stack.basicstack.de/apps/argocd/README.md

# Argo CD Deployment

This directory contains the Argo CD deployment configuration for the basicstack.de k3s cluster.

Argo CD itself is installed from the community Helm chart (`argoproj/argo-helm`, chart `argo-cd`). This directory holds the chart values file plus a small kustomize wrapper for the ingress and sealed secrets that stay in git.

## Files

- `values.yaml` - Helm values for the `argo-cd` chart (image tag, OIDC/RBAC config, resource limits, ingress disabled).
- `kustomization.yaml` - Kustomize wrapper for the ingress + sealed secrets (does NOT install Argo CD itself).
- `argocd-ingress.yaml` - Ingress configuration for the Argo CD UI (Traefik + cert-manager `letsencrypt-prod`).
- `argocd-oidc-secret-sealed.yaml` - Sealed secret for Pocket ID OIDC integration.
- `repo-*.yaml` - Sealed secrets for Git repository access.

## How the install is wired

The root [`../app-argocd.yaml`](../app-argocd.yaml) is an Argo CD `Application` with two sources:

1. The public Helm chart at `https://argoproj.github.io/argo-helm`, chart `argo-cd`, `targetRevision` pinned in git.
2. This repo (`ref: values`) providing the `values.yaml` used by source (1) AND the ingress/sealed secrets applied via `kustomize`.

Once bootstrapped, Argo CD manages its own install by syncing this Application.

## Resource limits

Memory limits were added after DEV-281 (resource exhaustion incident on 2026-07-12) and are now driven by `values.yaml`:

| Component | Memory Limit | Memory Request |
|-----------|--------------|----------------|
| application-controller | 512Mi | 256Mi |
| repo-server | 512Mi | 256Mi |
| redis | 256Mi | 128Mi |
| server | 256Mi | 128Mi |
| notifications-controller | 128Mi | 64Mi |
| applicationset-controller | 256Mi | 128Mi |

## Deployment

### Steady state (managed by Argo CD)

Once the cluster is bootstrapped, changes to this directory are picked up by the root `argocd` Application on the next sync. No manual `kubectl apply` is required.

### First-time / disaster-recovery bootstrap

Argo CD cannot install itself while it is gone. Bootstrap with helm, then hand ownership back:

```bash
helm repo add argo https://argoproj.github.io/argo-helm
helm repo update
helm install argocd argo/argo-cd \
  --version 10.4.0 \
  --namespace argocd --create-namespace \
  --values apps/argocd/values.yaml \
  --wait --timeout 10m

kubectl apply -k apps/argocd/          # ingress + sealed secrets
kubectl apply -f apps/app-argocd.yaml  # hand ownership back to GitOps
```

## Updating Argo CD

Bump the chart and the image tag in a single PR:

1. Refresh the local helm repo cache and check what's available:
   ```bash
   helm repo update
   helm search repo argo/argo-cd --versions | head
   ```

2. Bump both fields together, keeping them in sync with the chart's `appVersion`:
   - `apps/app-argocd.yaml` -> `spec.sources[0].targetRevision` (chart version, e.g. `10.4.0`)
   - `apps/argocd/values.yaml` -> `global.image.tag` (app version, e.g. `v3.5.1`)

3. Optionally render locally to sanity-check the output before opening the PR:
   ```bash
   helm template argocd argo/argo-cd \
     --version <new-chart-version> \
     -f apps/argocd/values.yaml -n argocd | less
   ```

4. Open the PR. After merge, Argo CD syncs itself onto the new version.

## Troubleshooting

### Check resource usage

```bash
kubectl top pods -n argocd
```

### Check applied resource limits

```bash
kubectl get deployment,statefulset -n argocd -o custom-columns='NAME:.metadata.name,MEMORY_LIMIT:.spec.template.spec.containers[0].resources.limits.memory'
```

### Rollback if a chart upgrade misbehaves

```bash
helm -n argocd history argocd
helm -n argocd rollback argocd <previous-revision>
```

## History

- **2026-08-23**: Switched to the community Helm chart, bumped to `v3.5.1` / chart `10.4.0` (DEV-519).
- **2026-07-12**: Added resource limits via kustomization to prevent OOM incidents (DEV-281).
- **2026-07-11**: Initial deployment (vendored `install.yaml`).