refactor: reorg resources to improve argocd sync speed

Signed-off-by: Bowen Sun <[email protected]>

Author: nusnewob

packages/argo-cd/manifests/kustomization.yaml

@@ -7,4 +7,3 @@ resources:
   - hub-cluster-secret.yaml
   - appproject-cnoe.yaml
   - appproject-demo.yaml
-  - auth-token.yaml

packages/argo-workflows/manifests/external-secrets.yaml

@@ -3,6 +3,8 @@ kind: ExternalSecret
 metadata:
   annotations:
     argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-delete-policy: HookFailed
   name: keycloak-oidc
   namespace: argo
 spec:

packages/argo-workflows/values.yaml

@@ -26,6 +26,13 @@ server:
       - groups
     rbac:
       enabled: true
+  volumes:
+    - name: secret-dependency
+      secret:
+        secretName: keycloak-oidc
+  volumeMounts: # explicit declaring dependency on external secret
+    - name: secret-dependency
+      mountPath: /do-not-use
   extraArgs:
     - --auth-mode=client
     - --auth-mode=sso # Required for sso configuration

packages/argo-cd/manifests/auth-token.yaml renamed to packages/backstage/manifests/argocd-auth-token.yaml

@@ -3,8 +3,6 @@ kind: Job
 metadata:
   name: auth-token
   namespace: argocd
-  annotations:
-    argocd.argoproj.io/hook: PostSync
 spec:
   template:
     metadata:

packages/backstage/manifests/external-secrets.yaml

@@ -3,6 +3,8 @@ kind: ExternalSecret
 metadata:
   annotations:
     argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-delete-policy: HookFailed
   name: keycloak-oidc
   namespace: backstage
 spec:
@@ -135,6 +137,8 @@ kind: ExternalSecret
 metadata:
   annotations:
     argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-delete-policy: HookFailed
   name: integrations
   namespace: backstage
 spec:

packages/backstage/manifests/kustomization.yaml

@@ -5,3 +5,4 @@ kind: Kustomization
 resources:
   - external-secrets.yaml
   - k8s-config-secret.yaml
+  - argocd-auth-token.yaml

packages/bootstrap/bootstrap-addons.yaml

@@ -222,6 +222,9 @@ external-secrets:
                 secretKey: config.json
                 remoteRef:
                   remoteKey: config
+  additionalResources:
+    - manifestPath: ../bootstrap/manifests/external-secrets
+      type: manifests
 
 crossplane:
   enabled: true

packages/bootstrap/manifests/argocd/kustomization.yaml

@@ -3,6 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - cnoe-local.yaml
-  - cnoe-cluster.yaml
   - appproject.yaml

packages/bootstrap/manifests/argocd/cnoe-cluster.yaml renamed to packages/bootstrap/manifests/external-secrets/cnoe-cluster.yaml

@@ -3,7 +3,6 @@ kind: ClusterSecretStore
 metadata:
   annotations:
     argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-    argocd.argoproj.io/sync-wave: "1"
   name: cnoe-kubeconfig
 spec:
   provider:
@@ -27,6 +26,7 @@ metadata:
   annotations:
     argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
   name: cnoe-kubeconfig
+  namespace: argocd
 spec:
   refreshInterval: 1m
   secretStoreRef:

packages/bootstrap/manifests/argocd/cnoe-local.yaml renamed to packages/bootstrap/manifests/external-secrets/cnoe-local.yaml

@@ -4,6 +4,7 @@ metadata:
   annotations:
     argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
   name: cnoe-local
+  namespace: argocd
 spec:
   refreshInterval: 1m
   secretStoreRef: