ArgoCD Installation

If you’re using ArgoCD to manage your Kubernetes resources, you may want to install SUSE Security Admission Controller using ArgoCD. This is possible, but there are certain considerations. Since Admission Controller v1.17.0, the cert-manager dependency is removed. There is a new certificate reconciler that automatically renews the certificates. This means that the Admission Controller controller takes care of creating and renewing the certificates for you. This includes both the root CA and all webhook certificates.

The initial root CA and webhook certificate creation is during the Helm chart installation using the available Helm functions. So, during Helm chart rendering, the installation checks if the certificates are already created, and if not, it creates them.

This poses a problem when using ArgoCD, as it uses Helm solely to render the templates, with all resource lifecycle management by ArgoCD. Whenever ArgoCD renders the Helm chart to check that the cluster application doesn’t deviate from the chart definition, it attempts certificate creation again. As a result, it marks the secrets that store the certificates and the webhook configuration as unsynchronized.

To resolve this issue, it’s necessary to configure the ArgoCD application to ignore:

  • the data field in secrets

  • the caBundle field in the MutatingWebhookConfiguration

  • ValidatingWebhookConfiguration resources.

The Admission Controller Helm chart and its container images are distributed through the SUSE Application Collection. Before you create the ArgoCD application, give ArgoCD access to the Application Collection OCI Helm repository, and create the image pull secret in the namespace where you deploy Admission Controller:

kubectl apply -f - <<EOF
apiVersion: v1
kind: Secret
metadata:
  name: application-collection-repo
  namespace: argocd
  labels:
    argocd.argoproj.io/secret-type: repository
stringData:
  type: helm
  name: application-collection
  url: dp.apps.rancher.io/charts
  enableOCI: "true"
  username: <your-username>
  password: <your-token>
EOF

kubectl create namespace suse-sec-adm-controller

kubectl create secret docker-registry application-collection \
  --namespace suse-sec-adm-controller \
  --docker-server=dp.apps.rancher.io \
  --docker-username=<your-username> \
  --docker-password=<your-token>

Then, create the ArgoCD application with the ignoreDifferences field:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: suse-sec-adm-controller
  namespace: argocd
spec:
  project: default
  source:
    repoURL: dp.apps.rancher.io/charts
    chart: suse-security-admission-controller
    targetRevision: 1.1.0
    helm:
      valuesObject:
        global:
          imagePullSecrets:
            - application-collection
  destination:
    server: https://kubernetes.default.svc
    namespace: suse-sec-adm-controller
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:     # Sync options which modifies sync behavior
      # When syncing changes, respect fields ignored by the ignoreDifferences configuration
      - RespectIgnoreDifferences=true
  # ignoreDifferences is the important configuration to avoid ArgoCD marking
  # the secrets and # webhook configurations as unsynchronized
  ignoreDifferences:
  - group: ""
    kind: "Secret"
    name: kubewarden-ca
    namespace: suse-sec-adm-controller
    jsonPointers:
      - /data
  - group: ""
    kind: "Secret"
    name: kubewarden-webhook-server-cert
    namespace: suse-sec-adm-controller
    jsonPointers:
      - /data
  - group: ""
    kind: "Secret"
    name: kubewarden-audit-scanner-client-cert
    namespace: suse-sec-adm-controller
    jsonPointers:
      - /data
  - group: "admissionregistration.k8s.io"
    kind: "MutatingWebhookConfiguration"
    jqPathExpressions:
      - '.webhooks[]?.clientConfig.caBundle'
  - group: "admissionregistration.k8s.io"
    kind: "ValidatingWebhookConfiguration"
    jqPathExpressions:
      - '.webhooks[]?.clientConfig.caBundle'

In the example, the key aspect is the ignoreDifferences configuration for the Admission Controller controller application. The rest of the content provides context on how to configure the ArgoCD application and to provide a complete example.