-
docs(argocd): add a local verification recipe (#5387)
frostbyte_neo 发布于
2026-08-23 19:44:15 +00:00 - docs(argocd): add a local verification recipe
Verified both registered Argo CD tools live against a real local Argo
CD install with a real GitOps application synced from a public repo
(argoproj/argocd-example-apps guestbook) -- no bugs found.
argocd_application_status confirmed with real sync/health status,
revision, and operation phase; argocd_application_diff confirmed
against real drift (disabled automated sync, then patched a live
Deployment's replica count directly, confirming the tool correctly
surfaces the resulting diff).Also documents a genuine gotcha hit while building the recipe: the
official install.yaml fails under plainkubectl applywith
metadata.annotations: Too long: may not be more than 262144 bytes--
the ApplicationSet CRD is large enough that client-side apply's
last-applied-configuration annotation exceeds Kubernetes' own limit.
--server-side --force-conflictsavoids the annotation entirely.
Verified the full recipe twice, end-to-end, against two independent
fresh kind clusters.- docs(argocd): fix reproducibility and lifecycle gaps per Greptile
- The diff-tool output was attributed to "direct tool invocation" with
no actual reproducible command -- and opensre investigate doesn't
guarantee argocd_application_diff runs on any given turn (the planner
decides). Added the exact invocation as a copy-pasteable command;
first draft used bare python3, which fails since importing
integrations.argocd.tools needs the project's own venv -- fixed to
uv run python3 and re-verified live. - The port-forward was backgrounded with no PID capture or readiness
check, so a slow start or leftover process on 8080 could leave the
login step targeting a dead endpoint, or leak a stray process past
teardown. Added a bounded readiness loop and captured the PID so
teardown can actually kill it. - Trimmed a "Confirmed live: ..." verification-narration sentence from
the CRD-size Warning box; kept the actionable explanation.
Re-verified the changed sections live on a second fresh cluster: PID
capture, readiness loop, and the corrected uv run invocation all
confirmed working.- docs(argocd): trap-kill the port-forward on any exit path, per Greptile
The bounded readiness loops' exit 1 on timeout (or an interrupted run)
skipped straight past the teardown block, leaving the backgrounded
kubectl port-forward running and occupying port 8080 for the next
attempt. Added a trap on EXIT right after starting the port-forward, so
normal completion, a readiness-loop timeout, and an interrupted run all
reliably kill it. Verified live: a simulated timeout correctly triggers
the trap and the background process is gone immediately after.- docs(argocd): make cluster creation idempotent, per Greptile
The port-forward trap only covers that one process -- an early exit
from the readiness loop, a failed command, or an interrupted run still
left the kind cluster itself running, and kind create cluster fails
outright on a name collision (node(s) already exist for a cluster with
the name "..."), so a retry after any failed attempt needed a manual
kind delete first. Deleting any stale cluster of the same name before
creating (a no-op on a clean first run) makes retries always work
without requiring cleanup on every possible failure path -- confirmed
the exact error message live before writing the explanation.- docs(argocd): warn before deleting a pre-existing cluster, per Greptile
The unconditional kind delete before create (added for retry-ability)
would silently destroy a reader's own cluster if they already had one
named opensre-argocd-demo for an unrelated purpose -- no check, no
warning. Now only deletes if a cluster with that exact name already
exists, and prints a 5-second warning with a name-specific Ctrl-C
window before doing so, rather than acting silently. Verified live both
paths: no pre-existing cluster skips straight to create, and a
pre-existing cluster of that name triggers the warning, waits, then
deletes and recreates.- docs(argocd): require affirmative confirmation before deleting a cluster, per Greptile
A timed Ctrl-C window is still an automatic delete if the reader isn't
watching the terminal at that exact moment. Replaced with a blocking
read prompt requiring an explicit y/Y before deleting an
already-existing opensre-argocd-demo cluster; anything else (including
no input, e.g. a non-interactive run) aborts with exit 1 and leaves the
existing cluster untouched. Verified live: no pre-existing cluster
skips the prompt entirely, confirming 'y' deletes and recreates,
declining aborts and preserves the existing cluster.- docs(argocd): fix store-path pattern per human review on a sibling doc
Same fix as docs/splunk.mdx and siblings: "a literal zero-byte file
does not work here" doesn't hold on current main -- store.py catches
JSONDecodeError from an empty file and falls back to an empty v2 store.
Switched to pointing OPENSRE_INTEGRATIONS_STORE_PATH at a path inside a
fresh mktemp -d directory instead, which avoids the exception entirely
since the file itself never exists. Also trims a
verification-narrative sentence to match the corrected sibling docs.- docs(argocd): remove embedded internal-import diff reproduction, per muddlebee
Removed the python3 -c snippet that directly imported and invoked
ArgoCDApplicationDiffTool -- user-facing docs shouldn't teach or depend
on internal integration class paths. Replaced with prose stating the
same substance (the planner doesn't guarantee this tool runs every
turn, and here's what it reported on a turn where it did) without a
reader-facing internal-import command. The opensre investigate flow,
empty-directory store setup, and teardown are unchanged.下载附件