Skip to content

Commit 5b6d592

Browse files
dcasatidcasati
authored
Merge branch 'main' into act-3
2 parents fb02bb2 + 857fccf commit 5b6d592

10 files changed

Lines changed: 545 additions & 0 deletions

‎.github/argocd/SETUP.md‎

Lines changed: 231 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,231 @@
1+
# ArgoCD GitHub Issue Creation Setup Guide
2+
3+
This guide sets up automatic GitHub issue creation when ArgoCD deployments fail.
4+
5+
## Architecture
6+
7+
```
8+
ArgoCD Deployment Failure → ArgoCD Notifications → GitHub Repository Dispatch → GitHub Actions → Create Issue
9+
```
10+
11+
## Files Created
12+
13+
1. `.github/argocd/argocd-notifications-config.yaml` - ArgoCD notification configuration
14+
2. `.github/workflows/argocd-deployment-failure.yml` - GitHub Actions workflow
15+
16+
## Setup Steps
17+
18+
### 1. Create a GitHub Personal Access Token
19+
20+
1. Go to https://github.com/settings/tokens?type=beta
21+
2. Click "Generate new token" → "Fine-grained personal access token"
22+
3. Configure:
23+
- **Name:** `ArgoCD Notifications`
24+
- **Repository access:** Select your target repository
25+
- **Permissions:**
26+
- Repository permissions → Contents: Read-only
27+
- Repository permissions → Metadata: Read-only (automatically selected)
28+
- Repository permissions → Actions: Read and write (for repository_dispatch)
29+
- Repository permissions → Issues: Read and write
30+
4. Click "Generate token" and copy it (starts with `github_pat_...`)
31+
32+
### 2. Add Secrets to Kubernetes
33+
34+
```bash
35+
# Add your GitHub token to ArgoCD notifications
36+
kubectl patch secret argocd-notifications-secret -n argocd -p='{"stringData":{"github-token":"YOUR_GITHUB_TOKEN_HERE"}}'
37+
```
38+
39+
### 3. Configure Cluster Name Context
40+
41+
Set the cluster name that will be included in notifications:
42+
43+
```bash
44+
# Get current cluster context name
45+
CLUSTER_NAME=$(kubectl config current-context)
46+
47+
# Add the context to the ConfigMap
48+
kubectl patch configmap argocd-notifications-cm -n argocd --type=merge -p "{\"data\":{\"context\":\"clusterName: ${CLUSTER_NAME}\n\"}}"
49+
```
50+
51+
The cluster name will be accessible in notification templates as `{{.context.clusterName}}`.
52+
53+
### 4. Set Environment Variables in Config
54+
55+
Configure the webhook service and notification template:
56+
57+
```bash
58+
# Replace with your values
59+
export GITHUB_OWNER="your-github-username-or-org"
60+
export GITHUB_REPO="your-repo-name"
61+
62+
# Add the GitHub webhook service configuration
63+
kubectl patch configmap argocd-notifications-cm -n argocd --type=merge -p "{\"data\":{\"service.webhook.github-webhook\":\"url: https://api.github.com/repos/${GITHUB_OWNER}/${GITHUB_REPO}/dispatches\nheaders:\n- name: Accept\n value: application/vnd.github+json\n- name: Authorization\n value: Bearer \\\$github-token\n- name: X-GitHub-Api-Version\n value: \\\"2022-11-28\\\"\n- name: Content-Type\n value: application/json\n\"}}"
64+
65+
# Add the webhook template (note: use single file method below if patch causes issues)
66+
```
67+
68+
**Alternative: Apply complete configuration from file**
69+
70+
If you encounter template parsing errors with patches, create and apply a complete configuration file:
71+
72+
```bash
73+
# Create the complete ConfigMap file
74+
cat <<'EOF' > /tmp/argocd-notifications-cm.yaml
75+
apiVersion: v1
76+
kind: ConfigMap
77+
metadata:
78+
name: argocd-notifications-cm
79+
namespace: argocd
80+
data:
81+
context: |
82+
clusterName: YOUR_CLUSTER_NAME
83+
service.webhook.github-webhook: |
84+
url: https://api.github.com/repos/YOUR_OWNER/YOUR_REPO/dispatches
85+
headers:
86+
- name: Accept
87+
value: application/vnd.github+json
88+
- name: Authorization
89+
value: Bearer $github-token
90+
- name: X-GitHub-Api-Version
91+
value: "2022-11-28"
92+
- name: Content-Type
93+
value: application/json
94+
template.sync-failed-webhook: |
95+
webhook:
96+
github-webhook:
97+
method: POST
98+
body: |
99+
{
100+
"event_type": "argocd-sync-failed",
101+
"client_payload": {
102+
"app_name": "{{.app.metadata.name}}",
103+
"health_status": "{{.app.status.health.status}}",
104+
"sync_status": "{{.app.status.sync.status}}",
105+
"message": "{{.app.status.operationState.message}}",
106+
"revision": "{{.app.status.sync.revision}}",
107+
"repo_url": "{{.app.spec.source.repoURL}}",
108+
"cluster": "{{.context.clusterName}}",
109+
"namespace": "{{.app.spec.destination.namespace}}",
110+
"timestamp": "{{.app.status.operationState.finishedAt}}",
111+
"resources": {{toJson .app.status.resources}}
112+
}
113+
}
114+
trigger.on-health-degraded: |
115+
- when: app.status.health.status == 'Degraded'
116+
send: [sync-failed-webhook]
117+
trigger.on-sync-failed: |
118+
- when: app.status.operationState.phase in ['Error', 'Failed']
119+
send: [sync-failed-webhook]
120+
EOF
121+
122+
# Edit the file to replace YOUR_CLUSTER_NAME, YOUR_OWNER, YOUR_REPO
123+
vi /tmp/argocd-notifications-cm.yaml
124+
125+
# Apply using replace --force to avoid kubectl apply annotation issues
126+
kubectl replace --force -f /tmp/argocd-notifications-cm.yaml
127+
```
128+
129+
**Important notes:**
130+
- Use `kubectl patch` for incremental changes to preserve existing configuration
131+
- Use `kubectl replace --force` only if applying a complete configuration file, as it will overwrite the entire ConfigMap
132+
- The `kubectl apply` command can create problematic annotations that cause template parsing errors - avoid it for this ConfigMap
133+
- Use camelCase variable names in the context block (not hyphenated) to avoid template parsing errors
134+
135+
### 5. Commit and push the workflow
136+
137+
```bash
138+
cd /home/dcasati/src/agentic-platform-engineering
139+
140+
# Add the files
141+
git add .github/workflows/argocd-deployment-failure.yml
142+
git add .github/argocd/argocd-notifications-config.yaml
143+
144+
# Commit
145+
git commit -m "Add ArgoCD deployment failure notification workflow"
146+
147+
# Push
148+
git push
149+
```
150+
151+
### 6. Enable Notifications on Your ArgoCD Applications
152+
153+
Add annotations to your ArgoCD Application manifests:
154+
155+
```yaml
156+
apiVersion: argoproj.io/v1alpha1
157+
kind: Application
158+
metadata:
159+
name: my-app
160+
namespace: argocd
161+
annotations:
162+
notifications.argoproj.io/subscribe.on-sync-failed.github-webhook: ""
163+
notifications.argoproj.io/subscribe.on-health-degraded.github-webhook: ""
164+
spec:
165+
# ... rest of your application spec
166+
```
167+
168+
Or use the ArgoCD CLI:
169+
170+
```bash
171+
# Subscribe to sync failed notifications
172+
argocd app patch my-app --patch='{"metadata":{"annotations":{"notifications.argoproj.io/subscribe.on-sync-failed.github-webhook":""}}}'
173+
174+
# Subscribe to health degraded notifications
175+
argocd app patch my-app --patch='{"metadata":{"annotations":{"notifications.argoproj.io/subscribe.on-health-degraded.github-webhook":""}}}'
176+
```
177+
178+
## Testing
179+
180+
1. ArgoCD detects sync failure or degraded health
181+
2. ArgoCD Notifications sends webhook to GitHub repository_dispatch
182+
3. GitHub Actions workflow is triggered
183+
4. Workflow checks for existing open issues for the same app
184+
- If exists: Adds comment with new failure details
185+
- If not: Creates new issue with full details
186+
5. Issue includes:
187+
- Error message
188+
- Revision/commit that failed
189+
- Health and sync status
190+
- Recommended remediation steps
191+
- Links to ArgoCD UI and source repository
192+
193+
## Security Features
194+
195+
- ✅ Fine-grained GitHub token with minimal permissions (Contents, Actions, Issues)
196+
- ✅ Token stored in Kubernetes secret (not in code)
197+
- ✅ Token authentication protects GitHub API endpoint
198+
- ✅ Automatic duplicate issue detection
199+
- ✅ Labels for easy filtering: `argocd-deployment-failure`, `automated`, `bug`
200+
201+
## Troubleshooting
202+
203+
### Notifications not being sent:
204+
205+
```bash
206+
# Check notifications controller logs
207+
kubectl logs -n argocd -l app.kubernetes.io/name=argocd-notifications-controller
208+
209+
# Verify the secret has the GitHub token
210+
kubectl get secret argocd-notifications-secret -n argocd -o yaml
211+
212+
# Verify the ConfigMap is applied
213+
kubectl get configmap argocd-notifications-cm -n argocd -o yaml
214+
```
215+
216+
### Issues not being created:
217+
218+
1. Check GitHub Actions workflow runs in your repository
219+
2. Verify the repository_dispatch event type matches: `argocd-sync-failed`
220+
3. Check workflow logs for errors
221+
4. Verify token permissions include "Actions: Read and write" and "Issues: Read and write"
222+
223+
## Next Steps
224+
225+
After completing the setup:
226+
227+
1. Test with a known-good application first
228+
2. Gradually enable on critical applications
229+
3. Monitor the issue tracker for patterns
230+
4. Customize the issue template as needed
231+
5. Consider adding auto-close logic when apps recover

‎.github/argocd/argocd-notifications-config.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: argocd-notifications-cm
5+
namespace: argocd
6+
data:
7+
# Cluster name - set this to your cluster context name
8+
# You can set this automatically with: kubectl patch configmap argocd-notifications-cm -n argocd -p "{\"data\":{\"cluster-name\":\"$(kubectl config current-context)\"}}"
9+
cluster-name: "CLUSTER_NAME_PLACEHOLDER"
10+
11+
# GitHub webhook service configuration
12+
service.webhook.github-webhook: |
13+
url: https://api.github.com/repos/DevExpGbb/agentic-platform-engineering/dispatches
14+
headers:
15+
- name: Accept
16+
value: application/vnd.github+json
17+
- name: Authorization
18+
value: Bearer $github-token
19+
- name: X-GitHub-Api-Version
20+
value: "2022-11-28"
21+
- name: Content-Type
22+
value: application/json
23+
24+
# Trigger on sync failures
25+
trigger.on-sync-failed: |
26+
- when: app.status.operationState.phase in ['Error', 'Failed']
27+
send: [sync-failed-webhook]
28+
29+
# Trigger on degraded health
30+
trigger.on-health-degraded: |
31+
- when: app.status.health.status == 'Degraded'
32+
send: [sync-failed-webhook]
33+
34+
# Template for the webhook payload
35+
template.sync-failed-webhook: |
36+
webhook:
37+
github-webhook:
38+
method: POST
39+
body: |
40+
{
41+
"event_type": "argocd-sync-failed",
42+
"client_payload": {
43+
"app_name": "{{.app.metadata.name}}",
44+
"health_status": "{{.app.status.health.status}}",
45+
"sync_status": "{{.app.status.sync.status}}",
46+
"message": "{{.app.status.operationState.message}}",
47+
"revision": "{{.app.status.sync.revision}}",
48+
"repo_url": "{{.app.spec.source.repoURL}}",
49+
"cluster": "$cluster-name",
50+
"namespace": "{{.app.spec.destination.namespace}}",
51+
"timestamp": "{{.app.status.operationState.finishedAt}}",
52+
"resources": {{toJson .app.status.resources}}
53+
}
54+
}

‎.github/argocd/setup-cluster-name.sh‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/bin/bash
2+
# Run this script once when ArgoCD is installed to set the cluster name
3+
# Usage: ./setup-cluster-name.sh
4+
5+
set -e
6+
7+
CLUSTER_NAME=$(kubectl config current-context)
8+
9+
echo "Setting cluster name in ArgoCD notifications: $CLUSTER_NAME"
10+
11+
# Update the cluster-name in the argocd-notifications-cm ConfigMap
12+
kubectl patch configmap argocd-notifications-cm -n argocd \
13+
-p "{\"data\":{\"cluster-name\":\"$CLUSTER_NAME\"}}"
14+
15+
# Restart the notifications controller to pick up the change
16+
kubectl rollout restart deployment argocd-notifications-controller -n argocd
17+
18+
echo "✓ Cluster name configured: $CLUSTER_NAME"
19+
echo ""
20+
echo "ArgoCD notifications will now use cluster name: $CLUSTER_NAME"

‎.github/prompts/write-docs.prompt.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# Analyze Commit and Create Documentation Issue
2+
3+
Analyze commit `{COMMIT_SHA}` in repository `{REPOSITORY}` using the GitHub MCP server.
4+
5+
## Your Task
6+
7+
1. **Examine the commit** using MCP to access:
8+
- Commit diff and changed files
9+
- Current documentation structure
10+
- Project context
11+
12+
2. **Decide if documentation is needed** based on these criteria:
13+
14+
### ✅ Document These:
15+
- Public APIs/Interfaces (functions, classes, endpoints)
16+
- Complex logic requiring explanation
17+
- Architectural or workflow changes
18+
- Breaking changes
19+
- New dependencies or integrations
20+
- Security/performance changes
21+
- Database schemas or data models
22+
- Unit tests
23+
24+
### ❌ Skip These:
25+
- Minor refactoring or formatting
26+
- Internal helpers
27+
- Trivial typo fixes
28+
- Code moves without logic changes
29+
- Patch dependency updates
30+
in the current repository
31+
- Add labels: `documentation`, `automated`
32+
3. **If documentation is needed:**
33+
- Use the GitHub MCP server to create a GitHub issue with title: "📚 Documentation needed for commit test"
34+
- Use assign_copilot_to_issue tool to assign @copilot to issue.
35+
- In the issue body, explain:
36+
- What changed and why it needs documentation
37+
- Which documentation files should be updated
38+
- Any breaking changes or migration notes needed
39+
- Confirm if all steps succeeded or not.
40+
41+
4. **If documentation is NOT needed:**
42+
- Simply explain why in a brief response (no issue needed)

‎.github/workflows/copilot-az-login.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: "Copilot - Azure Login"
2+
3+
on:
4+
workflow_dispatch:
5+
6+
permissions:
7+
id-token: write
8+
contents: read
9+
issues: write
10+
11+
env:
12+
ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
13+
ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
14+
ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
15+
ARM_USE_OIDC: true
16+
17+
jobs:
18+
copilot-setup-steps:
19+
runs-on: ubuntu-latest
20+
environment: demo
21+
22+
# Job-level permissions override workflow-level, so you must include id-token here
23+
permissions:
24+
contents: write
25+
id-token: write # Required for Azure federated identity
26+
27+
steps:
28+
- name: Checkout code
29+
uses: actions/checkout@v5
30+
31+
- name: Azure CLI Login
32+
uses: azure/login@v2
33+
with:
34+
client-id: ${{ secrets.ARM_CLIENT_ID }}
35+
tenant-id: ${{ secrets.ARM_TENANT_ID }}
36+
subscription-id: ${{ secrets.ARM_SUBSCRIPTION_ID }}
37+
38+
- name: Validate Workload Identity Auth Works
39+
run: |
40+
az account show
41+
az group list

0 commit comments

Comments
 (0)