feat: use argocd applications instead of applcationsets for workloads

charts/team-ns/templates/argocd/argocd-application-workloads.yaml

@@ -0,0 +1,93 @@
+{{- $v := .Values }}
+{{- range $v.workloads }}
+{{- $a := .imageUpdateStrategy }}
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: 'team-{{ $v.teamId }}-{{ .name }}'
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+  {{- if or (eq $a.type "digest") (eq $a.type "semver") }}
+    argocd-image-updater.argoproj.io/team-{{ $v.teamId }}-{{ .name }}.force-update: 'true'
+    argocd-image-updater.argoproj.io/team-{{ $v.teamId }}-{{ .name }}.pull-secret: 'pullsecret:argocd/copy-team-{{ $v.teamId }}-harbor-pullsecret'
+    argocd-image-updater.argoproj.io/git-branch: main
+    argocd-image-updater.argoproj.io/write-back-method: 'git:secret:argocd/team-{{ $v.teamId }}-gitea-repo-creds'
+    {{- if eq $a.type "semver" }}
+    argocd-image-updater.argoproj.io/image-list: 'team-{{ $v.teamId }}-{{ .name }}={{ $a.semver.imageRepository }}:~{{ $a.semver.versionConstraint }}'
+    argocd-image-updater.argoproj.io/team-{{ $v.teamId }}-{{ .name }}.update-strategy: 'semver'
+    argocd-image-updater.argoproj.io/team-{{ $v.teamId }}-{{ .name }}.helm.image-name: '{{ $a.semver.imageParameter }}'
+    argocd-image-updater.argoproj.io/team-{{ $v.teamId }}-{{ .name }}.helm.image-tag: '{{ $a.semver.tagParameter }}'
+    {{- end }}
+    {{- if eq $a.type "digest" }}
+    argocd-image-updater.argoproj.io/image-list: 'team-{{ $v.teamId }}-{{ .name }}={{ $a.digest.imageRepository }}:{{ $a.digest.tag }}'
+    argocd-image-updater.argoproj.io/team-{{ $v.teamId }}-{{ .name }}.update-strategy: 'digest'
+    argocd-image-updater.argoproj.io/team-{{ $v.teamId }}-{{ .name }}.helm.image-name: '{{ $a.digest.imageParameter }}'
+    argocd-image-updater.argoproj.io/team-{{ $v.teamId }}-{{ .name }}.helm.image-tag: '{{ $a.digest.tagParameter }}'
+    {{- end }}
+  {{- end }}
+spec:
+  {{- if and ( eq $v.teamId "admin" ) .namespace }} 
+  project: 'default' # project is not restricted
+  {{- else }} 
+  project: 'team-{{ $v.teamId }}' # project is restricted
+  {{- end }}
+  sources:
+  - repoURL: '{{ .url }}'
+    targetRevision: '{{ .revision }}' 
+    path: '{{ .path }}' 
+    chart: '{{ .chart }}'  
+    helm:
+      valueFiles:
+      - $repoURL/env/teams/{{ $v.teamId }}/workloadValues/{{ .name }}.yaml"
+      releaseName: '{{ .name }}'
+      {{- if and (.sidecarInject) (.createNamespace) }}
+      parameters:
+        - name: sidecar.istio.io/inject
+          value: 'true'
+      {{- end }}
+  - repoURL: "{{ $v.gitOps.workloadValuesRepoUrl }}"
+    targetRevision: HEAD
+    ref: repoURL
+  syncPolicy:
+    automated:
+      allowEmpty: false
+      prune: false
+      selfHeal: true
+    retry:
+      backoff:
+        duration: 10s
+        factor: 3
+      limit: 3
+    {{- if eq $v.teamId "admin" }} 
+    syncOptions:
+      - RespectIgnoreDifferences=true
+      - ServerSideApply=true
+      {{- if .createNamespace }}
+      - CreateNamespace=true
+      {{- end }}
+  ignoreDifferences:
+    - group: admissionregistration.k8s.io
+      kind: ValidatingWebhookConfiguration
+      jqPathExpressions:
+      - '.webhooks[]?.clientConfig.caBundle'
+    - group: admissionregistration.k8s.io
+      kind: MutatingWebhookConfiguration
+      jqPathExpressions:
+      - '.webhooks[]?.clientConfig.caBundle'
+    - group: "apps"
+      kind: "StatefulSet"
+      jqPathExpressions:
+        - ".spec.volumeClaimTemplates[].apiVersion"
+        - ".spec.volumeClaimTemplates[].kind"
+        - ".spec.volumeClaimTemplates[].spec"
+    {{- end }}
+  destination:
+    server: 'https://kubernetes.default.svc'
+    {{- if and ( eq $v.teamId "admin" ) .namespace }} 
+    namespace: '{{ .namespace }}'
+    {{- else }} 
+    namespace: 'team-{{ $v.teamId }}'
+    {{- end }}
+{{- end }}

charts/team-ns/templates/argocd/argocd-applicationset.yaml

@@ -94,7 +94,7 @@ spec:
       destination:
         server: 'https://kubernetes.default.svc'
         {{- if and ( eq $v.teamId "admin" ) .namespace }} 
-        namespace: '{{- .namespace }}'
+        namespace: '{{ .namespace }}'
         {{- else }} 
         namespace: 'team-{{ $v.teamId }}'
         {{- end }}

values/argocd/argocd.gotmpl

@@ -113,7 +113,7 @@ configs:
       rootCA: |
         {{- $v._derived.caCert | nindent 8 }}
       {{- end }}
-
+  timeout.reconciliation: 30s
   {{- if $v._derived.untrustedCA }}
   tls:
     certificates: