README.md.gotmpl

## Codefresh gitops runtime
{{ template "chart.versionBadge" . }}{{ template "chart.typeBadge" . }}{{ template "chart.appVersionBadge" . }}

## Prerequisites

- Helm **3.11.0+**

## Get Chart Info

```console
helm show all oci://quay.io/codefresh/gitops-runtime
```
See [Use OCI-based registries](https://helm.sh/docs/topics/registries/)

## Codefresh official documentation:
Prior to running the installation please see the official documentation at: https://codefresh.io/docs/docs/installation/gitops/hybrid-gitops-helm-installation/

## Multi Runtime Installation
You can install multiple Codefresh GitOps Runtimes in the same cluster, as long as each Runtime is deployed in its own namespace and manages only the applications in that namespace.
To achieve this, configure your Runtimes to run in namespaced mode by setting `global.runtime.singleNamespace=true`. See the values.yaml example below:
```yaml
global:
  runtime:
    singleNamespace: true
sealed-secrets:
  enabled: false
argo-cd:
  createClusterRoles: false
  crds:
    install: false
  configs:
    params:
      application.namespaces: ''
argo-events:
  controller:
    rbac:
      namespaced: true
argo-workflows:
  crds:
    install: false
  singleNamespace: true
  createAggregateRoles: false
  controller:
    clusterWorkflowTemplates:
      enabled: false
  server:
    clusterWorkflowTemplates:
      enabled: false
argo-rollouts:
  enabled: false
tunnel-client:
  enabled: false
gitops-operator:
  crds:
    install: false
```

Note that for the first runtime in the cluster, you have to configure it to install the CRDs, with setting these values:
```yaml
global:
  runtime:
    isConfigurationRuntime: true
argo-cd:
  crds:
    install: true
argo-workflows:
  crds:
    install: true
argo-rollouts:
  installCRDs: true
gitops-operator:
  crds:
    install: true
```

> [!WARNING]
> If you want more than one runtime in your cluster, make sure that all of the runtimes in your cluster are configured with `global.runtime.singleNamespace=true`.
> If you already have a runtime installed in the cluster without this setting, multi runtime installation is not supported.


## Argo-workflows artifact and log storage
Codefresh provides a SaaS object storage based solution for Argo workflows logs storage. The chart deploys a configmap named `codefresh-workflows-log-store` with the repository configuration.
If you want to utilize the Codefresh SaaS solution for log storage for all workflows in the runtime please set the following values:

```yaml
argo-workflows:
  controller:
    workflowDefaults:
      spec:
        artifactRepositoryRef:
          configMap: codefresh-workflows-log-store
          key: codefresh-workflows-log-store
```


> [!WARNING]
> It's highly recommended to use your own artifact storage for data privacy reasons.
> Codefresh provided storage has a retention policy of 14 days and limitations on uploaded file sizes.
> Please refer to the official documentation for more details.


## Installation with External ArgoCD

If you want to use an existing ArgoCD installation, you can disable the built-in ArgoCD and configure the GitOps Runtime to use the external ArgoCD.
See the `values.yaml` example below:

```yaml
global:
  # -- Configuration for external ArgoCD
  # Should be used when `argo-cd.enabled` is set to false
  external-argo-cd:
    # -- ArgoCD server settings
    server:
      # -- Service name of the ArgoCD server
      svc: argocd
      # -- Port of the ArgoCD server
      port: 80
      # -- Set if Argo CD is running behind reverse proxy under subpath different from /
      # e.g.
      # rootpath: '/argocd'
      rootpath: ''
    redis:
      # -- Service name of the ArgoCD Redis
      svc: argocd-redis
      # -- Port of the ArgoCD Redis
      port: 6379
    repoServer:
      # -- Service name of the ArgoCD repo server
      svc: argocd-repo-server
      # -- Port of the ArgoCD repo server
      port: 8081

    # -- How GitOps Runtime should authenticate with ArgoCD
    auth:
      # -- Authentication type. Can be password or token
      type: password

      # If `auth.type=password` is set
      # -- ArgoCD username in plain text
      username: "admin"
      # -- ArgoCD password in plain text
      password: ""
      # -- ArgoCD password referenced by an existing secret
      passwordSecretKeyRef:
        name: argocd-initial-admin-secret
        key: password

      # If `auth.type=token` is set
      # -- ArgoCD token in plain text
      token: ""
      # -- ArgoCD token referenced by an existing secret
      tokenSecretKeyRef: {}
      # e.g:
      # tokenSecretKeyRef:
      #   name: argocd-token
      #   key: token

argo-cd:
  # -- Disable built-in ArgoCD
  enabled: false
```

⚠️ If `auth.type=password` is set, ArgoCd user must have `apiKey` capability enabled.

`argocd-cm` ConfigMap

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
  labels:
    app.kubernetes.io/name: argocd-cm
    app.kubernetes.io/part-of: argocd
data:
  accounts.admin: apiKey, login
  admin.enabled: "true"
```

## Installation with External Argo Rollouts

If you want to use an existing Argo Rollouts installation, you can disable the built-in Argo Rollouts and configure the GitOps Runtime to use the external Argo Rollouts.
See the `values.yaml` example below:

```yaml
global:
  # -- Configuration for external Argo Rollouts
  external-argo-rollouts:
    # -- Rollout reporter settings
    rollout-reporter:
      # -- Enable rollout reporter
      # Configuration is defined at .Values.event-reporters.rollout
      enabled: true

argo-rollouts:
  # -- Disable built-in Argo Rollouts
  enabled: false
```

## Using with private registries - Helper utility
The GitOps Runtime comprises multiple subcharts and container images. Subcharts also vary in values structure, making it difficult to override image specific values to use private registries.
We have created a helper utility to resolve this issue:
- The utility create values files in the correct structure, overriding the registry for each image. When installing the chart, you can then provide those values files to override all images.
- The utility also creates other files with data to help you identify and correctly mirror all the images.

#### Usage

The utility is packaged in a container image. Below are instructions on executing the utility using Docker:

```
docker run -v <output_dir>:/output quay.io/codefresh/gitops-runtime-private-registry-utils:{{ template "chart.version" . }} <local_registry>
```
`output_dir` - is a local directory where the utility will output files. <br>
`local_registry` - is your local registry where you want to mirror the images to

The utility will output 4 files into the folder:
1. `image-list.txt` - is the list of all images used in this version of the chart. Those are the images that you need to mirror.
2. `image-mirror.csv` - is a csv file with 2 fields - source_image and target_image. source_image is the image with the original registry and target_image is the image with the private registry. Can be used as an input file for a mirroring script.
3. `values-images-no-tags.yaml` - a values file with all image values with the private registry **excluding tags**. If provided through --values to helm install/upgrade command - it will override all images to use the private registry.
4. `values-images-with-tags.yaml` - The same as 3 but with tags **included**.


For usage with external ArgoCD run the utility with `EXTERNAL_ARGOCD` environment variable set to `true`.
```
docker run -e EXTERNAL_ARGOCD=true  -v <output_dir>:/output quay.io/codefresh/gitops-runtime-private-registry-utils:{{ template "chart.version" . }} <local_registry>
```


## Openshift

```yaml
internal-router:
  dnsService: dns-default
  dnsNamespace: openshift-dns
  clusterDomain: cluster.local

argo-cd:
  redis:
    securityContext:
      runAsUser: 1000680000 # Arbitrary user ID within allowed range

  openshift:
    enabled: true

argo-events:
  openshift: true

  webhook:
    port: 8443

sealed-secrets:
  podSecurityContext:
    enabled: false
  containerSecurityContext:
    enabled: false
```

## Upgrading

### To >=0.23.3

#### Manual fix in the ISC repository

If the ISC repository already contains the resources/app-projects/cf-runtime-app-project.yaml file it should be manually updated:
```yaml
...
spec:
  destinations:
  - namespace: '*'
    server: "*" # <-- replace 'https://kubernetes.default.svc' with "*" here
...
```

### To 0.23.x

####  Affected values

- `.Values.gitops-operator.image` map has been changed to include `registry` field. Please migrate the values git below:

```yaml
# before
gitops-operator:
  image:
    repository: quay.io/codefresh/codefresh-gitops-operator
    tag: vX.Y.Z

# after
gitops-operator:
  image:
    registry: quay.io
    repository: codefresh/codefresh-gitops-operator
    tag: vX.Y.Z
```

{{ template "chart.valuesSection" . }}