vault plugin is not connecting to vault

[Zoli8501]

I try to activate the plugin for argocd in helm chart, configmaps are argocd-cmp-cm and argocd-cm.

configuration of argocd-cm: configManagementPlugins: |

• name: vault-configuration generate: command:
  • argocd-vault-plugin
  • generate
  • "."
  • "-s"
  • "vault-configuration"
• name: argocd-vault-plugin generate: command: ["argocd-vault-plugin"] args: ["generate", "./"] discover: fileName: "./argocd-vault-plugin"

the cmp-plugin in argocd-cmp-cm: plugins:

--- First plugin

   cmp-plugin:
     version: v1.0
     init:
       command: [sh]
       args: [-c, 'echo "Initializing..."']
     generate:
       command: [sh, -c]
       args:
         - |
           echo "{\"kind\": \"ConfigMap\", \"apiVersion\": \"v1\", \"metadata\": { \"name\": \"$ARGOCD_APP_NAME\", \"namespace\": \"$ARGOCD_APP_NAMESPACE\", \"annotations\": {\"Foo\": \"$ARGOCD_ENV_FOO\", \"KubeVersion\": \"$KUBE_VERSION\", \"KubeApiVersion\": \"$KUBE_API_VERSIONS\",\"Bar\": \"baz\"}}}"
     discover:
       fileName: "./subdir/s*.yaml"
       find:
         glob: "**/Chart.yaml"
         command: [sh, -c, find . -name env.yaml]

and the plugin configuration part: extraContainers:

• command:

  • /var/run/argocd/argocd-cmp-server image: registry.access.redhat.com/ubi8 imagePullPolicy: Always name: avp resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop:
    • ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 999 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts:
  • mountPath: /var/run/argocd name: var-files
  • mountPath: /home/argocd/cmp-server/plugins name: plugins
  • mountPath: /tmp name: cmp-tmp
  • mountPath: /home/argocd/cmp-server/config/plugin.yaml name: argocd-cmp-cm subPath: cmp-plugin.yaml
  • mountPath: /usr/local/bin/argocd-vault-plugin name: custom-tools subPath: argocd-vault-plugin

  initContainers:

• args:

  • - curl -L https://github.com/argoproj-labs/argocd-vault-plugin/releases/download/v1.17.0/argocd-vault-plugin_1.17.0_linux_amd64 -o /tmp/argocd-vault-plugin && chmod +x /tmp/argocd-vault-plugin && mv /tmp/argocd-vault-plugin /custom-tools/ command:

  • sh
  • '-c' env:
  • name: AVP_VERSION value: 1.16.1 image: registry.access.redhat.com/ubi8 imagePullPolicy: Always name: download-tools resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop:
    • ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 999 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts:
  • mountPath: /custom-tools name: custom-tools
  • mountPath: /tmp name: tmp

  -- Additional volumeMounts to the repo server main container

  volumeMounts: []

  -- Additional volumes to the repo server pod

  volumes:

  • configMap: name: argocd-cmp-cm name: argocd-cmp-cm
  • emptyDir: {} name: cmp-tmp
  • emptyDir: {} name: custom-tools

-- envFrom to pass to repo server

@default -- [] (See [values.yaml])

envFrom:

• secretRef: name: vault-configuration

backend secret is root token of vault: data: AVP_AUTH_TYPE: vault VAULT_ADDR: ... AVP_AUTH_TYPE: token AVP_TYPE: vault VAULT_TOKEN: ... kind: Secret

Argocd app manifest:

apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: opensearch namespace: argocd spec: project: hccs destination: server: {{ .Values.spec.destination.server }} namespace: opensearch sources:

• chart: opensearch repoURL: https://harbor.cp-01-prod.mcs-rancher.t-systems.net/chartrepo/hccs targetRevision: 2.18.0 helm: valueFiles:
  • $values/helm-charts/opensearch/opensearch-values_1.yaml values: | envFrom:
    • secretRef: name: opensearch
• repoURL: {{ .Values.spec.source.repoURL }} ref: values targetRevision: development syncPolicy: automated: {}

and the secret: kind: Secret apiVersion: v1 metadata: name: opensearch annotations: avp.kubernetes.io/path: "secret/data/opensearch" type: Opaque stringData: password:

in argocd the secret will be syncronized but password substitution is not happening...

I also tried to add manually cmp-plugin configmap: apiVersion: v1 kind: ConfigMap metadata: name: cmp-plugin data: avp.yaml: | apiVersion: argoproj.io/v1alpha1 kind: ConfigManagementPlugin metadata: name: argocd-vault-plugin spec: allowConcurrency: true discover: find: command:

• sh
• "-c"
• "find . -name '*.yaml' | xargs -I {} grep \"<path\|avp\.kubernetes\.io\" {} | grep ." generate: command:
  • argocd-vault-plugin
  • generate
  • "." lockRepo: false

but also not working...

Thank you for your support.

[Zoli8501]

Made some progress, plugin is now visible in argocd, can be selected but when creating new app following error appears: Unable to create application: application spec for root-app is invalid: InvalidSpecError: Unable to generate manifests in .: rpc error: code = Unknown desc = plugin sidecar failed. error generating manifests in cmp: rpc error: code = Unknown desc = error generating manifests: argocd-vault-plugin generate -s vault-kubernetes failed exit status 1: Error: argument required to generate manifests Usage: argocd-vault-plugin generate [flags] Flags: -c, --config-path string path to a file containing Vault configuration (YAML, JSON, envfile) to use -h, --help help for generate -s, --secret-name string name of a Kubernetes Secret in the argocd namespace containing Vault configuration data in the argocd namespace of your ArgoCD host (Only available when used in ArgoCD). The namespace can be overridden by using the format : --verbose-sensitive-output enable verbose mode for detailed info to help with debugging. Includes sensitive data (credentials), logged to stderr

cmp-plugin: apiVersion: v1 kind: ConfigMap metadata: name: cmp-plugin namespace: argocd data: avp.yaml: | apiVersion: argoproj.io/v1alpha1 kind: ConfigManagementPlugin metadata: name: argocd-vault-plugin spec: allowConcurrency: true discover: find: command:

• sh
• "-c"
• "find . -name '*.yaml' | xargs -I {} grep \"<path\|avp\.kubernetes\.io\" {} | grep ." generate: command:
  • argocd-vault-plugin
  • generate
  • "."
  • "-s"
  • "vault-kubernetes" lockRepo: false

somehow it not mounted: $ printenv | grep "AVP" $ $

but mountpath and volummounts are there in the configuration:

        - mountPath: /home/argocd/cmp-server/config/plugin.yaml
          name: cmp-plugin
          subPath: avp.yaml

..

volumes:

• configMap: name: cmp-plugin name: cmp-plugin