devops-stack-module-application

A DevOps Stack module to deploy a simple Application in Argo CD.

The module creates an Argo CD AppProject using the name given on declaration and then creates an Argo CD Application using the chart that is inside the path for the Git repository that is declared.

Inside that folder, the module expects an Helm chart with a folder structure similar to the following (as is standard practice):

application_folder
  ├── Chart.yaml
  ├── charts
  │   ├── dependency1.tar.gz
  │   └── dependency2.tar.gz
  ├── secrets.yaml
  ├── templates
  │   ├── template1.yaml
  │   ├── template2.yaml
  │   ├── template3.yaml
  │   └── _helpers.tpl
  └── values.yaml

By default, the created AppProject can only create an Application within a Namespace of the same name or within a Namespace declared on the module declaration. Besides that, the AppProject has the permission to create any kind of Kubernetes resources inside the destination cluster, but you can restrict the allowed resources if you need to.

Usage

This module can be declared by adding the following block on your Terraform configuration:

module "module_name" {
  source = "git::https://github.com/camptocamp/devops-stack-module-application.git?ref=<RELEASE>"

  name             = "application-name"
  argocd_namespace = local.argocd_namespace

  source_repo            = "https://address.com/owner/repository.git"
  source_repo_path       = "path/to/chart"
  source_target_revision = "branch"

  depends_on = [module.argocd]
}

A more complex declaration, that defines the Namespace and also the AppProject allowed resources, would look like this:

module "module_name" {
  source = "git::https://github.com/camptocamp/devops-stack-module-application.git?ref=<RELEASE>"

  name             = "application-name"
  argocd_namespace = local.argocd_namespace

  source_repo            = "https://address.com/owner/repository.git"
  source_repo_path       = "path/to/chart"
  source_target_revision = "branch"

  destination_namespace = "namespace"

  project_cluster_resource_whitelist = [
    {
      group = "*"
      kind = "Namespace"
    },
  ]

  project_namespace_resource_whitelist = [
    {
      group = "apps"
      kind = "Deployment"
    },
    {
      group = "*"
      kind = "Service"
    },
  ]

  depends_on = [module.argocd]
}

Furthermore, you can customize the chart’s values.yaml by adding an Helm configuration as an HCL structure:

module "module_name" {
  source = "git::https://github.com/camptocamp/devops-stack-module-application.git?ref=<RELEASE>"

  name             = "application-name"
  argocd_namespace = local.argocd_namespace

  source_repo            = "https://address.com/owner/repository.git"
  source_repo_path       = "path/to/chart"
  source_target_revision = "branch"

  helm_values = [{ # Note the curly brackets here
    map = {
      string = "string"
      bool   = true
    }
    sequence = [
      {
        key1 = "value1"
        key2 = "value2"
      },
      {
        key1 = "value1"
        key2 = "value2"
      },
    ]
    sequence2 = [
      "string1",
      "string2"
    ]
  }]

  depends_on = [module.argocd]
}

Using a private repository

When your charts are stored inside a private repository, Argo CD needs to have the credentials necessary to have at least read access to the contents of the repository.

This module has 2 variables you can use for that, depending on the type of credentials you want to configure, either HTTPS or SSH.

SSH

You’ll need to pass a string containing a private SSH key in the variable source_credentials_ssh_key (you can pass the value however you want, as long as it is a string) and the repository needs to be of the type git@address.com:owner/repository.

Do not hardcode your SSH private key as the example below! Either create the SSH key using Terraform and pass the output directly or use SOPS to store and pass the key as a secret. 
module "module_name" {
  source = "git::https://github.com/camptocamp/devops-stack-module-application.git?ref=<RELEASE>"

  name             = "application-name"
  argocd_namespace = local.argocd_namespace

  source_repo            = "git@address.com:owner/repository"
  source_repo_path       = "path/to/chart"
  source_target_revision = "branch"

  source_credentials_ssh_key = "-----BEGIN OPENSSH PRIVATE KEY-----\nfoo\nbar\n-----END OPENSSH PRIVATE KEY-----"

  depends_on = [module.argocd]
}

HTTPS

You’ll need to pass the username and password inside the variable source_credentials_https and the repository needs to be of the type https://address.com/owner/repository.

Do not hardcode your password the example below! It is recommended to pass the value as secret, either using SOPS or another provider. Another best practice would be to use a token you created on Github.com (or another provider) that has the least amount of access needed (in these use-case, Argo CD only needs read access). 
module "module_name" {
  source = "git::https://github.com/camptocamp/devops-stack-module-application.git?ref=<RELEASE>"

  name             = "application-name"
  argocd_namespace = local.argocd_namespace

  source_repo            = "https://address.com/owner/repository.git"
  source_repo_path       = "path/to/chart"
  source_target_revision = "branch"

  source_credentials_https = {
    username = "your_username"
    password = "your_token_password"
    https_insecure = false
  }

  depends_on = [module.argocd]
}

Technical Reference

Dependencies

module.argocd

As this is an application, it needs to be deployed after the deployment of Argo CD and consequently this module needs to have this explicit dependency.

Requirements

The following requirements are needed by this module:

Providers

The following providers are used by this module:

Modules

No modules.

Resources

The following resources are used by this module:

Required Inputs

The following input variables are required:

argocd_namespace

Description: Namespace used by Argo CD where the Application and AppProject resources should be created.

Type: string

name

Description: Name to give the to the AppProject and Application.

Type: string

source_repo

Description: Repository where to retrieve the application’s chart.

Type: string

source_repo_path

Description: Path for the application’s chart in the source repository.

Type: string

source_target_revision

Description: Git target revision for the application chart.

Type: string

Optional Inputs

The following input variables are optional (have default values):

app_autosync

Description: Automated sync options for the Argo CD Application resource.

Type:

object({
    allow_empty = optional(bool)
    prune       = optional(bool)
    self_heal   = optional(bool)
  })

Default:

{
  "allow_empty": false,
  "prune": true,
  "self_heal": true
}

dependency_ids

Description: IDs of the other modules on which this module depends on.

Type: map(string)

Default: {}

destination_namespace

Description: Namespace where the application will be deployed. By default it is the same as the application’s name defined by var.name. We use a ternary operator to conditionally define the Namespace only if it is defined on the module’s instantiation: namespace = var.destination_namespace == null ? var.name : var.destination_namespace.

Type: string

Default: null

helm_values

Description: Helm values, passed as a list of HCL structures. These values are concatenated with the default ones and then passed to the application’s charts.

Type: any

Default: []

project_cluster_resource_whitelist

Description: Cluster-scoped resources allowed to be deployed in the Argo CD AppProject created by the module. The group must be a Kubernetes API group such as core or apps and the kind must be a Kubernetes Kinds/Object Schemas such as Namespace or ClusterRole (note that only resources like these ones are compatible with this setting, the other resources are only Namespace-scoped). You can see the API Groups here.

Type:

list(object({
    group = string
    kind  = string
  }))

Default:

[
  {
    "group": "*",
    "kind": "*"
  }
]

project_namespace_resource_whitelist

Description: Namespace-scoped resources allowed to be deployed in the Argo CD AppProject created by the module. The group must be a Kubernetes API group such as core or apps and the kind must be a Kubernetes Kinds/Object Schemas such as Pod, ConfigMap, DaemonSet, Deployment, etc. You can see the API Groups here.

Type:

list(object({
    group = string
    kind  = string
  }))

Default:

[
  {
    "group": "*",
    "kind": "*"
  }
]

source_credentials_https

Description: Credentials to connect to a private repository. Use this variable when connecting through HTTPS. You’ll need to provide the the username and password values. If the TLS certificate for the HTTPS connection is not issued by a qualified CA, you can set https_insecure as true.

Type:

object({
    username       = string
    password       = string
    https_insecure = bool
  })

Default:

{
  "https_insecure": false,
  "password": null,
  "username": null
}

source_credentials_ssh_key

Description: Credentials to connect to a private repository. Use this variable when connecting to a repository through SSH.

Type: string

Default: null

Outputs

The following outputs are exported:

id

Description: ID to pass other modules in order to refer to this module as a dependency.

Reference in table format

Show tables

= Requirements

Name Version

argocd

~> 4

utils

~> 1

= Providers

Name Version

argocd

~> 4

null

n/a

utils

~> 1

= Resources

Name Type

argocd_application.this

resource

argocd_project.this

resource

argocd_repository.private_https_repo

resource

argocd_repository.private_ssh_repo

resource

null_resource.dependencies

resource

null_resource.this

resource

utils_deep_merge_yaml.values

data source

= Inputs

Name Description Type Default Required

app_autosync

Automated sync options for the Argo CD Application resource.

 
object({
    allow_empty = optional(bool)
    prune       = optional(bool)
    self_heal   = optional(bool)
  })
 
{
  "allow_empty": false,
  "prune": true,
  "self_heal": true
}

no

argocd_namespace

Namespace used by Argo CD where the Application and AppProject resources should be created.

string

n/a

yes

dependency_ids

IDs of the other modules on which this module depends on.

map(string)

{}

no

destination_namespace

Namespace where the application will be deployed. By default it is the same as the application’s name defined by var.name. We use a ternary operator to conditionally define the Namespace only if it is defined on the module’s instantiation: namespace = var.destination_namespace == null ? var.name : var.destination_namespace.

string

null

no

helm_values

Helm values, passed as a list of HCL structures. These values are concatenated with the default ones and then passed to the application’s charts.

any

[]

no

name

Name to give the to the AppProject and Application.

string

n/a

yes

project_cluster_resource_whitelist

Cluster-scoped resources allowed to be deployed in the Argo CD AppProject created by the module. The group must be a Kubernetes API group such as core or apps and the kind must be a Kubernetes Kinds/Object Schemas such as Namespace or ClusterRole (note that only resources like these ones are compatible with this setting, the other resources are only Namespace-scoped). You can see the API Groups here.

 
list(object({
    group = string
    kind  = string
  }))
 
[
  {
    "group": "*",
    "kind": "*"
  }
]

no

project_namespace_resource_whitelist

Namespace-scoped resources allowed to be deployed in the Argo CD AppProject created by the module. The group must be a Kubernetes API group such as core or apps and the kind must be a Kubernetes Kinds/Object Schemas such as Pod, ConfigMap, DaemonSet, Deployment, etc. You can see the API Groups here.

 
list(object({
    group = string
    kind  = string
  }))
 
[
  {
    "group": "*",
    "kind": "*"
  }
]

no

source_credentials_https

Credentials to connect to a private repository. Use this variable when connecting through HTTPS. You’ll need to provide the the username and password values. If the TLS certificate for the HTTPS connection is not issued by a qualified CA, you can set https_insecure as true.

 
object({
    username       = string
    password       = string
    https_insecure = bool
  })
 
{
  "https_insecure": false,
  "password": null,
  "username": null
}

no

source_credentials_ssh_key

Credentials to connect to a private repository. Use this variable when connecting to a repository through SSH.

string

null

no

source_repo

Repository where to retrieve the application’s chart.

string

n/a

yes

source_repo_path

Path for the application’s chart in the source repository.

string

n/a

yes

source_target_revision

Git target revision for the application chart.

string

n/a

yes

= Outputs

Name Description

id

ID to pass other modules in order to refer to this module as a dependency.