basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
93 commits 7 branches 0 tags 2.5 MiB
Commit graph

5 commits

Author SHA1 Message Date
CTO Agent
3eb4c7fe92 Fix argocd-rbac-cm ConfigMap YAML structure 
Move metadata.name and app.kubernetes.io/part-of label from data section
to proper metadata section.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 09:35:28 +00:00
CTO Agent
1ed15d98ea Fix argocd-cm ConfigMap YAML structure 
Move metadata.name and app.kubernetes.io/part-of label from data section
to proper metadata section. This was causing kustomize build failures.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 09:34:28 +00:00
CTO Agent
fe9301f891 Enable Argo CD self-management via dedicated Application 
Create app-argocd Application to manage argocd resources using kustomize.
Update stack Application exclusion to allow Application manifests while
excluding direct resource management (prevents namespace errors from
directory recursion bypassing kustomization).

Architecture:
- stack Application manages Application manifests (app-*.yaml)
- argocd Application manages argocd resources via kustomize
- Both Applications can self-manage through this pattern

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 09:25:19 +00:00
CTO Agent
8f537b8f82 Test Argo CD self-management with argocd-cm annotation 
Add test annotation to argocd-cm ConfigMap to verify that Argo CD
automatically syncs changes to its own configuration.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 09:22:39 +00:00
CTO Agent
a95e638f6b Add Argo CD installation manifests with Pocket ID SSO 
- Downloaded upstream Argo CD install.yaml from stable branch
- Customized for basicstack.de cluster:
  - Disabled dex deployment (using Pocket ID OIDC instead)
  - Added --insecure flag to argocd-server (TLS at Traefik ingress)
  - Configured OIDC integration with auth.basicstack.de
  - Added RBAC policy mapping argo_admins group to admin role
  - Mounted OIDC client credentials from argocd-oidc-secret
- Created Traefik ingress for argo.basicstack.de with cert-manager TLS

Sealed secrets for OIDC and repository credentials already in place.
Ready for deployment per DEV-249 plan.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 09:19:28 +00:00