@@ -175,7 +175,7 @@ but a consistent method should be used, for example `<cluster-name>.<CA-ROOT-DOM
175175
176176Replace the ` <cluster-name> ` and ` <Organizational Unit> ` tokens to match your requirements:
177177
178- ```
178+ ``` yaml
179179apiVersion : cert-manager.io/v1
180180kind : Certificate
181181metadata :
@@ -199,7 +199,7 @@ but need to transpose it into the cluster secret.
199199
200200Extract the fields we need into environment variables:
201201
202- ```
202+ ` ` ` bash
203203export PRINCIPAL_AGENT_CA=$(kubectl get secret <cluster-name>-principal -o jsonpath='{.data.ca\.crt}')
204204export PRINCIPAL_AGENT_TLS=$(kubectl get secret <cluster-name>-principal -o jsonpath='{.data.tls\.crt}')
205205export PRINCIPAL_AGENT_KEY=$(kubectl get secret <cluster-name>-principal -o jsonpath='{.data.tls\.key}')
@@ -208,7 +208,7 @@ export PRINCIPAL_AGENT_KEY=$(kubectl get secret <cluster-name>-principal -o json
208208To create the ` <cluster-name>-cluster ` secret that is needed we must first create the ` config ` block
209209with the certs:
210210
211- ```
211+ ``` bash
212212cat << EOF > config
213213{
214214 "tlsClientConfig": {
223223
224224Now create the secret:
225225
226- ```
226+ ``` bash
227227kubectl create secret generic < cluster-name> -cluster -n argocd --from-literal=name=< cluster-name> --from-literal=server=https://argocd-agent-resource-proxy:9090? agentName=< cluster-name> --from-file=config=./config
228228```
229229!!! note "Add unique query parameter to server"
@@ -233,7 +233,7 @@ kubectl create secret generic <cluster-name>-cluster -n argocd --from-literal=na
233233 as shown in this example.
234234
235235Then label the secret as a cluster secret and include the label to identify the matching agent:
236- ```
236+ ``` bash
237237kubectl label secret < cluster-name> -cluster argocd.argoproj.io/secret-type=cluster
238238kubectl label secret < cluster-name> -cluster argocd-agent.argoproj-labs.io/agent-name=< cluster-name>
239239```
@@ -250,7 +250,7 @@ be minted on the Principal where the Issuer is available and then moved to the A
250250 the Agents will at times run in less secure locations/networks then the Principle so isolating
251251 the CA to one location, the principal, is beneficial.
252252
253- ```
253+ ``` yaml
254254apiVersion : cert-manager.io/v1
255255kind : Certificate
256256metadata :
@@ -271,7 +271,7 @@ spec:
271271
272272Output the secret to a file as we need to install it on the cluster where the Agent resides:
273273
274- ```
274+ ` ` ` bash
275275kubectl get secret <cluster-name>-agent -o yaml -n argocd | kubectl neat > <cluster-name>-agent.yaml
276276```
277277
@@ -285,21 +285,21 @@ the security reasons discussed earlier.
285285!!! note "Using yq"
286286 The command ` yq ` is used to modify the secret, if ` yq ` is not available simply edit the secret as needed.
287287
288- ```
288+ ``` bash
289289kubectl get secret argocd-agent-ca -o yaml -n argocd | yq ' del(.data.["tls.key"])' -y | oc neat > argocd-agent-ca.yaml
290290```
291291
292292Change the secret type to ` Opaque ` since a Kubernetes TLS secret requires a key, additionally change the name of the exported secret from ` <cluster-name>-agent ` to
293293to ` argocd-agent-client-tls ` .
294294
295- ```
296- yq -i '.type = "Opaque"' ./ argocd-agent-ca.yaml -y
295+ ``` bash
296+ yq -i ' .type = "Opaque"' argocd-agent-ca.yaml -y
297297yq -i ' .metadata.name = "argocd-agent-client-tls"' < path-to-secret> /< cluster-name> -agent.yaml -y
298298```
299299
300300On the Agent cluster apply the two secrets:
301301
302- ```
302+ ``` bash
303303kubectl apply -f ./argocd-agent-ca.yaml
304304kubectl apply -f < cluster-name> -agent.yaml
305305```
0 commit comments