DEVOCEAN

kubectl create namespace devops-argocd

kubectl apply -n devops-argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: argocd-ingress
  namespace: devops-argocd
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prd
    ingress.kubernetes.io/force-ssl-redirect: "true"
    kubernetes.io/tls-acme: "true"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
spec:
  ingressClassName: nginx
  rules:
    - host: argocd.<<< YOUR_DOMAIN >>>
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: argocd-server
                port:
                  number: 443
  tls:
    - hosts:
        - argocd.<<< YOUR_DOMAIN >>>
      secretName: argocd-acme-crt

kubectl apply -f ingress.yaml

kubectl get ing -n devops-argocd
NAME                        CLASS    HOSTS                  ADDRESS   PORTS     AGE
argocd-ingress              nginx    argocd.<<< YOUR_DOMAIN >>>             80, 443   11s
cm-acme-http-solver-x879f   <none>   argocd.<<< YOUR_DOMAIN >>>             80        8s

yq e '.metadata.annotations."cert-manager.io/cluster-issuer"="letsencrypt-prd"' ingress.yaml --inplace
kubectl apply -f ingress.yaml

kubectl get ing -n devops-argocd
NAME             CLASS   HOSTS                  ADDRESS                                                                        PORTS     AGE
argocd-ingress   nginx   argocd.<<< YOUR_DOMAIN >>>   a9af0f1f2a24d48979b3a6f9a3cdd8e8-1458433199.ap-northeast-2.elb.amazonaws.com   80, 443   3m39s

echo -n 'pRVYem4wAJFnVd4PAyTwAEr7ph3IYtjl' | base64
cFJWWWVtNHdBSkZuVmQ0UEF5VHdBRXI3cGgzSVl0amw=

kubectl edit secret argocd-secret -n devops-argocd
apiVersion: v1
data:
  admin.password: JDJhJDEwJG5VNC2uYjZUZ1hwc9ByempzMXRKZHV2VHBNVHpBeUY4OFdUMHNnL2o0b4QxYkF1MVZJa4VP
  admin.passwordMtime: MjAyYC0xMi0yKFQwMjowTKo0TFo=
  oidc.keycloak.clientSecret: <<< CLIENT_SECRET (base64) >>>
  server.secretkey: cTVpU2k2b0lJSHNyNlc1Qzl2SUgzV5BQZXNSOEU9b1NncFhoa3NNa0RSST0=
  ....

kubectl edit configmap argocd-cm -n devops-argocd
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
data:
  url: https://argocd.<<< YOUR_DOMAIN >>>
  oidc.config: |
    name: Keycloak
    issuer: https://keycloak.<<< YOUR_DOMAIN >>>/realms/quickstart
    clientID: argocd
    clientSecret: $oidc.keycloak.clientSecret
    requestedScopes: ["openid", "profile", "email", "groups"]

kubectl edit configmap argocd-rbac-cm -n devops-argocd

apiVersion: v1
kind: ConfigMap
data:
  policy.csv: |
    g, ArgoCDAdmins, role:admin
...

kubectl rollout restart deployment argocd-server -n devops-argocd

....
app.get('/logout', (req, res) => {
  const keycloakLogoutUrl = `${keycloakConfig['auth-server-url']}/realms/${keycloakConfig.realm}/protocol/openid-connect/logout`;
  req.logout();
  req.redirect(keycloakLogoutUrl = `?rediret_uri=${encodeURIComponent('http://<<< SERVER_HOST >>>:<<< SERVER_PORT >>>')}`);
});
....