1
kind: ConfigMap
metadata:
  name: cmp-plugin
  namespace: argo-cd
data:
  avp.yaml: |
    apiVersion: argoproj.io/v1alpha1
    kind: ConfigManagementPlugin
    metadata:
      name: argocd-vault-plugin
    spec:
      allowConcurrency: true
      discover:
        find:
          command:
            - sh
            - "-c"
            - "find . -name '*.yaml' | xargs -I {} grep \"<path\\|avp\\.kubernetes\\.io\" {} | grep ."
      generate:
        command:
          - argocd-vault-plugin
          - generate
          - "."
          - "-s"
          - "argo-cd:vault-configuration"
      lockRepo: false
---

Repo server values:

## Repo Server
repoServer:

  envFrom:
  - secretRef:
      name: vault-configuration

  extraContainers:
    # argocd-vault-plugin with plain YAML
    - name: avp
      command:
        - "/var/run/argocd/argocd-cmp-server"
      image: registry.access.redhat.com/ubi8
      securityContext:
        runAsNonRoot: true
        runAsUser: 999
      volumeMounts:
        - mountPath: /var/run/argocd
          name: var-files
        - mountPath: /home/argocd/cmp-server/plugins
          name: plugins
        - mountPath: /home/argocd/cmp-server/config/plugin.yaml
          subPath: avp.yaml
          name: cmp-plugin
        - mountPath: /tmp
          name: tmp

        - name: custom-tools
          subPath: argocd-vault-plugin
          mountPath: /usr/local/bin/argocd-vault-plugin

  initContainers:
    - name: download-tools
      image: registry.access.redhat.com/ubi8
      env:
        - name: AVP_VERSION
          value: 1.16.1
      command: [sh, -c]
      args:
        - >-
          curl -L https://github.com/argoproj-labs/argocd-vault-plugin/releases/download/v$(AVP_VERSION)/argocd-vault-plugin_$(AVP_VERSION)_linux_amd64 -o argocd-vault-plugin &&
          chmod +x argocd-vault-plugin &&
          mv argocd-vault-plugin /custom-tools/
      volumeMounts:
        - mountPath: /custom-tools
          name: custom-tools

  volumes:
   - name: cmp-plugin
     configMap:
       name: cmp-plugin
   - name: custom-tools
     emptyDir: {}

  serviceAccount:
    create: true
    name: "" # "argocd-repo-server"
    annotations: {}
    labels: {}
    automountServiceAccountToken: true

  rbac:
    - apiGroups:
        - ''
      resources:
        - secrets
        - configmaps
      verbs:
        - get
        - list
        - watch

Expected behavior Need to replace <password> with password key value from the vault named azure-key-vault.

kind: Secret
apiVersion: v1
metadata:
  name: test-secret
  namespace: django
  annotations:
    avp.kubernetes.io/path: "azure-key-vault"
type: Opaque
stringData:
  password: <password>

Additional context I've used Sealed Secrets for my secret variables till now and it worked fine. I want to know that whether fetching values directly from Azure Key Vault is better than using Sealed Secrets.