AWS eks documentation change
Summary
Removed 'Progressive rollout' section, updated generator examples to use 'destination.name' instead of 'destination.server', added merge generator documentation, clarified cluster requirements, added cluster exclusion examples, and included security considerations for ApplicationSets.
Security assessment
Added explicit security documentation via an 'Important' note linking to Argo CD's ApplicationSet security guidelines. This proactively addresses security awareness but doesn't fix a specific vulnerability. No evidence of a resolved security incident exists in the diff.
Diff
diff --git a/eks/latest/userguide/argocd-applicationsets.md b/eks/latest/userguide/argocd-applicationsets.md index b7c663257..99d7e2eb4 100644 --- a//eks/latest/userguide/argocd-applicationsets.md +++ b//eks/latest/userguide/argocd-applicationsets.md @@ -5 +5 @@ -PrerequisitesHow ApplicationSets workList generatorCluster generatorGit generatorsMatrix generatorProgressive rolloutMulti-region deploymentManage ApplicationSetsAdditional resources +PrerequisitesHow ApplicationSets workList generatorCluster generatorGit generatorsMatrix generatorMulti-region deploymentManage ApplicationSetsAdditional resources @@ -19,2 +18,0 @@ ApplicationSets generate multiple Applications from templates, enabling you to d - * Multiple target clusters registered (see [Register target clusters](./argocd-register-clusters.html)) - @@ -27,0 +26,4 @@ ApplicationSets generate multiple Applications from templates, enabling you to d +###### Note + +Multiple target clusters are not required for ApplicationSets. You can use generators other than the cluster generator (like list, git, or matrix generators) to deploy applications without remote clusters. + @@ -41,0 +44,2 @@ Common generators for EKS deployments: + * **Merge generator** \- Merge parameters from multiple generators + @@ -61,2 +65 @@ Deploy to multiple clusters with explicit configuration: - - cluster: arn:aws:eks:us-west-2:111122223333:cluster/dev-cluster - environment: dev + - environment: dev @@ -64,2 +67 @@ Deploy to multiple clusters with explicit configuration: - - cluster: arn:aws:eks:us-west-2:111122223333:cluster/staging-cluster - environment: staging + - environment: staging @@ -67,2 +69 @@ Deploy to multiple clusters with explicit configuration: - - cluster: arn:aws:eks:us-west-2:111122223333:cluster/prod-cluster - environment: prod + - environment: prod @@ -80 +81 @@ Deploy to multiple clusters with explicit configuration: - server: '{{cluster}}' + name: '{{environment}}-cluster' @@ -89 +90 @@ Deploy to multiple clusters with explicit configuration: -Use EKS cluster ARNs in the `server` field when targeting registered EKS clusters. You can also use cluster names with `destination.name` instead of `destination.server`. +Use `destination.name` with cluster names for better readability. The `destination.server` field also works with EKS cluster ARNs if needed. @@ -126,0 +128,2 @@ This automatically creates an Application for each registered cluster. +Use `matchLabels` to include specific clusters, or `matchExpressions` to exclude clusters: + @@ -133,0 +137,3 @@ This automatically creates an Application for each registered cluster. + matchExpressions: + - key: skip-appset + operator: DoesNotExist @@ -171 +177 @@ Git generators create Applications based on repository structure: - server: arn:aws:eks:us-west-2:111122223333:cluster/my-cluster + name: my-cluster @@ -215 +221 @@ Combine multiple generators to deploy across multiple dimensions (environments - server: '{{server}}' + name: '{{name}}' @@ -220,39 +225,0 @@ For details on combining generators, see [Matrix Generator](https://argo-cd.read -## Progressive rollout - -Deploy to environments sequentially with different sync policies: - - - apiVersion: argoproj.io/v1alpha1 - kind: ApplicationSet - metadata: - name: progressive-rollout - namespace: argocd - spec: - generators: - - list: - elements: - - environment: dev - autoSync: "true" - - environment: staging - autoSync: "true" - - environment: prod - autoSync: "false" - template: - metadata: - name: 'app-{{environment}}' - spec: - project: default - source: - repoURL: https://github.com/example/app - targetRevision: HEAD - path: 'overlays/{{environment}}' - destination: - server: arn:aws:eks:us-west-2:111122223333:cluster/{{environment}}-cluster - namespace: app - syncPolicy: - automated: - prune: true - selfHeal: '{{autoSync}}' - -Dev and staging sync automatically, while production requires manual approval. - @@ -273 +240 @@ Deploy to clusters across multiple regions: - - cluster: arn:aws:eks:us-west-2:111122223333:cluster/prod-us-west + - clusterName: prod-us-west @@ -275 +242 @@ Deploy to clusters across multiple regions: - - cluster: arn:aws:eks:us-east-1:111122223333:cluster/prod-us-east + - clusterName: prod-us-east @@ -277 +244 @@ Deploy to clusters across multiple regions: - - cluster: arn:aws:eks:eu-west-1:111122223333:cluster/prod-eu-west + - clusterName: prod-eu-west @@ -293 +260 @@ Deploy to clusters across multiple regions: - server: '{{cluster}}' + name: '{{clusterName}}' @@ -323,0 +291,6 @@ Deleting an ApplicationSet deletes all generated Applications. If those Applicat +To preserve deployed resources when deleting an ApplicationSet, set `.syncPolicy.preserveResourcesOnDeletion` to `true` in the ApplicationSet spec. For more information, see [Application Pruning & Resource Deletion](https://argo-cd.readthedocs.io/en/stable/operator-manual/applicationset/Application-Deletion/) in the Argo CD documentation. + +###### Important + +Argo CD’s ApplicationSets feature has security considerations you should be aware of before using ApplicationSets. For more information, see [ApplicationSet Security](https://argo-cd.readthedocs.io/en/stable/operator-manual/applicationset/Security/) in the Argo CD documentation. +