Skip to content

Commit 9c7288a

Browse files
edjmaowerne2j
authored andcommitted
feat: Allow reading of ARGOCD_ENV prefixed variables for ArgoCD 2.4.0
1 parent 08bfa36 commit 9c7288a

File tree

4 files changed

+47
-0
lines changed

4 files changed

+47
-0
lines changed

docs/config.md

+17
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,23 @@ By default, the secret is assumed to be in the `argocd` namespace. However, the
2525

2626
<b>Note</b>: this requires the `argocd-repo-server` to have a service account token mounted in the standard location.
2727

28+
###### ArgoCD 2.4.0 Environment Variable Prefix
29+
30+
Starting with ArgoCD 2.4.0, environment variables passed into the `init` and `generate` steps are prefixed with `ARGOCD_ENV` to prevent users from setting potentially-sensitive environment variables. All environment variables defined here will be prepended with the new prefix, e.g. `ARGOCD_ENV_AVP_TYPE`. The configuration will honor both prefixed and non-prefixed environment variables, preferring the prefixed variable if both are presented. There are no changes needed to the secret.
31+
32+
```yaml
33+
apiVersion: v1
34+
stringData:
35+
# Will be renamed to ARGOCD_ENV_AVP_AUTH_TYPE by ArgoCD before reaching the plugin.
36+
AVP_AUTH_TYPE: vault
37+
kind: Secret
38+
metadata:
39+
name: vault-configuration
40+
namespace: argocd
41+
type: Opaque
42+
```
43+
44+
See the [ArgoCD Upgrade Guide](https://argo-cd.readthedocs.io/en/latest/operator-manual/upgrading/2.3-2.4/#update-plugins-to-use-newly-prefixed-environment-variables) for more information.
2845
##### Configuration File
2946

3047
The configuration can be given in a file reachable from the plugin, in any Viper supported format (YAML, JSON, etc.). The keys must match the same names used in the the Kubernetes secret:

pkg/config/config.go

+10
Original file line numberDiff line numberDiff line change
@@ -268,6 +268,16 @@ func readConfigOrSecret(secretName, configPath string, v *viper.Viper) error {
268268
}
269269
}
270270

271+
// Check for ArgoCD 2.4 prefixed environment variables
272+
for _, envVar := range os.Environ() {
273+
if strings.HasPrefix(envVar, types.EnvArgoCDPrefix) {
274+
envVarPair := strings.SplitN(envVar, "=", 2)
275+
key := strings.TrimPrefix(envVarPair[0], types.EnvArgoCDPrefix+"_")
276+
val := envVarPair[1]
277+
v.Set(key, val)
278+
}
279+
}
280+
271281
for k, viperValue := range v.AllSettings() {
272282
for _, prefix := range backendPrefixes {
273283
if strings.HasPrefix(k, prefix) {

pkg/config/config_test.go

+17
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,23 @@ fDGt+yaf3RaZbVwHSVLzxiXGsu1WQJde3uJeNh5c6z+5
166166
},
167167
"*backends.OnePasswordConnect",
168168
},
169+
{
170+
map[string]interface{}{
171+
"ARGOCD_ENV_AVP_TYPE": "vault",
172+
"ARGOCD_ENV_AVP_AUTH_TYPE": "github",
173+
"ARGOCD_ENV_AVP_GITHUB_TOKEN": "token",
174+
},
175+
"*backends.Vault",
176+
},
177+
{
178+
map[string]interface{}{
179+
"ARGOCD_ENV_AVP_TYPE": "vault",
180+
"AVP_TYPE": "not-valid-type",
181+
"ARGOCD_ENV_AVP_AUTH_TYPE": "github",
182+
"ARGOCD_ENV_AVP_GITHUB_TOKEN": "token",
183+
},
184+
"*backends.Vault",
185+
},
169186
}
170187
for _, tc := range testCases {
171188
for k, v := range tc.environment {

pkg/types/constants.go

+3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
package types
22

33
const (
4+
// Environment Variable Prefix
5+
EnvArgoCDPrefix = "ARGOCD_ENV"
6+
47
// Environment Variable Constants
58
EnvAvpType = "AVP_TYPE"
69
EnvAvpRoleID = "AVP_ROLE_ID"

0 commit comments

Comments
 (0)