feat(argocd): switch to community Helm chart (DEV-521)

Migrate Argo CD self-install to community Helm chart argo-cd 10.4.0 (appVersion v3.5.1). Executed in DEV-522 destructive window.

apps/app-argocd.yaml

@@ -3,16 +3,27 @@ kind: Application
 metadata:
   name: argocd
   namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
 spec:
   project: default
-  source:
-    repoURL: git@forgejo.forgejo.svc.cluster.local:basicstack/stack.basicstack.de.git
-    targetRevision: main
-    path: apps/argocd
   destination:
     server: https://kubernetes.default.svc
     namespace: argocd
+  sources:
+    - repoURL: https://argoproj.github.io/argo-helm
+      chart: argo-cd
+      targetRevision: 10.4.0
+      helm:
+        releaseName: argocd
+        valueFiles:
+          - $values/apps/argocd/values.yaml
+    - repoURL: git@forgejo.forgejo.svc.cluster.local:basicstack/stack.basicstack.de.git
+      targetRevision: main
+      path: apps/argocd
+      ref: values
   syncPolicy:
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true
+      - ApplyOutOfSyncOnly=true

apps/argocd/README.md

@@ -2,19 +2,28 @@
 
 This directory contains the Argo CD deployment configuration for the basicstack.de k3s cluster.
 
+Argo CD itself is installed from the community Helm chart (`argoproj/argo-helm`, chart `argo-cd`). This directory holds the chart values file plus a small kustomize wrapper for the ingress and sealed secrets that stay in git.
+
 ## Files
 
-- `argocd-install.yaml` - Auto-generated Argo CD installation manifest (DO NOT EDIT DIRECTLY)
+- `values.yaml` - Helm values for the `argo-cd` chart (image tag, OIDC/RBAC config, resource limits, ingress disabled).
-- `kustomization.yaml` - Kustomize overlay that adds resource limits and other customizations
+- `kustomization.yaml` - Kustomize wrapper for the ingress + sealed secrets (does NOT install Argo CD itself).
-- `argocd-ingress.yaml` - Ingress configuration for Argo CD UI
+- `argocd-ingress.yaml` - Ingress configuration for the Argo CD UI (Traefik + cert-manager `letsencrypt-prod`).
-- `argocd-oidc-secret-sealed.yaml` - Sealed secret for OIDC integration
+- `argocd-oidc-secret-sealed.yaml` - Sealed secret for Pocket ID OIDC integration.
-- `repo-*.yaml` - Sealed secrets for Git repository access
+- `repo-*.yaml` - Sealed secrets for Git repository access.
 
-## Resource Limits
+## How the install is wired
 
-**IMPORTANT**: Resource limits were added after DEV-281 (resource exhaustion incident on 2026-07-12).
+The root [`../app-argocd.yaml`](../app-argocd.yaml) is an Argo CD `Application` with two sources:
 
-All Argo CD components now have memory limits to prevent OOM incidents:
+1. The public Helm chart at `https://argoproj.github.io/argo-helm`, chart `argo-cd`, `targetRevision` pinned in git.
+2. This repo (`ref: values`) providing the `values.yaml` used by source (1) AND the ingress/sealed secrets applied via `kustomize`.
+
+Once bootstrapped, Argo CD manages its own install by syncing this Application.
+
+## Resource limits
+
+Memory limits were added after DEV-281 (resource exhaustion incident on 2026-07-12) and are now driven by `values.yaml`:
 
 | Component | Memory Limit | Memory Request |
 |-----------|--------------|----------------|
@@ -25,46 +34,51 @@ All Argo CD components now have memory limits to prevent OOM incidents:
 | notifications-controller | 128Mi | 64Mi |
 | applicationset-controller | 256Mi | 128Mi |
 
-These limits are based on observed usage patterns and provide headroom while preventing unlimited memory consumption.
-
 ## Deployment
 
-### Option 1: Apply with kustomize (RECOMMENDED)
+### Steady state (managed by Argo CD)
+
+Once the cluster is bootstrapped, changes to this directory are picked up by the root `argocd` Application on the next sync. No manual `kubectl apply` is required.
+
+### First-time / disaster-recovery bootstrap
+
+Argo CD cannot install itself while it is gone. Bootstrap with helm, then hand ownership back:
 
 ```bash
-kubectl apply -k apps/argocd/
+helm repo add argo https://argoproj.github.io/argo-helm
+helm repo update
+helm install argocd argo/argo-cd \
+  --version 10.4.0 \
+  --namespace argocd --create-namespace \
+  --values apps/argocd/values.yaml \
+  --wait --timeout 10m
+
+kubectl apply -k apps/argocd/          # ingress + sealed secrets
+kubectl apply -f apps/app-argocd.yaml  # hand ownership back to GitOps
 ```
 
-This will apply the base manifests plus all patches defined in `kustomization.yaml`.
-
-### Option 2: Direct apply (not recommended)
-
-```bash
-kubectl apply -f apps/argocd/argocd-install.yaml
-kubectl apply -f apps/argocd/argocd-ingress.yaml
-# etc.
-```
-
-**Note**: This skips the resource limit patches and is NOT recommended.
-
 ## Updating Argo CD
 
-When updating to a new Argo CD version:
+Bump the chart and the image tag in a single PR:
 
-1. Download the new install manifest:
+1. Refresh the local helm repo cache and check what's available:
    ```bash
-   curl -sSL https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml > argocd-install.yaml
+   helm repo update
+   helm search repo argo/argo-cd --versions | head
    ```
 
-2. Apply with kustomize (resource limits will be automatically applied):
+2. Bump both fields together, keeping them in sync with the chart's `appVersion`:
+   - `apps/app-argocd.yaml` -> `spec.sources[0].targetRevision` (chart version, e.g. `10.4.0`)
+   - `apps/argocd/values.yaml` -> `global.image.tag` (app version, e.g. `v3.5.1`)
+
+3. Optionally render locally to sanity-check the output before opening the PR:
    ```bash
-   kubectl apply -k apps/argocd/
+   helm template argocd argo/argo-cd \
+     --version <new-chart-version> \
+     -f apps/argocd/values.yaml -n argocd | less
    ```
 
-3. Verify resource limits are in place:
+4. Open the PR. After merge, Argo CD syncs itself onto the new version.
-   ```bash
-   kubectl get statefulset,deployment -n argocd -o custom-columns='NAME:.metadata.name,MEMORY_LIMIT:.spec.template.spec.containers[0].resources.limits.memory'
-   ```
 
 ## Troubleshooting
 
@@ -74,22 +88,21 @@ When updating to a new Argo CD version:
 kubectl top pods -n argocd
 ```
 
-### Check if resource limits are applied
+### Check applied resource limits
 
 ```bash
-kubectl get deployment,statefulset -n argocd -o json | jq '.items[] | {name: .metadata.name, limits: .spec.template.spec.containers[0].resources.limits}'
+kubectl get deployment,statefulset -n argocd -o custom-columns='NAME:.metadata.name,MEMORY_LIMIT:.spec.template.spec.containers[0].resources.limits.memory'
 ```
 
-### Rollback if needed
+### Rollback if a chart upgrade misbehaves
-
-If there are issues after applying resource limits:
 
 ```bash
-# Remove limits from a specific component
+helm -n argocd history argocd
-kubectl patch deployment -n argocd argocd-server --type='json' -p='[{"op": "remove", "path": "/spec/template/spec/containers/0/resources"}]'
+helm -n argocd rollback argocd <previous-revision>
 ```
 
 ## History
 
-- **2026-07-12**: Added resource limits via kustomization to prevent OOM incidents (DEV-281)
+- **2026-08-23**: Switched to the community Helm chart, bumped to `v3.5.1` / chart `10.4.0` (DEV-519).
-- **2026-07-11**: Initial deployment
+- **2026-07-12**: Added resource limits via kustomization to prevent OOM incidents (DEV-281).
+- **2026-07-11**: Initial deployment (vendored `install.yaml`).

apps/argocd/kustomization.yaml

@@ -4,82 +4,7 @@ kind: Kustomization
 namespace: argocd
 
 resources:
-  - argocd-install.yaml
   - argocd-ingress.yaml
   - argocd-oidc-secret-sealed.yaml
   - repo-basicstack-org-secret-sealed.yaml
   - repo-stack-basicstack-de-secret-sealed.yaml
-
-patches:
-  # Add memory limits to prevent OOM incidents (DEV-281)
-  - target:
-      kind: StatefulSet
-      name: argocd-application-controller
-    patch: |-
-      - op: add
-        path: /spec/template/spec/containers/0/resources
-        value:
-          limits:
-            memory: 512Mi
-          requests:
-            memory: 256Mi
-
-  - target:
-      kind: Deployment
-      name: argocd-repo-server
-    patch: |-
-      - op: add
-        path: /spec/template/spec/containers/0/resources
-        value:
-          limits:
-            memory: 512Mi
-          requests:
-            memory: 256Mi
-
-  - target:
-      kind: Deployment
-      name: argocd-redis
-    patch: |-
-      - op: add
-        path: /spec/template/spec/containers/0/resources
-        value:
-          limits:
-            memory: 256Mi
-          requests:
-            memory: 128Mi
-
-  - target:
-      kind: Deployment
-      name: argocd-server
-    patch: |-
-      - op: add
-        path: /spec/template/spec/containers/0/resources
-        value:
-          limits:
-            memory: 256Mi
-          requests:
-            memory: 128Mi
-
-  - target:
-      kind: Deployment
-      name: argocd-notifications-controller
-    patch: |-
-      - op: add
-        path: /spec/template/spec/containers/0/resources
-        value:
-          limits:
-            memory: 128Mi
-          requests:
-            memory: 64Mi
-
-  - target:
-      kind: Deployment
-      name: argocd-applicationset-controller
-    patch: |-
-      - op: add
-        path: /spec/template/spec/containers/0/resources
-        value:
-          limits:
-            memory: 256Mi
-          requests:
-            memory: 128Mi

apps/argocd/values.yaml

@@ -0,0 +1,80 @@
+global:
+  image:
+    tag: v3.5.1
+
+configs:
+  cm:
+    url: https://argo.basicstack.de
+    application.instanceLabelKey: argocd.argoproj.io/instance
+    resource.exclusions: |
+      - apiGroups: [cilium.io]
+        kinds: [CiliumIdentity, CiliumEndpoint, CiliumEndpointSlice]
+      - apiGroups: [kyverno.io, reports.kyverno.io, wgpolicyk8s.io]
+        kinds: [PolicyReport, ClusterPolicyReport, EphemeralReport,
+                ClusterEphemeralReport, AdmissionReport, ClusterAdmissionReport,
+                BackgroundScanReport, ClusterBackgroundScanReport, UpdateRequest]
+    oidc.config: |
+      name: Pocket ID
+      issuer: https://auth.basicstack.de
+      clientID: $oidc.pocketid.clientId
+      clientSecret: $oidc.pocketid.clientSecret
+      requestedScopes: [openid, profile, email, groups]
+      requestedIDTokenClaims:
+        groups: {essential: true}
+
+  rbac:
+    policy.default: role:readonly
+    policy.csv: |
+      g, argo_admins, role:admin
+      p, role:admin, applications, *, */*, allow
+      p, role:admin, clusters, *, *, allow
+      p, role:admin, repositories, *, *, allow
+      p, role:admin, projects, *, *, allow
+      p, role:admin, accounts, *, *, allow
+      p, role:admin, gpgkeys, *, *, allow
+      p, role:admin, certificates, *, *, allow
+      p, role:admin, exec, *, *, allow
+
+controller:
+  resources:
+    requests:
+      memory: 256Mi
+    limits:
+      memory: 512Mi
+
+repoServer:
+  resources:
+    requests:
+      memory: 256Mi
+    limits:
+      memory: 512Mi
+
+server:
+  resources:
+    requests:
+      memory: 128Mi
+    limits:
+      memory: 256Mi
+  ingress:
+    enabled: false
+
+redis:
+  resources:
+    requests:
+      memory: 128Mi
+    limits:
+      memory: 256Mi
+
+notifications:
+  resources:
+    requests:
+      memory: 64Mi
+    limits:
+      memory: 128Mi
+
+applicationSet:
+  resources:
+    requests:
+      memory: 128Mi
+    limits:
+      memory: 256Mi