@squidboylan Do we know what additional Argo CD resources are created?

@squidboylan Do we know what additional Argo CD resources are created?

looks to be:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/component: redis
    app.kubernetes.io/name: argocd-redis
    app.kubernetes.io/part-of: argocd
  name: argocd-redis
rules:
- apiGroups:
  - ""
  resourceNames:
  - argocd-redis
  resources:
  - secrets
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - create

and

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/component: redis
    app.kubernetes.io/name: argocd-redis
    app.kubernetes.io/part-of: argocd
  name: argocd-redis
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: argocd-redis
subjects:
- kind: ServiceAccount
  name: argocd-redis

based on my analysis of the diff.

Confirmed by deploying upstream/main:

squid@korhal:~/hacking/go/idpbuilder$ k get role -n argocd
NAME                               CREATED AT
argocd-application-controller      2025-07-30T21:34:12Z
argocd-applicationset-controller   2025-07-30T21:34:12Z
argocd-dex-server                  2025-07-30T21:34:12Z
argocd-notifications-controller    2025-07-30T21:34:12Z
argocd-server                      2025-07-30T21:34:12Z
squid@korhal:~/hacking/go/idpbuilder$ k get rolebinding -n argocd
NAME                               ROLE                                    AGE
argocd-application-controller      Role/argocd-application-controller      2m
argocd-applicationset-controller   Role/argocd-applicationset-controller   2m
argocd-dex-server                  Role/argocd-dex-server                  2m
argocd-notifications-controller    Role/argocd-notifications-controller    2m
argocd-server                      Role/argocd-server                      2m

@squidboylan Do we know what additional Argo CD resources are created?

looks to be:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/component: redis
    app.kubernetes.io/name: argocd-redis
    app.kubernetes.io/part-of: argocd
  name: argocd-redis
rules:
- apiGroups:
  - ""
  resourceNames:
  - argocd-redis
  resources:
  - secrets
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - create

and

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/component: redis
    app.kubernetes.io/name: argocd-redis
    app.kubernetes.io/part-of: argocd
  name: argocd-redis
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: argocd-redis
subjects:
- kind: ServiceAccount
  name: argocd-redis

based on my analysis of the diff.

Confirmed by deploying upstream/main:

squid@korhal:~/hacking/go/idpbuilder$ k get role -n argocd
NAME                               CREATED AT
argocd-application-controller      2025-07-30T21:34:12Z
argocd-applicationset-controller   2025-07-30T21:34:12Z
argocd-dex-server                  2025-07-30T21:34:12Z
argocd-notifications-controller    2025-07-30T21:34:12Z
argocd-server                      2025-07-30T21:34:12Z
squid@korhal:~/hacking/go/idpbuilder$ k get rolebinding -n argocd
NAME                               ROLE                                    AGE
argocd-application-controller      Role/argocd-application-controller      2m
argocd-applicationset-controller   Role/argocd-applicationset-controller   2m
argocd-dex-server                  Role/argocd-dex-server                  2m
argocd-notifications-controller    Role/argocd-notifications-controller    2m
argocd-server                      Role/argocd-server                      2m

Should we disable argocd-dex-server as we are not using it?

Should we disable argocd-dex-server as we are not using it?

yeah, let's look into that separately though as it's a separate problem from the upgrade. Feel free to open an issue if you want, in either case I'll start looking into that.

Ah we do have its pods disabled at least https://github.com/cnoe-io/idpbuilder/blob/main/hack/argo-cd/dex-server.yaml , so there's probably not much more to do there. We could patch out all of the references but it's probably not worth maintaining that. I like the current fix of setting its replicas to 0