Skip to main content
logoTetrate Patch ServiceVersion: alpha

Upgrades with Argo CD

This page finishes connecting your repository when Argo CD deploys from it. You change each Application that deploys a Tetrate product, and add one Application for the agent. The setup guide in the console shows the exact lines for your account; this page explains them.

Step 1: Change Each Product's Application​

Merge these lines into the Application that deploys the product, here Tetrate Enterprise Gateway in the default environment:

metadata:
  labels:
    patch.tetrate.io/product: teg
    patch.tetrate.io/environment: default
spec:
  sources:
    - repoURL: oci://docker.io/tetrate/teg-envoy-gateway-helm
      chart: teg
      targetRevision: v1.9.3
      helm:
        valueFiles:
          # ...your own values files, then the versions file, last:
          - $values/.tetrate/teg/envs/default/values-versions.yaml
    - repoURL: https://github.com/<owner>/<repository>.git
      targetRevision: main
      ref: values
  syncPolicy:
    syncOptions:
      - ServerSideApply=true

What each part does:

  • The labels tell the agent which product and environment this Application deploys. Patch Service uses them to show the product on the cluster, and to know it is deployed from your repository.
  • Tetrate's chart comes first in sources, so its targetRevision is the chart version upgrades move. If you named this file in the setup guide, the manifest points at that field.
  • The versions file is the last of valueFiles, so its image pins win over any image your own values set. Keep your own values files before it.
  • Your repository is a second source with ref: values, so $values/ can read the versions file from it. Use the same URL your Argo CD already reads the repository with.
  • ServerSideApply=true is needed because some of the product's CRDs are too large for a client-side apply. Argo CD applies the chart's CRDs on every sync, so they upgrade with the chart.

Commit the change. On its next sync, Argo CD deploys exactly what runs today, with the same versions, now read from the versions file.

Step 2: Deploy the Agent from Your Repository​

The download includes an Application for the agent, .tetrate/patch-service-agent/envs/default/application.yaml, so agent upgrades arrive as pull requests too. It reads the agent's settings from .tetrate/patch-service-agent/values-customer.yaml, already filled in for your account. Nothing secret is in either: the agent reads its credentials from the Secret and ConfigMap that connecting the cluster created.

  1. If the cluster already runs the agent from Connect a cluster, uninstall that copy first. The Secret and ConfigMap it uses stay in place:

    helm uninstall patch-service-agent -n tetrate-dataplane-system

  2. Apply the agent's Application to the cluster, once. From then on Argo CD keeps it in sync with the repository:

    kubectl apply -f .tetrate/patch-service-agent/envs/default/application.yaml

The agent's chart is in Tetrate's private registry, fips-containers.teg.tetratelabs.com. Register that registry in Argo CD as a Helm OCI repository, with the same Tetrate Hub credentials the secrets file from Connect a cluster holds, so Argo CD can fetch the chart.

The Application lives in the argocd namespace. If your Argo CD uses another one, change the Application's namespace and argocdNamespace in values-customer.yaml to match: the agent reads the labeled Applications there.

Step 3: Check the Result​

Once Argo CD has synced both:

  1. In the console's Clusters view, the cluster shows a chip for each product, such as teg · default, filled rather than outlined. Hover over it: it names the Application and your repository.
  2. Run the Tetrate upgrades workflow once from the repository's Actions tab.

An outlined chip means Patch Service does not upgrade that product, and hovering says why: usually the manifest does not declare it, or the Application reads from a different repository.

Next Steps​