Introduce ArgoCD ordering

Makefile

@@ -60,7 +60,7 @@ docs-serve: ## Preview the documentation
 test: commodore_args += -f tests/$(instance).yml
 test: .compile ## Compile the component
 .PHONY: gen-golden
-gen-golden: commodore_args += -f tests/$(instance).yml 
+gen-golden: commodore_args += -f tests/$(instance).yml
 gen-golden: clean .compile ## Update the reference version for target `golden-diff`.
 	@rm -rf tests/golden/$(instance)
 	@mkdir -p tests/golden/$(instance)
@@ -95,3 +95,14 @@ clean: ## Clean the project
 .PHONY: pre-commit-hook
 pre-commit-hook: ## Install pre-commit hook in .git/hooks
 	/usr/bin/cp -fa .githooks/pre-commit .git/hooks/pre-commit
+
+.PHONY: push-golden
+push-golden: commodore_args += -f tests/$(instance).yml
+push-golden: clean .compile ## Update the reference version for target `golden-diff`.
+	yq eval-all '. as $$item ireduce ({}; . * $$item )' hack/base_app.yaml tests/golden/vshn/appcat/apps/appcat.yaml | kubectl apply -f -
+	cd compiled/appcat/appcat && \
+	git init && \
+	git add . && \
+	git commit -m "update" && \
+	git remote add origin http://gitea_admin:admin@forgejo.127.0.0.1.nip.io:8088/gitea_admin/appcat.git && \
+	git push -u origin master --force

README.md

@@ -27,6 +27,23 @@ There is currently no easy way to run it locally. You need to apply the compiled
 
 This process is not suitable for installing the component on a production system.
 
+## Use ArgoCD in kindev
+
+Kindev provides a forgejo instance and ArgoCD that we can use the git repositories from it. ArgoCD is available at http://argocd.127.0.0.1.nip.io:8088/.
+
+To push any of the golden tests to it you can use `gmake push-golden -e instance=vshn`, it will:
+* Compile the given golden test
+* Push it to forgejo
+* Create or update an ArgoCD app according to the app config in the component
+
+There's a known issue:
+On the very first sync after setting up kindev, ArgoCD doesn't recognize the `server-side` flag. Thus, the sync will fail. Simply click sync again in the ArgoCD GUI to trigger it again.
+
+## ArgoCD SyncWaves
+
+There's a postprocess function that will add ArgoCD syn annotations to each object of the given kind.
+If any new types are introduced that need specific ordering, the `add_argo_annotations.jsonnet` is the right place.
+
 ## Documentation
 
 The rendered documentation for this component is available on the [Commodore Components Hub](https://hub.syn.tools/appcat).

class/appcat.yml

@@ -125,3 +125,31 @@ parameters:
         - type: jsonnet
           filter: postprocess/patch_operator_deployment.jsonnet
           path: ${_instance}/crossplane/helmchart/crossplane/templates
+        - type: jsonnet
+          filter: postprocess/add_argo_annotations.jsonnet
+          path: ${_instance}
+        - type: jsonnet
+          filter: postprocess/add_argo_wave_crossplane.jsonnet
+          path: ${_instance}/crossplane/helmchart/crossplane/templates
+        - type: jsonnet
+          filter: postprocess/add_argo_annotations.jsonnet
+          path: ${_instance}/sli_exporter
+          enabled: ${appcat:slos:enabled}
+        - type: jsonnet
+          filter: postprocess/add_argo_annotations.jsonnet
+          path: ${_instance}/sla_reporter
+          enabled: ${appcat:slos:sla_reporter:enabled}
+        - type: jsonnet
+          filter: postprocess/add_argo_annotations.jsonnet
+          path: ${_instance}/apiserver
+          enabled: ${appcat:apiserver:enabled}
+        - type: jsonnet
+          filter: postprocess/add_argo_annotations.jsonnet
+          path: ${_instance}/cloud_billing
+        - type: jsonnet
+          filter: postprocess/add_argo_annotations.jsonnet
+          path: ${_instance}/controllers/appcat
+          enabled: ${appcat:controller:enabled}
+        - type: jsonnet
+          filter: postprocess/add_argo_annotations.jsonnet
+          path: ${_instance}/controllers/sts-resizer

component/common.libsonnet

@@ -20,7 +20,6 @@ local syncOptions = {
   metadata+: {
     annotations+: {
       'argocd.argoproj.io/sync-options': 'SkipDryRunOnMissingResource=true',
-      'argocd.argoproj.io/sync-wave': '10',
     },
   },
 };

component/main.jsonnet

@@ -246,4 +246,8 @@ local haPrometheusRule = {
   '10_appcat_ha_monitoring': haPrometheusRule,
   [if params.services.vshn.enabled && params.services.emailAlerting.enabled then '10_mailgun_secret']: emailSecret,
   [if params.billing.enableMockOrgInfo then '10_mock_org_info']: mockOrgInfo,
+  // This is ugly, but otherwise the post-processing will fail for
+  // golden tests where things get dynamically enabeld or disabled, so we
+  // can't use an enabled filter in the post processing...
+  'controllers/sts-resizer/.keep': '',
 }

hack/base_app.yaml

@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: appcat
+  namespace: argocd
+operation:
+  initiatedBy:
+    automated: true
+  retry:
+    limit: 5
+  sync:
+    prune: true
+spec:
+  destination:
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    path: .
+    repoURL: http://forgejo-http.forgejo.svc:3000/gitea_admin/appcat
+    targetRevision: HEAD
+    directory:
+      recurse: true

postprocess/add_argo_annotations.jsonnet

@@ -0,0 +1,63 @@
+local com = import 'lib/commodore.libjsonnet';
+local inv = com.inventory();
+
+local annotationMap = {
+  Namespace: {
+    'argocd.argoproj.io/sync-wave': '-100',
+  },
+  ServiceAccount: {
+    'argocd.argoproj.io/sync-wave': '-100',
+  },
+  Role: {
+    'argocd.argoproj.io/sync-wave': '-100',
+  },
+  ClusterRole: {
+    'argocd.argoproj.io/sync-wave': '-100',
+  },
+  RoleBinding: {
+    'argocd.argoproj.io/sync-wave': '-100',
+  },
+  Secrets: {
+    'argocd.argoproj.io/sync-wave': '-100',
+  },
+  ClusterRoleBinding: {
+    'argocd.argoproj.io/sync-wave': '-100',
+  },
+  ObjectBucket: {
+    'argocd.argoproj.io/sync-options': 'Prune=false,SkipDryRunOnMissingResource=true',
+  },
+  DeploymentRuntimeConfig: {
+    'argocd.argoproj.io/sync-wave': '-90',
+    'argocd.argoproj.io/sync-options': 'SkipDryRunOnMissingResource=true',
+  },
+  Provider: {
+    'argocd.argoproj.io/sync-wave': '-80',
+    'argocd.argoproj.io/sync-options': 'SkipDryRunOnMissingResource=true',
+  },
+  CompositeResourceDefinition: {
+    'argocd.argoproj.io/sync-wave': '-70',
+    'argocd.argoproj.io/sync-options': 'SkipDryRunOnMissingResource=true',
+  },
+  Composition: {
+    'argocd.argoproj.io/sync-wave': '-60',
+    'argocd.argoproj.io/sync-options': 'SkipDryRunOnMissingResource=true',
+  },
+  ProviderConfig: {
+    'argocd.argoproj.io/sync-wave': '-50',
+    'argocd.argoproj.io/sync-options': 'SkipDryRunOnMissingResource=true',
+  },
+  Function: {
+    'argocd.argoproj.io/sync-wave': '-40',
+    'argocd.argoproj.io/sync-options': 'SkipDryRunOnMissingResource=true',
+  },
+};
+
+local addArgoWave(obj) =
+  local annotations = std.get(annotationMap, obj.kind, if std.objectHas(obj.metadata, 'annotations') then obj.metadata.annotations else null);
+  if std.type(obj) == 'object' then obj {
+    metadata+: {
+      [if std.type(annotations) != 'null' then 'annotations']+: annotations,
+    },
+  } else obj;
+
+com.fixupDir(std.extVar('output_path'), addArgoWave)

postprocess/add_argo_wave_crossplane.jsonnet

@@ -0,0 +1,13 @@
+local com = import 'lib/commodore.libjsonnet';
+local inv = com.inventory();
+
+local addArgoWave(obj) =
+  obj {
+    metadata+: {
+      annotations: {
+        'argocd.argoproj.io/sync-wave': '-100',
+      },
+    },
+  };
+
+com.fixupDir(std.extVar('output_path'), addArgoWave)

postprocess/patch_operator_deployment.jsonnet

@@ -7,7 +7,7 @@ local run_as_user = {
 };
 
 local fixup(obj) =
-  if obj.kind == 'Deployment' then
+  if std.type(obj) == 'object' && obj.kind == 'Deployment' then
     obj {
       spec+: {
         template+: {

tests/golden/apiserver/appcat/appcat/10_appcat_namespace.yaml

@@ -2,6 +2,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
   annotations:
+    argocd.argoproj.io/sync-wave: '-100'
     openshift.io/node-selector: node-role.kubernetes.io/infra=
   labels:
     name: syn-appcat

tests/golden/apiserver/appcat/appcat/10_clusterrole_finalizer.yaml

@@ -1,7 +1,8 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  annotations: {}
+  annotations:
+    argocd.argoproj.io/sync-wave: '-100'
   labels:
     rbac.crossplane.io/aggregate-to-crossplane: 'true'
   name: crossplane:appcat:finalizer

tests/golden/apiserver/appcat/appcat/10_clusterrole_services_read.yaml

@@ -1,7 +1,8 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  annotations: {}
+  annotations:
+    argocd.argoproj.io/sync-wave: '-100'
   labels:
     name: appcat-services-read
   name: appcat:services:read

tests/golden/apiserver/appcat/appcat/10_clusterrole_view.yaml

@@ -1,7 +1,8 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  annotations: {}
+  annotations:
+    argocd.argoproj.io/sync-wave: '-100'
   labels:
     rbac.authorization.k8s.io/aggregate-to-admin: 'true'
     rbac.authorization.k8s.io/aggregate-to-edit: 'true'

tests/golden/apiserver/appcat/appcat/10_function_appcat.yaml

@@ -1,6 +1,9 @@
 apiVersion: pkg.crossplane.io/v1beta1
 kind: Function
 metadata:
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+    argocd.argoproj.io/sync-wave: '-40'
   name: function-appcat
 spec:
   package: ghcr.io/vshn/appcat:v4.105.2-func

tests/golden/apiserver/appcat/appcat/10_function_patch_and_transform.yaml

@@ -1,6 +1,9 @@
 apiVersion: pkg.crossplane.io/v1beta1
 kind: Function
 metadata:
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+    argocd.argoproj.io/sync-wave: '-40'
   name: function-patch-and-transform
 spec:
   package: xpkg.upbound.io/crossplane-contrib/function-patch-and-transform:v0.1.4

tests/golden/apiserver/appcat/appcat/10_provider_sql.yaml

@@ -3,7 +3,7 @@ kind: Provider
 metadata:
   annotations:
     argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-    argocd.argoproj.io/sync-wave: '10'
+    argocd.argoproj.io/sync-wave: '-80'
   labels:
     name: provider-sql
   name: provider-sql
@@ -15,6 +15,9 @@ spec:
 apiVersion: pkg.crossplane.io/v1beta1
 kind: DeploymentRuntimeConfig
 metadata:
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+    argocd.argoproj.io/sync-wave: '-90'
   name: provider-sql
 spec:
   deploymentTemplate:
@@ -31,7 +34,8 @@ spec:
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  annotations: {}
+  annotations:
+    argocd.argoproj.io/sync-wave: '-100'
   labels:
     name: provider-sql
   name: provider-sql
@@ -40,7 +44,8 @@ metadata:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  annotations: {}
+  annotations:
+    argocd.argoproj.io/sync-wave: '-100'
   labels:
     name: crossplane-provider-provider-sql-system-custom
   name: crossplane:provider:provider-sql:system:custom
@@ -61,7 +66,8 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  annotations: {}
+  annotations:
+    argocd.argoproj.io/sync-wave: '-100'
   labels:
     name: crossplane-provider-provider-sql-system-custom
   name: crossplane:provider:provider-sql:system:custom

tests/golden/apiserver/appcat/appcat/10_runtimeconfig_function_appcat.yaml

@@ -1,6 +1,9 @@
 apiVersion: pkg.crossplane.io/v1beta1
 kind: DeploymentRuntimeConfig
 metadata:
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+    argocd.argoproj.io/sync-wave: '-90'
   name: function-appcat
 spec:
   deploymentTemplate:

tests/golden/apiserver/appcat/appcat/10_runtimeconfig_function_pnt.yaml

@@ -1,6 +1,9 @@
 apiVersion: pkg.crossplane.io/v1beta1
 kind: DeploymentRuntimeConfig
 metadata:
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+    argocd.argoproj.io/sync-wave: '-90'
   name: function-patch-and-transform
 spec:
   deploymentTemplate:

tests/golden/apiserver/appcat/appcat/20_serviceaccount_appcat.yaml

@@ -1,7 +1,8 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  annotations: {}
+  annotations:
+    argocd.argoproj.io/sync-wave: '-100'
   labels:
     name: function-appcat
   name: function-appcat

tests/golden/apiserver/appcat/appcat/20_serviceaccount_pnt.yaml

@@ -1,7 +1,8 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  annotations: {}
+  annotations:
+    argocd.argoproj.io/sync-wave: '-100'
   labels:
     name: function-patch-and-transform
   name: function-patch-and-transform

tests/golden/apiserver/appcat/appcat/apiserver/10_cluster_role_api_server.yaml

@@ -1,6 +1,8 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: '-100'
   name: appcat-apiserver
 rules:
   - apiGroups:

tests/golden/apiserver/appcat/appcat/apiserver/10_cluster_role_basic_users.yaml

@@ -1,7 +1,8 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  annotations: {}
+  annotations:
+    argocd.argoproj.io/sync-wave: '-100'
   labels:
     authorization.openshift.io/aggregate-to-basic-user: 'true'
     name: system-openshift4-aggregate-appcat-to-basic-user

tests/golden/apiserver/appcat/appcat/apiserver/10_cluster_role_binding.yaml

@@ -1,7 +1,8 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  annotations: {}
+  annotations:
+    argocd.argoproj.io/sync-wave: '-100'
   labels:
     name: appcat-apiserver
   name: appcat-apiserver

tests/golden/apiserver/appcat/appcat/apiserver/10_cluster_role_view.yaml

@@ -1,7 +1,8 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  annotations: {}
+  annotations:
+    argocd.argoproj.io/sync-wave: '-100'
   labels:
     name: appcat-api-view
     rbac.authorization.k8s.io/aggregate-to-view: 'true'