Add tls cert mount appset controller

[ishitasequeira]

What type of PR is this?
/kind enhancement

What does this PR do / why we need it:
ArgoCD recently added support for custom TLS certificates for ApplicationSet Gitlab SCM Providers. ApplicationSetController added a new option --scm-root-ca-path and expects the certificate to be mounted on the path specified. As part of this PR, we added a new parameter to spec.applicationSet.scmRootCaPath to ArgoCD spec which takes the data from a hard-coded configMap named argocd-appset-gitlab-scm-tls-certs-cm containing the certificate and volume mounts it on the applicationset-controller pods on the path specified in spec.applicationSet.scmRootCaPath. The PR also adds a watcher on the the configMap to reconcile ArgoCD for any changes to the ConfigMap.

Have you updated the necessary documentation?

• Documentation update is required by this PR.
• Documentation has been updated.

Which issue(s) this PR fixes:

Fixes GITOPS-3107

How to test changes / Special notes to the reviewer:

1. Start the argocd-operator using make install run
2. Create a configMap named argocd-appset-gitlab-scm-tls-certs-cm with TLS cert details.
3. Create the ArgoCD instance with below configuration in the same namespace as the configMap.

apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
  name: argocd
  namespace: test-1-32-appsets-scm-tls-mount
spec:
  applicationSet:
    scmRootCaPath: <path_of_the_cert_for_volume_mount>

4. Describe the applicationset controller pod to see if the volume and volume mount is present or not.

[anandf]

Any specific reason for going with config map and not a secret ?

[ishitasequeira]

No specific reason, followed what we have used for TLS certs.

[anandf]

Correct name to SCMRootCAPath

[anandf]

Can user provide any path to mount the CM volumen ? Are there any restrictions on what this path can be ? Like should be under /app/tls ?

[ishitasequeira]

User can provide any path to mount the CM volume as long as controller has access to write to that path.

[anandf]

If a user, who might not the directory structure of the AppSet controller container, provide an invalid directory, then there would be errors. If say using a restricted path like /cert or /etc/tls/cert needing root access are provided, then it would result in unexpected errors.

[ishitasequeira]

I updated to use /app/tls/scm/cert as the path. I also took ConfigMap Name as the input from users, not restricting them to a specific ConfigMap.

[anandf]

Why should we get the CA mount path from the user, if the operator is going to mount it from a well defined CM.
Alternatively, Can the operator create an empty config map argocd-appset-gitlab-scm-tls-certs-cm and mount it in a well defined path like /app/tls/cert and if at all the user wants to use this feature, all he has to do is to fill Certificate data in config map argocd-appset-gitlab-scm-tls-certs-cm. With this approach, it would be easy for the operator to manage the Volume and VolumeMounts as its no longer conditonal. Since the mount path is well defined, there won't be any path restrictions that user has to be aware of when providing the value for scmRootCAPath.

[anandf]

The alternate approach, would be similar to how TLS certs are handled in ArgoCD Server.

oc get deploy -n openshift-gitops openshift-gitops-server -o yaml
....
- mountPath: /app/config/tls
          name: tls-certs
....
volumes:
      - configMap:
          defaultMode: 420
          name: argocd-tls-certs-cm
        name: tls-certs

oc get cm -n openshift-gitops argocd-tls-certs-cm -o yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-tls-certs-cm
  namespace: openshift-gitops

[ishitasequeira]

We would not want to create an empty CM as the requests for Gitlab client would use these certs only if the parameter --scm-root-ca-path is set on the ApplicationController pod. And, we would want to set this path only if user has provided the ConfigMap.

I do like the thought of hard-coding the path of the cert, but I am wondering if there would be any use case where user would want to specify the path. I am open to hard-coding the path for volume mount.

[anandf]

In that case can we check for the existence of a config map with name argocd-appset-gitlab-scm-tls-certs-cm or with a label selector and if it exists, then create a volume and mount it using a volumemount at well defined hardcoded path.

[ishitasequeira]

Yes, we can do that. I will update the code. Do you have a path in mind?

[anandf]

The one you had suggested in the example, /app/tls/cert looks good to me. If we want to give some kind of user configurable option, to explicitly enable this feature, then we can consider taking in the config map name in the ArgoCD spec and keep the mount path hard coded to /app/tls/cert

[ishitasequeira]

I updated to use /app/tls/scm/cert as the path. I also took ConfigMap Name as the input from users, not restricting them to a specific ConfigMap.

[anandf]

/lgtm
/approve