basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

feat(argocd): switch to community Helm chart (DEV-521) #4

Merged
forgejoadmin merged 1 commit from feat/DEV-521-argocd-helm into main 2026-08-23 10:11:26 +00:00
Conversation 0 Commits 1 Files changed 5 +152 -33487
forgejoadmin commented 2026-08-23 08:32:58 +00:00
Owner
Copy link

Summary

Switch Argo CD from the vendored apps/argocd/argocd-install.yaml (~33k lines) to the community Helm chart (argoproj/argo-helm, chart argo-cd 10.4.0, app v3.5.1).

Git-only preparation for DEV-519. Do not merge yet — the bootstrap-window ticket (DEV-519 child) will merge this during the destructive cutover.

Changes

  • New apps/argocd/values.yaml — chart values file (global.image.tag: v3.5.1, configs.cm with URL / OIDC / resource-exclusions, configs.rbac with argo_admins -> role:admin, per-component memory limits from DEV-281, chart ingress disabled).
  • Rewrite apps/argocd/kustomization.yaml — only wraps argocd-ingress.yaml + the three SealedSecrets. Six memory-limit JSON patches removed (now driven by values.yaml).
  • Delete apps/argocd/argocd-install.yaml.
  • Rewrite apps/app-argocd.yaml — multi-source Application (helm chart at argoproj/argo-helm + this repo at ref: values). Adds ServerSideApply=true, ApplyOutOfSyncOnly=true, CreateNamespace=true, and pins the resources-finalizer.argocd.argoproj.io finalizer explicitly.
  • Rewrite apps/argocd/README.md — replace the "download install.yaml" bump procedure with the Helm bump procedure (helm repo update, helm search repo argo/argo-cd, bump targetRevision + global.image.tag together).

Unchanged files verified still present: argocd-ingress.yaml, argocd-oidc-secret-sealed.yaml, repo-basicstack-org-secret-sealed.yaml, repo-stack-basicstack-de-secret-sealed.yaml.

Verification

$ helm template argocd argo/argo-cd --version 10.4.0 -f apps/argocd/values.yaml -n argocd
# exit 0, 34379 lines rendered
$ grep -c 'image: quay.io/argoproj/argocd:v3.5.1' <output>
8
$ kustomize build apps/argocd/
# exit 0, renders 1 Ingress + 3 SealedSecrets

Rendered chart output includes:

  • configs.cm.url: https://argo.basicstack.de
  • oidc.config with Pocket ID issuer, $oidc.pocketid.clientId placeholders (secret unchanged)
  • policy.csv with g, argo_admins, role:admin and full admin policy
  • resource.exclusions matching today's Cilium + Kyverno exclusions verbatim
  • Memory limits on controller / repo-server / server / redis / notifications / applicationset (all matching pre-migration values)
  • No Ingress (chart's ingress disabled; ours stays in kustomize with cert-manager + Traefik annotations intact)

Related

  • Parent: DEV-519 — Switch Argo CD to Helm chart
  • This ticket: DEV-521 — Prepare git PR

🤖 Generated with Claude Code

## Summary Switch Argo CD from the vendored `apps/argocd/argocd-install.yaml` (~33k lines) to the community Helm chart (`argoproj/argo-helm`, chart `argo-cd 10.4.0`, app `v3.5.1`). Git-only preparation for [DEV-519](/DEV/issues/DEV-519). **Do not merge yet** — the bootstrap-window ticket ([DEV-519](/DEV/issues/DEV-519) child) will merge this during the destructive cutover. ## Changes - **New** `apps/argocd/values.yaml` — chart values file (`global.image.tag: v3.5.1`, `configs.cm` with URL / OIDC / resource-exclusions, `configs.rbac` with `argo_admins` -> `role:admin`, per-component memory limits from DEV-281, chart ingress disabled). - **Rewrite** `apps/argocd/kustomization.yaml` — only wraps `argocd-ingress.yaml` + the three SealedSecrets. Six memory-limit JSON patches removed (now driven by `values.yaml`). - **Delete** `apps/argocd/argocd-install.yaml`. - **Rewrite** `apps/app-argocd.yaml` — multi-source `Application` (helm chart at `argoproj/argo-helm` + this repo at `ref: values`). Adds `ServerSideApply=true`, `ApplyOutOfSyncOnly=true`, `CreateNamespace=true`, and pins the `resources-finalizer.argocd.argoproj.io` finalizer explicitly. - **Rewrite** `apps/argocd/README.md` — replace the "download install.yaml" bump procedure with the Helm bump procedure (`helm repo update`, `helm search repo argo/argo-cd`, bump `targetRevision` + `global.image.tag` together). Unchanged files verified still present: `argocd-ingress.yaml`, `argocd-oidc-secret-sealed.yaml`, `repo-basicstack-org-secret-sealed.yaml`, `repo-stack-basicstack-de-secret-sealed.yaml`. ## Verification ``` $ helm template argocd argo/argo-cd --version 10.4.0 -f apps/argocd/values.yaml -n argocd # exit 0, 34379 lines rendered $ grep -c 'image: quay.io/argoproj/argocd:v3.5.1' <output> 8 $ kustomize build apps/argocd/ # exit 0, renders 1 Ingress + 3 SealedSecrets ``` Rendered chart output includes: - `configs.cm.url: https://argo.basicstack.de` - `oidc.config` with Pocket ID issuer, `$oidc.pocketid.clientId` placeholders (secret unchanged) - `policy.csv` with `g, argo_admins, role:admin` and full admin policy - `resource.exclusions` matching today's Cilium + Kyverno exclusions verbatim - Memory limits on controller / repo-server / server / redis / notifications / applicationset (all matching pre-migration values) - No `Ingress` (chart's ingress disabled; ours stays in kustomize with cert-manager + Traefik annotations intact) ## Related - Parent: [DEV-519](/DEV/issues/DEV-519) — Switch Argo CD to Helm chart - This ticket: [DEV-521](/DEV/issues/DEV-521) — Prepare git PR 🤖 Generated with [Claude Code](https://claude.com/claude-code)
forgejoadmin added 1 commit 2026-08-23 08:32:58 +00:00 
Replace the vendored ~33k-line apps/argocd/argocd-install.yaml with the
argoproj/argo-helm chart argo-cd 10.4.0 (app v3.5.1). Values live in
apps/argocd/values.yaml; the local kustomize wrapper now only carries the
Traefik ingress and the sealed secrets. The root apps/app-argocd.yaml
Application becomes multi-source (chart + this repo as $values), enables
ServerSideApply + ApplyOutOfSyncOnly, and pins the resources-finalizer
explicitly.

Behavior-equivalent to the previous install: same URL, OIDC (Pocket ID),
argo_admins RBAC mapping, resource.exclusions list, and per-component
memory limits (DEV-281). Ingress is disabled in the chart; ours stays in
kustomize with cert-manager letsencrypt-prod annotations.

README.md updated with the Helm bump procedure. argocd-install.yaml
removed.

Verified locally:
  helm template argocd argo/argo-cd --version 10.4.0 \
    -f apps/argocd/values.yaml -n argocd
  # renders 34k lines, image: quay.io/argoproj/argocd:v3.5.1
  kustomize build apps/argocd/
  # renders 1 Ingress + 3 SealedSecrets, no errors

Refs: DEV-521, plan DEV-519 §3, §8.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
forgejoadmin merged commit 82de4507a8 into main 2026-08-23 10:11:26 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: basicstack/stack.basicstack.de#4
No description provided.
Delete branch "feat/DEV-521-argocd-helm"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?