refarch - argocd deployment issues

[mtb-xt]

Hi team,

I'm following this manual to deploy ArgoCD - https://docs.cloudposse.com/reference-architecture/how-to-guides/integrations/argocd/pats/

And noticed couple of issues with it:

1. Deploy ArgoCD GitHub Repositories Configuration page reads

   Deploy the ArgoCD configuration for the two GitHub repos with the following workflow:
   atmos workflow argocd-repos -f argocd

   But there's no such workflow, it should be atmos workflow deploy/argocd-repos -f argocd

2. Command workflow deploy/argocd-repos fails, stating:

   │ Error: Unsupported argument
   │
   │   on main.tf line 88, in resource "github_branch_protection" "default":
   │   88:   push_restrictions = var.push_restrictions_enabled ? [
   │
   │ An argument named "push_restrictions" is not expected here.
   

   This happens because argument "push_restrictions" only exists in v4 of github provider, and your versions.tf lock it to 'higher or equal to v4' - which happily installs version 6 :-D

3. Creating the bot user as described results with these errors in terraform:

╷
│ Error: PATCH https://api.github.com/repos/9spokes/argocd-deploy-non-prod: 403 Resource not accessible by personal access token []
│
│   with github_branch_default.default[0],
│   on main.tf line 55, in resource "github_branch_default" "default":
│   55: resource "github_branch_default" "default" {
│
╵
╷
│ Error: PUT https://api.github.com/organizations/13359015/team/8661474/repos/9spokes/argocd-deploy-non-prod: 403 Resource not accessible by personal access token []
│
│   with github_team_repository.default["dso"],
│   on main.tf line 99, in resource "github_team_repository" "default":
│   99: resource "github_team_repository" "default" {
│
╵
╷
│ Error: POST https://api.github.com/repos/9spokes/argocd-deploy-non-prod/keys: 403 Resource not accessible by personal access token []
│
│   with github_repository_deploy_key.default["platform/apse2-staging"],
│   on main.tf line 114, in resource "github_repository_deploy_key" "default":
│  114: resource "github_repository_deploy_key" "default" {
│
╵
╷
│ Error: POST https://api.github.com/repos/9spokes/argocd-deploy-non-prod/keys: 403 Resource not accessible by personal access token []
│
│   with github_repository_deploy_key.default["platform/apse2-dev"],
│   on main.tf line 114, in resource "github_repository_deploy_key" "default":
│  114: resource "github_repository_deploy_key" "default" {

I only managed to get this solved by changing bot user's permission to Owner, without changing anything in the fine-grained PAT

[milldr]

Thanks for pointing out these issues!

Good catch on 1. We'll get that corrected.

On 2, looks like push_restrictions has been replaced by restrict_pushes. As you point out pinning the provider to the previous version resolves that issue for now. But we'll make note of this to update the component with our next implementation.

Finally for 3, have you already created the empty GitHub repos and does the PAT you're using locally have access? https://docs.cloudposse.com/reference-architecture/setup/argocd/#create-all-argocd-pats

[mtb-xt]

Finally for 3, have you already created the empty GitHub repos and does the PAT you're using locally have access? https://docs.cloudposse.com/reference-architecture/setup/argocd/#create-all-argocd-pats

Yes, that's the thing. Looks like it's an observed effect - look at this discussion - https://github.com/orgs/community/discussions/58868#discussioncomment-7350390

And it solved instantly when the bot user became an owner of the organization.

[milldr]

I'm not sure I follow. Why does the bot need to be an owner of the organization? I believe it does need "Admin", but it doesn't need to be an owner of the Organization if the repositories are already created.

[mtb-xt]

I'm not sure I follow. Why does the bot need to be an owner of the organization? I believe it does need "Admin", but it doesn't need to be an owner of the Organization if the repositories are already created.

I'm 100% sure they were created, and I do not understand why either - just saying what helped. Bot user was an Admin in fine grained permissions on the target repos, but it still didn't work. Making it Owner of Org - worked.