feat: Update application api

Dockerfile

@@ -4,7 +4,7 @@ ARG BASE_IMAGE=docker.io/library/ubuntu:22.04@sha256:9a0bdde4188b896a372804be238
 # Initial stage which pulls prepares build dependencies and CLI tooling we need for our final image
 # Also used as the image in CI jobs so needs all dependencies
 ####################################################################################################
-FROM docker.io/library/golang:1.19.6@sha256:7ce31d15a3a4dbf20446cccffa4020d3a2974ad2287d96123f55caf22c7adb71 AS builder
+FROM docker.io/library/golang:1.19.7@sha256:5d947843dde82ba1df5ac1b2ebb70b203d106f0423bf5183df3dc96f6bc5a705 AS builder
 
 RUN echo 'deb http://deb.debian.org/debian buster-backports main' >> /etc/apt/sources.list
 
@@ -101,7 +101,7 @@ RUN HOST_ARCH=$TARGETARCH NODE_ENV='production' NODE_ONLINE_ENV='online' NODE_OP
 ####################################################################################################
 # Argo CD Build stage which performs the actual build of Argo CD binaries
 ####################################################################################################
-FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.19.6@sha256:7ce31d15a3a4dbf20446cccffa4020d3a2974ad2287d96123f55caf22c7adb71 AS argocd-build
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.19.7@sha256:5d947843dde82ba1df5ac1b2ebb70b203d106f0423bf5183df3dc96f6bc5a705 AS argocd-build
 
 WORKDIR /go/src/github.com/argoproj/argo-cd
 

Procfile

@@ -1,6 +1,6 @@
 controller: [ "$BIN_MODE" = 'true' ] && COMMAND=./dist/argocd || COMMAND='go run ./cmd/main.go' && sh -c "FORCE_LOG_COLORS=1 ARGOCD_FAKE_IN_CLUSTER=true ARGOCD_TLS_DATA_PATH=${ARGOCD_TLS_DATA_PATH:-/tmp/argocd-local/tls} ARGOCD_SSH_DATA_PATH=${ARGOCD_SSH_DATA_PATH:-/tmp/argocd-local/ssh} ARGOCD_BINARY_NAME=argocd-application-controller $COMMAND --loglevel debug --redis localhost:${ARGOCD_E2E_REDIS_PORT:-6379} --repo-server localhost:${ARGOCD_E2E_REPOSERVER_PORT:-8081} --otlp-address=${ARGOCD_OTLP_ADDRESS} --application-namespaces=${ARGOCD_APPLICATION_NAMESPACES:-''}"
 api-server: [ "$BIN_MODE" = 'true' ] && COMMAND=./dist/argocd || COMMAND='go run ./cmd/main.go' && sh -c "FORCE_LOG_COLORS=1 ARGOCD_FAKE_IN_CLUSTER=true ARGOCD_TLS_DATA_PATH=${ARGOCD_TLS_DATA_PATH:-/tmp/argocd-local/tls} ARGOCD_SSH_DATA_PATH=${ARGOCD_SSH_DATA_PATH:-/tmp/argocd-local/ssh} ARGOCD_BINARY_NAME=argocd-server $COMMAND --loglevel debug --redis localhost:${ARGOCD_E2E_REDIS_PORT:-6379} --disable-auth=${ARGOCD_E2E_DISABLE_AUTH:-'true'} --insecure --dex-server http://localhost:${ARGOCD_E2E_DEX_PORT:-5556} --repo-server localhost:${ARGOCD_E2E_REPOSERVER_PORT:-8081} --port ${ARGOCD_E2E_APISERVER_PORT:-8080} --otlp-address=${ARGOCD_OTLP_ADDRESS} --application-namespaces=${ARGOCD_APPLICATION_NAMESPACES:-''}"
-dex: sh -c "ARGOCD_BINARY_NAME=argocd-dex go run github.com/argoproj/argo-cd/v2/cmd gendexcfg -o `pwd`/dist/dex.yaml && docker run --rm -p ${ARGOCD_E2E_DEX_PORT:-5556}:${ARGOCD_E2E_DEX_PORT:-5556} -v `pwd`/dist/dex.yaml:/dex.yaml ghcr.io/dexidp/dex:$(grep "image: ghcr.io/dexidp/dex" manifests/base/dex/argocd-dex-server-deployment.yaml | cut -d':' -f3) dex serve /dex.yaml"
+dex: sh -c "ARGOCD_BINARY_NAME=argocd-dex go run github.com/argoproj/argo-cd/v2/cmd gendexcfg -o `pwd`/dist/dex.yaml && (test -f dist/dex.yaml || { echo 'Failed to generate dex configuration'; exit 1; }) && docker run --rm -p ${ARGOCD_E2E_DEX_PORT:-5556}:${ARGOCD_E2E_DEX_PORT:-5556} -v `pwd`/dist/dex.yaml:/dex.yaml ghcr.io/dexidp/dex:$(grep "image: ghcr.io/dexidp/dex" manifests/base/dex/argocd-dex-server-deployment.yaml | cut -d':' -f3) dex serve /dex.yaml"
 redis: bash -c "if [ \"$ARGOCD_REDIS_LOCAL\" = 'true' ]; then redis-server --save '' --appendonly no --port ${ARGOCD_E2E_REDIS_PORT:-6379}; else docker run --rm --name argocd-redis -i -p ${ARGOCD_E2E_REDIS_PORT:-6379}:${ARGOCD_E2E_REDIS_PORT:-6379} redis:$(grep "image: redis" manifests/base/redis/argocd-redis-deployment.yaml | cut -d':' -f3) --save '' --appendonly no --port ${ARGOCD_E2E_REDIS_PORT:-6379}; fi"
 repo-server: [ "$BIN_MODE" = 'true' ] && COMMAND=./dist/argocd || COMMAND='go run ./cmd/main.go' && sh -c "FORCE_LOG_COLORS=1 ARGOCD_FAKE_IN_CLUSTER=true ARGOCD_GNUPGHOME=${ARGOCD_GNUPGHOME:-/tmp/argocd-local/gpg/keys} ARGOCD_PLUGINSOCKFILEPATH=${ARGOCD_PLUGINSOCKFILEPATH:-./test/cmp}  ARGOCD_GPG_DATA_PATH=${ARGOCD_GPG_DATA_PATH:-/tmp/argocd-local/gpg/source} ARGOCD_TLS_DATA_PATH=${ARGOCD_TLS_DATA_PATH:-/tmp/argocd-local/tls} ARGOCD_SSH_DATA_PATH=${ARGOCD_SSH_DATA_PATH:-/tmp/argocd-local/ssh} ARGOCD_BINARY_NAME=argocd-repo-server ARGOCD_GPG_ENABLED=${ARGOCD_GPG_ENABLED:-false} $COMMAND --loglevel debug --port ${ARGOCD_E2E_REPOSERVER_PORT:-8081} --redis localhost:${ARGOCD_E2E_REDIS_PORT:-6379} --otlp-address=${ARGOCD_OTLP_ADDRESS}"
 cmp-server: [ "$ARGOCD_E2E_TEST" = 'true' ] && exit 0 || [ "$BIN_MODE" = 'true' ] && COMMAND=./dist/argocd || COMMAND='go run ./cmd/main.go' && sh -c "FORCE_LOG_COLORS=1 ARGOCD_FAKE_IN_CLUSTER=true ARGOCD_BINARY_NAME=argocd-cmp-server ARGOCD_PLUGINSOCKFILEPATH=${ARGOCD_PLUGINSOCKFILEPATH:-./test/cmp} $COMMAND --config-dir-path ./test/cmp --loglevel debug --otlp-address=${ARGOCD_OTLP_ADDRESS}"

VERSION

@@ -1 +1 @@
-2.6.0
+2.8.0

assets/swagger.json

@@ -5535,6 +5535,23 @@
         }
       }
     },
+    "v1alpha1AllowTags": {
+      "type": "object",
+      "title": "AllowTags provides filtering options to express which tags should be considered as update candidates",
+      "properties": {
+        "matchList": {
+          "type": "array",
+          "title": "MatchList defines a list of regex/wildcard expressions that are used to filter tags",
+          "items": {
+            "type": "string"
+          }
+        },
+        "matchType": {
+          "type": "string",
+          "title": "MatchType defines the type of matchList entries"
+        }
+      }
+    },
     "v1alpha1AppProject": {
       "type": "object",
       "title": "AppProject provides a logical grouping of applications, providing controls for:\n* where the apps may deploy to (cluster whitelist)\n* what may be deployed (repository whitelist, resource whitelist/blacklist)\n* who can access these applications (roles, OIDC group claims bindings)\n* and what they can do (RBAC policies)\n* automation access to these roles (JWT tokens)\n+genclient\n+genclient:noStatus\n+k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object\n+kubebuilder:resource:path=appprojects,shortName=appproj;appprojs",
@@ -6303,6 +6320,9 @@
             "$ref": "#/definitions/v1alpha1ResourceIgnoreDifferences"
           }
         },
+        "image": {
+          "$ref": "#/definitions/v1alpha1Image"
+        },
         "info": {
           "type": "array",
           "title": "Info contains a list of information (URLs, email addresses, and plain text) that relates to the application",
@@ -6405,6 +6425,13 @@
             "type": "string"
           }
         },
+        "imageUpdates": {
+          "type": "array",
+          "title": "ImageUpdates holds the status information on image updates",
+          "items": {
+            "$ref": "#/definitions/v1alpha1ImageUpdate"
+          }
+        },
         "images": {
           "description": "Images holds all images of application child resources.",
           "type": "array",
@@ -6953,6 +6980,24 @@
         }
       }
     },
+    "v1alpha1HelmParameterConfig": {
+      "type": "object",
+      "title": "HelmParameterConfig holds the names of helm parameters that Image Updater should set with appropriate/updated values in `.spec.source.helm.parameters`",
+      "properties": {
+        "imageName": {
+          "type": "string",
+          "title": "helm parameter name for image name\n+optional"
+        },
+        "imageSpec": {
+          "type": "string",
+          "title": "helm parameter name for image spec\n+optional"
+        },
+        "imageTag": {
+          "type": "string",
+          "title": "helm parameter name for image tag\n+optional"
+        }
+      }
+    },
     "v1alpha1HostInfo": {
       "type": "object",
       "title": "HostInfo holds host name and resources metrics\nTODO: describe purpose of this type\nTODO: describe members of this type",
@@ -6992,6 +7037,97 @@
         }
       }
     },
+    "v1alpha1IgnoreTags": {
+      "type": "object",
+      "title": "IgnoreTags provides filtering options to express which tags should be ignored when looking for update candidates",
+      "properties": {
+        "matchList": {
+          "type": "array",
+          "title": "MatchList defines a list of regex/wildcard expressions that are used to filter tags",
+          "items": {
+            "type": "string"
+          }
+        },
+        "matchType": {
+          "type": "string",
+          "title": "MatchType defines the type of matchList entries"
+        }
+      }
+    },
+    "v1alpha1Image": {
+      "type": "object",
+      "title": "Image contains all the configuration that is related to the images deployed by a specific application",
+      "properties": {
+        "updates": {
+          "$ref": "#/definitions/v1alpha1Updates"
+        }
+      }
+    },
+    "v1alpha1ImageConfiguration": {
+      "type": "object",
+      "title": "ImageConfiguration contains image specific update configuration for a given image",
+      "properties": {
+        "allowTags": {
+          "$ref": "#/definitions/v1alpha1AllowTags"
+        },
+        "constraint": {
+          "type": "string",
+          "title": "Constraint holds semver constraints to be applied filtering through image tags\n+optional"
+        },
+        "credentials": {
+          "$ref": "#/definitions/v1alpha1PullCredentials"
+        },
+        "forceUpdate": {
+          "type": "boolean",
+          "title": "ForceUpdate determines if Image Updater should update images not exposed in Application status"
+        },
+        "helm": {
+          "$ref": "#/definitions/v1alpha1HelmParameterConfig"
+        },
+        "ignoreTags": {
+          "$ref": "#/definitions/v1alpha1IgnoreTags"
+        },
+        "image": {
+          "type": "string",
+          "title": "Image contains the fully qualified image name"
+        },
+        "imagePlatforms": {
+          "type": "array",
+          "title": "ImagePlatforms specifies a list of allowed architectures for a specific image",
+          "items": {
+            "type": "string"
+          }
+        },
+        "kustomize": {
+          "$ref": "#/definitions/v1alpha1KustomizeParameterConfig"
+        },
+        "updateStrategy": {
+          "type": "string",
+          "title": "UpdateStrategy determines how Image Updater will find new versions of an image to be updated\nDefault strategy is \"semver\"\n+optional"
+        }
+      }
+    },
+    "v1alpha1ImageUpdate": {
+      "type": "object",
+      "title": "ImageUpdate contains status information about the update operations that have been conducted against container images used by an application",
+      "properties": {
+        "image": {
+          "type": "string",
+          "title": "Image holds the reference to the image whose update status is being displayed"
+        },
+        "lastTransitionTime": {
+          "$ref": "#/definitions/v1Time"
+        },
+        "newTag": {
+          "type": "string",
+          "title": "NewTag represents the name of the updated tag"
+        },
+        "oldTag": {
+          "type": "string",
+          "title": "OldTag represents the name of the tag that was replaced"
+        }
+      }
+    },
     "v1alpha1Info": {
       "type": "object",
       "properties": {
@@ -7073,6 +7209,14 @@
         }
       }
     },
+    "v1alpha1KustomizationConfig": {
+      "type": "object",
+      "properties": {
+        "path": {
+          "type": "string"
+        }
+      }
+    },
     "v1alpha1KustomizeOptions": {
       "type": "object",
       "title": "KustomizeOptions are options for kustomize to use when building manifests",
@@ -7087,6 +7231,16 @@
         }
       }
     },
+    "v1alpha1KustomizeParameterConfig": {
+      "type": "object",
+      "title": "KustomizeParameterConfig holds the original image that Image Updater should override appropriate/updated values in `.spec.source.kustomize.images`",
+      "properties": {
+        "imageName": {
+          "type": "string",
+          "title": "Original image to be overridden through kustomize"
+        }
+      }
+    },
     "v1alpha1KustomizeReplica": {
       "type": "object",
       "properties": {
@@ -7331,6 +7485,28 @@
         }
       }
     },
+    "v1alpha1PullCredentials": {
+      "type": "object",
+      "properties": {
+        "credsExpire": {
+          "$ref": "#/definitions/v1Time"
+        },
+        "env": {
+          "type": "string",
+          "title": "References an environment variable for the secret\n+optional"
+        },
+        "ext": {
+          "type": "string",
+          "title": "References an external script mounted to the Image Updater controller to generate credentials\n+optional"
+        },
+        "pullSecret": {
+          "$ref": "#/definitions/v1alpha1PullSecret"
+        },
+        "secret": {
+          "$ref": "#/definitions/v1alpha1SecretRef"
+        }
+      }
+    },
     "v1alpha1PullRequestGenerator": {
       "description": "PullRequestGenerator defines a generator that scrapes a PullRequest API to find candidate pull requests.",
       "type": "object",
@@ -7479,6 +7655,17 @@
         }
       }
     },
+    "v1alpha1PullSecret": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "namespace": {
+          "type": "string"
+        }
+      }
+    },
     "v1alpha1RepoCreds": {
       "type": "object",
       "title": "RepoCreds holds the definition for repository credentials",
@@ -8351,6 +8538,20 @@
         }
       }
     },
+    "v1alpha1SecretReferece": {
+      "type": "object",
+      "properties": {
+        "field": {
+          "type": "string"
+        },
+        "name": {
+          "type": "string"
+        },
+        "namespace": {
+          "type": "string"
+        }
+      }
+    },
     "v1alpha1SignatureKey": {
       "type": "object",
       "title": "SignatureKey is the specification of a key required to verify commit signatures with",
@@ -8643,6 +8844,75 @@
         }
       }
     },
+    "v1alpha1Updates": {
+      "type": "object",
+      "title": "Updates contains configuration related to updating images",
+      "properties": {
+        "allowTags": {
+          "$ref": "#/definitions/v1alpha1AllowTags"
+        },
+        "credentials": {
+          "$ref": "#/definitions/v1alpha1PullCredentials"
+        },
+        "forceUpdate": {
+          "type": "boolean",
+          "title": "ForceUpdate determines if Image Updater should force update all application images"
+        },
+        "ignoreTags": {
+          "$ref": "#/definitions/v1alpha1IgnoreTags"
+        },
+        "imageList": {
+          "type": "array",
+          "title": "ImageList contains image specific configurations for each individual application image",
+          "items": {
+            "$ref": "#/definitions/v1alpha1ImageConfiguration"
+          }
+        },
+        "updateStrategy": {
+          "type": "string",
+          "title": "UpdateStrategy determines common strategy that Image Updater will use to find new versions of all application image to be updated\nDefault strategy is \"semver\"\n+optional"
+        },
+        "writeBackConfig": {
+          "$ref": "#/definitions/v1alpha1WriteBackConfig"
+        }
+      }
+    },
+    "v1alpha1WriteBackConfig": {
+      "type": "object",
+      "title": "WriteBackConfig holds configuration to write back image updates to source",
+      "properties": {
+        "baseBranch": {
+          "type": "string",
+          "title": "BaseBranch specifies the branch to checkout and commit to if different from revision tracked in application spec\n+optional"
+        },
+        "commitBranch": {
+          "type": "string",
+          "title": "CommitBranch specifies the branch to commit to if there is need for separate read/write branches. Supports templating\n+optional"
+        },
+        "kustomization": {
+          "$ref": "#/definitions/v1alpha1KustomizationConfig"
+        },
+        "method": {
+          "type": "string",
+          "title": "Method is the write back method to be used by Image Updater\nDefault method is \"argocd\"\n+optional"
+        },
+        "path": {
+          "type": "string",
+          "title": "Path is a directory path within the Git repository that would contain the target file to be written/updated if Application is configured with multiple sources\n+optional"
+        },
+        "repoURL": {
+          "type": "string",
+          "title": "RepoURL is the URL to the repository (Git or Helm) that should be commited back to if Application is configured with multiple sources\n+optional"
+        },
+        "secret": {
+          "$ref": "#/definitions/v1alpha1SecretReferece"
+        },
+        "target": {
+          "type": "string",
+          "title": "Target determins the target file Image Updater writes back to\nDefault target is \"default\"\n+optional"
+        }
+      }
+    },
     "versionVersionMessage": {
       "type": "object",
       "title": "VersionMessage represents version of the Argo CD API server",

docs/operator-manual/ingress.md

@@ -240,7 +240,7 @@ spec:
   tls:
   - hosts:
     - argocd.example.com
-    secretName: argocd-secret # do not change, this is provided by Argo CD
+    secretName: argocd-server-tls # as expected by argocd-server
 ```
 
 ### Option 2: Multiple Ingress Objects And Hosts

docs/user-guide/projects.md

@@ -321,7 +321,7 @@ stringData:
 
 All the examples above talk about Git repositories, but the same principles apply to clusters as well.
 
-With cluster-scoped clusters we can also restrict projects to only allow applications whose destinations belong to the 
+With project-scoped clusters we can also restrict projects to only allow applications whose destinations belong to the 
 same project. The default behavior allows for applications to be installed onto clusters which are not a part of the same 
 project, as the example below demonstrates: