basicstack/stack.basicstack.de

CTO Agent 43610fb16d feat(argocd): switch to community Helm chart (DEV-519)

Replace the vendored ~33k-line apps/argocd/argocd-install.yaml with the
argoproj/argo-helm chart argo-cd 10.4.0 (app v3.5.1). Values live in
apps/argocd/values.yaml; the local kustomize wrapper now only carries the
Traefik ingress and the sealed secrets. The root apps/app-argocd.yaml
Application becomes multi-source (chart + this repo as $values), enables
ServerSideApply + ApplyOutOfSyncOnly, and pins the resources-finalizer
explicitly.

Behavior-equivalent to the previous install: same URL, OIDC (Pocket ID),
argo_admins RBAC mapping, resource.exclusions list, and per-component
memory limits (DEV-281). Ingress is disabled in the chart; ours stays in
kustomize with cert-manager letsencrypt-prod annotations.

README.md updated with the Helm bump procedure. argocd-install.yaml
removed.

Verified locally:
  helm template argocd argo/argo-cd --version 10.4.0 \
    -f apps/argocd/values.yaml -n argocd
  # renders 34k lines, image: quay.io/argoproj/argocd:v3.5.1
  kustomize build apps/argocd/
  # renders 1 Ingress + 3 SealedSecrets, no errors

Refs: DEV-521, plan DEV-519 §3, §8.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

2026-08-23 08:32:23 +00:00

3.9 KiB

Raw Permalink Blame History

Argo CD Deployment

This directory contains the Argo CD deployment configuration for the basicstack.de k3s cluster.

Argo CD itself is installed from the community Helm chart (argoproj/argo-helm, chart argo-cd). This directory holds the chart values file plus a small kustomize wrapper for the ingress and sealed secrets that stay in git.

Files

values.yaml - Helm values for the argo-cd chart (image tag, OIDC/RBAC config, resource limits, ingress disabled).
kustomization.yaml - Kustomize wrapper for the ingress + sealed secrets (does NOT install Argo CD itself).
argocd-ingress.yaml - Ingress configuration for the Argo CD UI (Traefik + cert-manager letsencrypt-prod).
argocd-oidc-secret-sealed.yaml - Sealed secret for Pocket ID OIDC integration.
repo-*.yaml - Sealed secrets for Git repository access.

How the install is wired

The root ../app-argocd.yaml is an Argo CD Application with two sources:

The public Helm chart at https://argoproj.github.io/argo-helm, chart argo-cd, targetRevision pinned in git.
This repo (ref: values) providing the values.yaml used by source (1) AND the ingress/sealed secrets applied via kustomize.

Once bootstrapped, Argo CD manages its own install by syncing this Application.

Resource limits

Memory limits were added after DEV-281 (resource exhaustion incident on 2026-07-12) and are now driven by values.yaml:

Component	Memory Limit	Memory Request
application-controller	512Mi	256Mi
repo-server	512Mi	256Mi
redis	256Mi	128Mi
server	256Mi	128Mi
notifications-controller	128Mi	64Mi
applicationset-controller	256Mi	128Mi

Deployment

Steady state (managed by Argo CD)

Once the cluster is bootstrapped, changes to this directory are picked up by the root argocd Application on the next sync. No manual kubectl apply is required.

First-time / disaster-recovery bootstrap

Argo CD cannot install itself while it is gone. Bootstrap with helm, then hand ownership back:

helm repo add argo https://argoproj.github.io/argo-helm
helm repo update
helm install argocd argo/argo-cd \
  --version 10.4.0 \
  --namespace argocd --create-namespace \
  --values apps/argocd/values.yaml \
  --wait --timeout 10m

kubectl apply -k apps/argocd/          # ingress + sealed secrets
kubectl apply -f apps/app-argocd.yaml  # hand ownership back to GitOps

Updating Argo CD

Bump the chart and the image tag in a single PR:

Refresh the local helm repo cache and check what's available:

helm repo update
helm search repo argo/argo-cd --versions | head

Bump both fields together, keeping them in sync with the chart's appVersion:
- apps/app-argocd.yaml -> spec.sources[0].targetRevision (chart version, e.g. 10.4.0)
- apps/argocd/values.yaml -> global.image.tag (app version, e.g. v3.5.1)

Optionally render locally to sanity-check the output before opening the PR:

helm template argocd argo/argo-cd \
  --version <new-chart-version> \
  -f apps/argocd/values.yaml -n argocd | less

Open the PR. After merge, Argo CD syncs itself onto the new version.

Troubleshooting

Check resource usage

kubectl top pods -n argocd

Check applied resource limits

kubectl get deployment,statefulset -n argocd -o custom-columns='NAME:.metadata.name,MEMORY_LIMIT:.spec.template.spec.containers[0].resources.limits.memory'

Rollback if a chart upgrade misbehaves

helm -n argocd history argocd
helm -n argocd rollback argocd <previous-revision>

History

2026-08-23: Switched to the community Helm chart, bumped to v3.5.1 / chart 10.4.0 (DEV-519).
2026-07-12: Added resource limits via kustomization to prevent OOM incidents (DEV-281).
2026-07-11: Initial deployment (vendored install.yaml).

3.9 KiB Raw Permalink Blame History