带有谷歌管理证书的 argocd ssl 证书

所以，诀窍是使用 argocd command reference --insecure 标志。 创建自定义 argocd 服务，关闭 CloudFlare 中的代理并使用使用托管证书的入口。

development-argocd-static-ip = 一个全局性的静态 IP argocd-server,gcp-managed,argocd-service,argocd-ingress 都在同一个命名空间中

argocd-server.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: server
    app.kubernetes.io/name: argocd-server
    app.kubernetes.io/part-of: argocd
  name: argocd-server
spec:
  SELEctor:
    matchLabels:
      app.kubernetes.io/name: argocd-server
  template:
    metadata:
      labels:
        app.kubernetes.io/name: argocd-server
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringschedulingIgnoredDuringExecution:
          - podAffinityTerm:
              labelSELEctor:
                matchLabels:
                  app.kubernetes.io/name: argocd-server
              topologyKey: kubernetes.io/hostname
            weight: 100
          - podAffinityTerm:
              labelSELEctor:
                matchLabels:
                  app.kubernetes.io/part-of: argocd
              topologyKey: kubernetes.io/hostname
            weight: 5
      containers:
      - command:
        - argocd-server
        - --insecure    # added this
        - --statiCassets
        - /shared/app
        image: quay.io/argoproj/argocd:v2.0.0
        imagePullPolicy: Always
        livenessProbe:
          httpGet:
            path: /healthz?full=true
            port: 8080
          initialDelaySeconds: 3
          periodSeconds: 30
        name: argocd-server
        ports:
        - containerPort: 8080
        - containerPort: 8083
        readinessProbe:
          httpGet:
            path: /healthz
            port: 8080
          initialDelaySeconds: 3
          periodSeconds: 30
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - all
        volumeMounts:
        - mountPath: /app/config/ssh
          name: ssh-known-hosts
        - mountPath: /app/config/tls
          name: tls-certs
        - mountPath: /app/config/server/tls
          name: argocd-repo-server-tls
      serviceAccountName: argocd-server
      volumes:
      - emptyDir: {}
        name: static-files
      - configMap:
          name: argocd-ssh-known-hosts-cm
        name: ssh-known-hosts
      - configMap:
          name: argocd-tls-certs-cm
        name: tls-certs
      - name: argocd-repo-server-tls
        secret:
          items:
          - key: tls.crt
            path: tls.crt
          - key: tls.key
            path: tls.key
          - key: ca.crt
            path: ca.crt
          optional: true
          secretName: argocd-repo-server-tls

gcp-managed.yaml

apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
  name: gcp-managed
spec:
  domains:
    - subdomain.env.domain.com

argocd-service.yaml

apiVersion: v1
kind: service
metadata:
  name: argocd-service
spec:
  SELEctor:
    app.kubernetes.io/name: argocd-server
  type: NodePort
  ports:
    - protocol: TCP
      port: 80
      targetPort: 8080

argocd-ingress.yaml

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: argocd-ingress
  Annotations:
    kubernetes.io/ingress.global-static-ip-name: development-argocd-static-ip
    networking.gke.io/managed-certificates: gcp-managed
    kubernetes.io/ingress.class: "gce"
spec:
  rules:
    - http:
        paths:
          - path: /*
            BACkend:
              servicename: argocd-service
              servicePort: 80

在以下命令中， kubectl describe managedcertificate gcp-managed -n argocd

Status:
  Certificate Name:    certificate-unique-id
  Certificate Status:  Active
  Domain Status:
    Domain:     subdomain.env.domain.com
    Status:     Active