Chapter 1. Configuring secure communication with Redis

Procedure

1. Log in to the OpenShift Container Platform web console.

2. Create an Argo CD instance with autotls enabled:

   1. In the Administrator perspective of the web console, use the left navigation panel to go to Administration CustomResourceDefinitions.
   2. Search for argocds.argoproj.io and click ArgoCD custom resource definition (CRD).
   3. On the CustomResourceDefinition details page, click the Instances tab, and then click Create ArgoCD.

   4. Edit or replace the YAML similar to the following example:

      Example Argo CD CR with autotls enabled

      apiVersion: argoproj.io/v1beta1
      kind: ArgoCD
      metadata:
        name: argocd 

      1

      
        namespace: openshift-gitops 

      2

      
      spec:
        redis:
          autotls: openshift 

      3

      
        ha:
          enabled: true 

      4

      Copy to Clipboard Toggle word wrap

      1

      The name of the Argo CD instance.

      2

      The namespace where you want to run the Argo CD instance.

      3

      The flag that enables the autotls setting and creates a TLS certificate for Redis.

      4

      The flag value that enables the HA feature. If you do not want to enable HA, do not include this line or set the flag value as false.

      Tip

      Alternatively, you can enable the autotls setting on an already existing Argo CD instance by running the following command:

      $ oc patch argocds.argoproj.io <instance-name> --type=merge -p '{"spec":{"redis":{"autotls":"openshift"}}}'

      Copy to Clipboard Toggle word wrap
   5. Click Create.

   6. Verify that the Argo CD pods are ready and running:

      $ oc get pods -n <namespace> 

      1

      Copy to Clipboard Toggle word wrap

      1

      Specify a namespace where the Argo CD instance is running, for example openshift-gitops.

      Example output with HA disabled

      NAME                                  READY   STATUS    RESTARTS   AGE
      argocd-application-controller-0       1/1     Running   0          26s
      argocd-redis-84b77d4f58-vp6zm         1/1     Running   0          37s
      argocd-repo-server-5b959b57f4-znxjq   1/1     Running   0          37s
      argocd-server-6b8787d686-wv9zh        1/1     Running   0          37s

      Copy to Clipboard Toggle word wrap

      Note

      The HA-enabled TLS configuration requires a cluster with at least three worker nodes. It can take a few minutes for the output to appear if you have enabled the Argo CD instances with HA configuration.

      Example output with HA enabled

      NAME                                       READY   STATUS    RESTARTS   AGE
      argocd-application-controller-0            1/1     Running   0          10m
      argocd-redis-ha-haproxy-669757fdb7-5xg8h   1/1     Running   0          10m
      argocd-redis-ha-server-0                   2/2     Running   0          9m9s
      argocd-redis-ha-server-1                   2/2     Running   0          98s
      argocd-redis-ha-server-2                   2/2     Running   0          53s
      argocd-repo-server-576499d46d-8hgbh        1/1     Running   0          10m
      argocd-server-9486f88b7-dk2ks              1/1     Running   0          10m

      Copy to Clipboard Toggle word wrap

3. Verify that the argocd-operator-redis-tls secret is created:

   $ oc get secrets argocd-operator-redis-tls -n <namespace> 

   1

   Copy to Clipboard Toggle word wrap

   1

   Specify a namespace where the Argo CD instance is running, for example openshift-gitops.

   Example output

   NAME                        TYPE                DATA   AGE
   argocd-operator-redis-tls   kubernetes.io/tls   2      30s

   Copy to Clipboard Toggle word wrap

   The secret must be of the kubernetes.io/tls type and a size of 2.

Procedure

1. Log in to the OpenShift Container Platform web console.

2. Create an Argo CD instance:

   1. In the Administrator perspective of the web console, use the left navigation panel to go to Administration CustomResourceDefinitions.
   2. Search for argocds.argoproj.io and click ArgoCD custom resource definition (CRD).
   3. On the CustomResourceDefinition details page, click the Instances tab, and then click Create ArgoCD.

   4. Edit or replace the YAML similar to the following example:

      Example ArgoCD CR with autotls disabled

      apiVersion: argoproj.io/v1beta1
      kind: ArgoCD
      metadata:
        name: argocd 

      1

      
        namespace: openshift-gitops 

      2

      
      spec:
        ha:
          enabled: true 

      3

      Copy to Clipboard Toggle word wrap

      1

      The name of the Argo CD instance.

      2

      The namespace where you want to run the Argo CD instance.

      3

      The flag value that enables the HA feature. If you do not want to enable HA, do not include this line or set the flag value as false.

   5. Click Create.

   6. Verify that the Argo CD pods are ready and running:

      $ oc get pods -n <namespace> 

      1

      Copy to Clipboard Toggle word wrap

      1

      Specify a namespace where the Argo CD instance is running, for example openshift-gitops.

      Example output with HA disabled

      NAME                                  READY   STATUS    RESTARTS   AGE
      argocd-application-controller-0       1/1     Running   0          26s
      argocd-redis-84b77d4f58-vp6zm         1/1     Running   0          37s
      argocd-repo-server-5b959b57f4-znxjq   1/1     Running   0          37s
      argocd-server-6b8787d686-wv9zh        1/1     Running   0          37s

      Copy to Clipboard Toggle word wrap

      Note

      The HA-enabled TLS configuration requires a cluster with at least three worker nodes. It can take a few minutes for the output to appear if you have enabled the Argo CD instances with HA configuration.

      Example output with HA enabled

      NAME                                       READY   STATUS    RESTARTS   AGE
      argocd-application-controller-0            1/1     Running   0          10m
      argocd-redis-ha-haproxy-669757fdb7-5xg8h   1/1     Running   0          10m
      argocd-redis-ha-server-0                   2/2     Running   0          9m9s
      argocd-redis-ha-server-1                   2/2     Running   0          98s
      argocd-redis-ha-server-2                   2/2     Running   0          53s
      argocd-repo-server-576499d46d-8hgbh        1/1     Running   0          10m
      argocd-server-9486f88b7-dk2ks              1/1     Running   0          10m

      Copy to Clipboard Toggle word wrap

3. Create a self-signed certificate for the Redis server by using one of the following options depending on your HA configuration:

   • For the Argo CD instance with HA disabled, run the following command:

     $ openssl req -new -x509 -sha256 \
       -subj "/C=XX/ST=XX/O=Testing/CN=redis" \
       -reqexts SAN -extensions SAN \
       -config <(printf "\n[SAN]\nsubjectAltName=DNS:argocd-redis.<namespace>.svc.cluster.local\n[req]\ndistinguished_name=req") \ 

     1

     
       -keyout /tmp/redis.key \
       -out /tmp/redis.crt \
       -newkey rsa:4096 \
       -nodes \
       -sha256 \
       -days 10

     Copy to Clipboard Toggle word wrap

     1

     Specify a namespace where the Argo CD instance is running, for example openshift-gitops.

     Example output

     Generating a RSA private key
     ...............++++
     ............................++++
     writing new private key to '/tmp/redis.key'

     Copy to Clipboard Toggle word wrap

   • For the Argo CD instance with HA enabled, run the following command:

     $ openssl req -new -x509 -sha256 \
       -subj "/C=XX/ST=XX/O=Testing/CN=redis" \
       -reqexts SAN -extensions SAN \
       -config <(printf "\n[SAN]\nsubjectAltName=DNS:argocd-redis-ha-haproxy.<namespace>.svc.cluster.local\n[req]\ndistinguished_name=req") \ 

     1

     
       -keyout /tmp/redis-ha.key \
       -out /tmp/redis-ha.crt \
       -newkey rsa:4096 \
       -nodes \
       -sha256 \
       -days 10

     Copy to Clipboard Toggle word wrap

     1

     Specify a namespace where the Argo CD instance is running, for example openshift-gitops.

     Example output

     Generating a RSA private key
     ...............++++
     ............................++++
     writing new private key to '/tmp/redis-ha.key'

     Copy to Clipboard Toggle word wrap

4. Verify that the generated certificate and key are available in the /tmp directory by running the following commands:

   $ cd /tmp

   Copy to Clipboard Toggle word wrap

   $ ls

   Copy to Clipboard Toggle word wrap

   Example output with HA disabled

   ...
   redis.crt
   redis.key
   ...

   Copy to Clipboard Toggle word wrap

   Example output with HA enabled

   ...
   redis-ha.crt
   redis-ha.key
   ...

   Copy to Clipboard Toggle word wrap

5. Create the argocd-operator-redis-tls secret by using one of the following options depending on your HA configuration:

   • For the Argo CD instance with HA disabled, run the following command:

     $ oc create secret tls argocd-operator-redis-tls --key=/tmp/redis.key --cert=/tmp/redis.crt

     Copy to Clipboard Toggle word wrap

   • For the Argo CD instance with HA enabled, run the following command:

     $ oc create secret tls argocd-operator-redis-tls --key=/tmp/redis-ha.key --cert=/tmp/redis-ha.crt

     Copy to Clipboard Toggle word wrap

     Example output

     secret/argocd-operator-redis-tls created

     Copy to Clipboard Toggle word wrap

6. Annotate the secret to indicate that it belongs to the Argo CD CR:

   $ oc annotate secret argocd-operator-redis-tls argocds.argoproj.io/name=<instance-name> 

   1

   Copy to Clipboard Toggle word wrap

   1

   Specify a name of the Argo CD instance, for example argocd.

   Example output

   secret/argocd-operator-redis-tls annotated

   Copy to Clipboard Toggle word wrap

7. Verify that the Argo CD pods are ready and running:

   $ oc get pods -n <namespace> 

   1

   Copy to Clipboard Toggle word wrap

   1

   Specify a namespace where the Argo CD instance is running, for example openshift-gitops.

   Example output with HA disabled

   NAME                                  READY   STATUS    RESTARTS   AGE
   argocd-application-controller-0       1/1     Running   0          26s
   argocd-redis-84b77d4f58-vp6zm         1/1     Running   0          37s
   argocd-repo-server-5b959b57f4-znxjq   1/1     Running   0          37s
   argocd-server-6b8787d686-wv9zh        1/1     Running   0          37s

   Copy to Clipboard Toggle word wrap

   Note

   It can take a few minutes for the output to appear if you have enabled the Argo CD instances with HA configuration.

   Example output with HA enabled

   NAME                                       READY   STATUS    RESTARTS   AGE
   argocd-application-controller-0            1/1     Running   0          10m
   argocd-redis-ha-haproxy-669757fdb7-5xg8h   1/1     Running   0          10m
   argocd-redis-ha-server-0                   2/2     Running   0          9m9s
   argocd-redis-ha-server-1                   2/2     Running   0          98s
   argocd-redis-ha-server-2                   2/2     Running   0          53s
   argocd-repo-server-576499d46d-8hgbh        1/1     Running   0          10m
   argocd-server-9486f88b7-dk2ks              1/1     Running   0          10m

   Copy to Clipboard Toggle word wrap