#
#  Author: Hari Sekhon
#  Date: 2021-06-10 18:52:21 +0100 (Thu, 10 Jun 2021)
#
#  vim:ts=2:sts=2:sw=2:et
#
#  https://github.com/HariSekhon/Kubernetes-configs
#
#  License: see accompanying Hari Sekhon LICENSE file
#
#  If you're using my code you're welcome to connect with me on LinkedIn and optionally send me feedback to help steer this or other code I publish
#
#  https://www.linkedin.com/in/HariSekhon
#

# ============================================================================ #
#            A r g o C D   S e t t i n g s   C o n f i g   P a t c h
# ============================================================================ #

# https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#repositories

# Patch to configure ArgoCD settings configmap
#
# Download argocd CLI:
#
#   curl -sSL https://raw.githubusercontent.com/HariSekhon/DevOps-Bash-tools/master/setup/install_argocd.sh | bash
#
# Validate:
#
#   argocd admin settings validate --argocd-cm-path ./argocd-cm.repos.patch.yaml
#
# Apply:
#
#   run: kubectl patch configmap argocd-cm --namespace argocd --patch "$(cat argocd-cm.repos.patch.yaml)"
#

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  # defining namespace leads to this error in Kustomize 3.1.0 and 4.1.3:
  #
  #   Error: no matches for Id ~G_v1_ConfigMap|argocd|argocd-cm; failed to find unique target for patch ~G_v1_ConfigMap|argocd-cm
  #
  # After much testing this is because the upstream ArgoCD base manifests for 2.0.3 defined in argocd-kustomization.yaml come without namespaces specified, and the namespace override in kustomization happens after this patching which is too late
  #
  #namespace: argocd  # breaks kustomize patching of argocd base
  labels:
    app.kubernetes.io/name: argocd-cm
    app.kubernetes.io/part-of: argocd  # necessary for configmap to be picked up my ArgoCD
data:
  # ===========
  # https://argoproj.github.io/argo-cd/operator-manual/declarative-setup/#repositories
  repositories: |
    # XXX: Edit all fields below
    - url: https://github.com/ORG/REPO.git  # keep .git suffix for GitLab, otherwise it'll 301 redirect which ArgoCD doesn't follow
      #passwordSecret:
      #  name: my-secret
      #  key: password
      #usernameSecret:
      #  name: my-secret
      #  key: username

    - url: git@github.com:ORG/REPO
      #sshPrivateKeySecret:  # XXX: use Shared Credential SSH Key between the repos instead, see further down
      #  name: my-secret
      #  key: sshPrivateKey

    # for local GitHub Enterprise
    - url: https://github.mycompany.internal/ORG/REPO
      #githubAppID: 1
      #githubAppInstallationID: 2
      #githubAppEnterpriseBaseUrl: https://github.mycompany.internal/api/v3
      #githubAppPrivateKeySecret:
      #  name: my-secret
      #  key: githubAppPrivateKey

    # ===========
    # Helm repos:
    - type: helm
      url: https://storage.googleapis.com/istio-prerelease/daily-build/master-latest-daily/charts
      name: istio.io
    - type: helm
      url: https://argoproj.github.io/argo-helm
      name: argo
      usernameSecret:
        name: my-secret
        key: username
      passwordSecret:
        name: my-secret
        key: password
      caSecret:
        name: my-secret
        key: ca
      certSecret:
        name: my-secret
        key: cert
      keySecret:
        name: my-secret
        key: key

    # ==================
    # Shared Credentials between repositories
    #
    #     https://argoproj.github.io/argo-cd/operator-manual/declarative-setup/#repository-credentials
    #
    # will only work for repos above where no creds are specified at all for them
    # longest (most specific) match wins, order not important in 1.4+
  repository.credentials: |
    - url: https://github.com/ORG  # for all repos with this prefix url (including https protocol)
      passwordSecret:
        name: my-secret
        key: password
      usernameSecret:
        name: my-secret
        key: username
      # OR
      githubAppID: 1
      githubAppInstallationID: 2
      githubAppEnterpriseBaseUrl: https://github.mycompany.internal/api/v3
      githubAppPrivateKeySecret:
        name: my-secret
        key: githubAppPrivateKey

    - url: git@github.com:ORG  # for all repos with this prefix url
      # XXX: GitHub.com security changes mean this SSH key must be generated without RSA due to avoid error 'You're using an RSA key with SHA-1, which is no longer allowed. Please use a newer client or a different key type.'
      #      eg. ssh-keygen -t ed25519 -f ~/.ssh/argocd-ed25519
      sshPrivateKeySecret:
        name: github-ssh-key  # kubectl create secret generic github-ssh-key -n argocd --from-file=private-key=$HOME/.ssh/github_key
        key: private-key

  # ===================
  # Add SSH public keys for git repo hosts here if necessary
  #
  # use your ~/.ssh/known_hosts or good old 'ssh-keyscan' to get these
  #
  #     https://argoproj.github.io/argo-cd/operator-manual/declarative-setup/#ssh-known-host-public-keys
  #
  #ssh_known_hosts: |
  #  bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/VqLat/MaB33pZy0y3rJZtnqwR2qOOvbwKZYKiEO1O6VqNEBxKvJJelCq0dTXWT5pbO2gDXC6h6QDXCaHo6pOHGPUy+YBaGQRGuSusMEASYiWunYN0vCAI8QaXnWMXNMdFP3jHAJH0eDsoiGnLPBlBp4TNm6rYI74nMzgz3B9IikW4WVK+dc8KZJZWYjAuORU3jc1c/NPskD2ASinf8v3xnfXeukU0sJ5N6m5E8VLjObPEO+mN2t/FZTMZLiFqPWc/ALSqnMnnhwrNi2rbfg/rd/IpL8Le3pSBne8+seeFVBoGqzHM9yXw==
  #  github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
  #  gitlab.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFSMqzJeV9rUzU4kWitGjeR4PWSa29SPqJ1fVkhtj3Hw9xjLVXVYrU9QlYWrOLXBpQ6KWjbjTDTdDkoohFzgbEY=
  #  gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf
  #  gitlab.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bNKTBSpIYDEGk9KxsGh3mySTRgMtXL583qmBpzeQ+jqCMRgBqB98u3z++J1sKlXHWfM9dyhSevkMwSbhoR8XIq/U0tCNyokEi/ueaBMCvbcTHhO7FcwzY92WK4Yt0aGROY5qX2UKSeOvuP4D6TPqKF1onrSzH9bx9XUf2lEdWT/ia1NEKjunUqu1xOB/StKDHMoX4/OKyIzuS0q/T1zOATthvasJFoPrAjkohTyaDUz2LN5JoH839hViyEG82yB+MjcFV5MU3N1l1QL3cVUCh93xSaua1N85qivl+siMkPGbO5xR/En4iEY6K2XPASUEMaieWVNTRCtJ4S8H+9
  #  ssh.dev.azure.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H
  #  vs-ssh.visualstudio.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H
