Chapter 6. Enabling support for a namespace-scoped Argo Rollouts installation
Red Hat OpenShift GitOps enables support for two modes of Argo Rollouts installations:
- Cluster-scoped installation (default): The Argo Rollouts custom resources (CRs) defined in any namespace are reconciled by the Argo Rollouts instance. As a result, you can use Argo Rollouts CR across any namespace on the cluster.
Namespace-scoped installation: The Argo Rollouts instance is installed in a specific namespace and only handles an Argo Rollouts CR within the same namespace. This installation mode includes the following benefits:
-
This mode does not require cluster-wide
ClusterRole
orClusterRoleBinding
permissions. You can install and use Argo Rollouts within a single namespace without requiring cluster permissions. - This mode provides security benefits by limiting the cluster scope of a single Argo Rollouts instance to a specific namespace.
-
This mode does not require cluster-wide
To prevent unintended privilege escalation, Red Hat OpenShift GitOps allows only one mode of Argo Rollout installation at a time.
To switch between cluster-scoped and namespace-scoped Argo Rollouts installations, complete the following steps.
6.1. Configuring a namespace-scoped Argo Rollouts installation
To configure a namespace-scoped instance of Argo Rollouts installation, complete the following steps.
Prerequisites
- You are logged in to the Red Hat OpenShift GitOps cluster as an administrator.
- You have installed Red Hat OpenShift GitOps on your Red Hat OpenShift GitOps cluster.
Procedure
-
In the Administrator perspective of the web console, go to Administration
CustomResourceDefinitions. -
Search for
Subscription
and click the Subscription CRD. - Click the Instances tab and then click the openshift-gitops-operator subscription.
Click the YAML tab and edit the YAML file.
Specify the
NAMESPACE_SCOPED_ARGO_ROLLOUTS
environment variable, with the value set totrue
in the.spec.config.env
property.Example of configuring the namespace-scoped Argo Rollouts installation
apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: name: openshift-gitops-operator spec: # (...) config: env: - name: NAMESPACE_SCOPED_ARGO_ROLLOUTS value: 'true' 1
- 1
- The value set to
'true'
enables namespace-scoped installation. If the value is set to'false'
or not specified the installation defaults to cluster-scoped mode.
Click Save.
The Red Hat OpenShift GitOps Operator facilitates the reconciliation of the Argo Rollouts custom resource within a namespace-scoped installation.
Verify that the Red Hat OpenShift GitOps Operator has enabled the namespace-scoped Argo Rollouts installation by viewing the logs of the GitOps container:
-
In the Administrator perspective of the web console, go to Workloads
Pods. - Click the openshift-gitops-operator-controller-manager pod, and then click the Logs tab.
-
Look for the following log statement:
Running in namespaced-scoped mode
. This statement indicates that the Red Hat OpenShift GitOps Operator has enabled the namespace-scoped Argo Rollouts installation.
-
In the Administrator perspective of the web console, go to Workloads
Create a
RolloutManager
resource to complete the namespace-scoped Argo Rollouts installation:-
Go to Operators
Installed Operators Red Hat OpenShift GitOps, and click the RolloutManager tab. - Click Create RolloutManager.
Select YAML view and enter the following snippet:
Example
RolloutManager
CR for a namespace-scoped Argo Rollouts installationapiVersion: argoproj.io/v1alpha1 kind: RolloutManager metadata: name: rollout-manager namespace: my-application 1 spec: namespaceScoped: true
- 1
- Specify the name of the project where you want to install the namespace-scoped Argo Rollouts instance.
Click Create.
After the
RolloutManager
CR is created, Red Hat OpenShift GitOps begins to install the namespace-scoped Argo Rollouts instance into the selected namespace.
-
Go to Operators
Verify that the namespace-scoped installation is successful.
-
In the RolloutManager tab, under the RolloutManagers section, ensure that the Status field of the
RolloutManager
instance isPhase: Available
. Examine the following output in the YAML tab under the RolloutManagers section to ensure that the installation is successful:
Example of namespace-scoped Argo Rollouts installation YAML file
spec: namespaceScoped: true status: conditions: lastTransitionTime: '2024-07-10T14:20:5z` message: '' reason: Success status: 'True' 1 type: 'Reconciled' phase: Available rolloutController: Available
- 1
- This status indicates that the namespace-scoped Argo Rollouts installation is enabled successfully.
If you try to install a namespace-specific Argo Rollouts instance while a cluster-scoped installation already exists on the cluster, an error message is displayed:
Example of an incorrect installation with an error message
spec: namespaceScoped: true status: conditions: lastTransitionTime: '2024-07-10T14:10:7z` message: 'when Subscription has environment variable NAMESPACE_SCOPED_ARGO_ROLLOUTS set to False, there may not exist any namespace-scoped RolloutManagers: only a single cluster-scoped RolloutManager is supported' reason: InvalidRolloutManagerScope status: 'False' 1 type: 'Reconciled' phase: Failure rolloutController: Failure
- 1
- This status indicates that the namespace-scoped Argo Rollouts installation is not enabled successfully. The installation defaults to cluster-scoped mode.
-
In the RolloutManager tab, under the RolloutManagers section, ensure that the Status field of the