Automation Suite on EKS/AKS installation guide

Provisioning ArgoCD​

• Provide the correct value for the application_namespace parameter in the argocd section of your input.json file. This is the namespace where applications are created, and ideally should be the namespace where ArgoCD is installed.
• If you install Automation Suite on a shared cluster, we recommend creating a new ArgoCD project dedicated to Automation Suite rather than using the default project. For instructions on how to create a project in ArgoCD, see Creating a project in ArgoCD.
• Configure the Helm repository in ArgoCD. For more information, see Configuring the Helm repository in ArgoCD.
• Grant the necessary permissions on the ArgoCD namespace. For more information, see Granting the necessary permissions on the ArgoCD namespace.

Creating a project in ArgoCD​

1. Log in to ArgoCD.
2. Navigate to Settings > Projects > +NEW PROJECT.
3. Provide a name and description for the project.
4. Add the following destinations:
   1. Enter <uipath> as the namespace and https://kubernetes.default.svc as the server.
   2. Enter <istio-system> as the namespace and https://kubernetes.default.svc as the server.
5. Add the <argocd> namespace to sourceNamespaces.
   Note:

   In older ArgoCD releases, sourceNamespaces is not visible in the UI.

apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: <project-name>
  namespace: <argocd-namespace>
spec:
  description: App project to manage and deploy uipath applications
  clusterResourceWhitelist:
    - group: '*'
      kind: '*'
  destinations:
    - namespace: <uipath>
      server: https://kubernetes.default.svc
    - namespace: <istio-system>
      server: https://kubernetes.default.svc
  sourceNamespaces:
    - <argocd-namespace>
  sourceRepos:
    - '*'
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: <project-name>
  namespace: <argocd-namespace>
spec:
  description: App project to manage and deploy uipath applications
  clusterResourceWhitelist:
    - group: '*'
      kind: '*'
  destinations:
    - namespace: <uipath>
      server: https://kubernetes.default.svc
    - namespace: <istio-system>
      server: https://kubernetes.default.svc
  sourceNamespaces:
    - <argocd-namespace>
  sourceRepos:
    - '*'

Configuring the Helm repository in ArgoCD​

1. Log in to ArgoCD.
2. Navigate to Settings > Repositories > +CONNECT REPO.
3. Use VIA HTTPS for the connection method.
4. Select Helm as the type.
5. Provide a name.
6. Choose uipath as the project. uipath is the name of the ArgoCD project you created for the UiPath® application.
7. Provide the repository URL, username, password, and certificate info.
8. Enable the OCI checkbox.
9. Select Connect.
10. Make sure that the connection status is Successful.

Granting the necessary permissions on the ArgoCD namespace​

1. Create a role to create and edit the secret in the <argocd> namespace:
   assignment

   apiVersion: rbac.authorization.k8s.io/v1
   kind: Role
   metadata:
     name: argo-secret-role
     namespace: <argocd>
   rules:
     - apiGroups: ["rbac.authorization.k8s.io"]
       resources: ["roles", "rolebindings"]
       verbs: ["*"]
     - apiGroups: ["*"]
       resources: ["secrets"]
       verbs: ["get", "watch", "list", "patch", "update", "create"]
   apiVersion: rbac.authorization.k8s.io/v1
   kind: Role
   metadata:
     name: argo-secret-role
     namespace: <argocd>
   rules:
     - apiGroups: ["rbac.authorization.k8s.io"]
       resources: ["roles", "rolebindings"]
       verbs: ["*"]
     - apiGroups: ["*"]
       resources: ["secrets"]
       verbs: ["get", "watch", "list", "patch", "update", "create"]
   

2. Bind the argo-secret-role role to the uipathadmin service account:
   assignment

   kubectl -n <argocd> create rolebinding secret-binding \
     --role=argo-secret-role --serviceaccount=<uipath>:uipathadmin
   kubectl -n <argocd> create rolebinding secret-binding \
     --role=argo-secret-role --serviceaccount=<uipath>:uipathadmin
   

3. Create a role to manage the applications in the <argocd> namespace:
   assignment

   apiVersion: rbac.authorization.k8s.io/v1
   kind: Role
   metadata:
     name: uipath-application-manager
     namespace: <argocd>
   rules:
     - apiGroups:
         - argoproj.io
       resources:
         - applications
       verbs:
         - "*"
   apiVersion: rbac.authorization.k8s.io/v1
   kind: Role
   metadata:
     name: uipath-application-manager
     namespace: <argocd>
   rules:
     - apiGroups:
         - argoproj.io
       resources:
         - applications
       verbs:
         - "*"
   

4. Bind the uipath-application-manager role to the uipathadmin service account:
   assignment

   kubectl create rolebinding uipath-application-manager-rolebinding --role=uipath-application-manager --serviceaccount=<uipath>:uipathadmin -n <argocd>
   kubectl create rolebinding uipath-application-manager-rolebinding --role=uipath-application-manager --serviceaccount=<uipath>:uipathadmin -n <argocd>
   

5. Bind the namespace reader role in the <argocd> namespace to the uipathadmin service account:
   assignment

   kubectl -n <argocd> create rolebinding namespace-reader-rolebinding \
     --clusterrole=namespace-reader-clusterrole --serviceaccount=<uipath>:uipathadmin
   kubectl -n <argocd> create rolebinding namespace-reader-rolebinding \
     --clusterrole=namespace-reader-clusterrole --serviceaccount=<uipath>:uipathadmin