08292bd449
Re-sealed the three Argo CD secrets with namespace: argocd instead of namespace: paperclip to match the kustomization.yaml deployment target. The sealed-secrets controller was failing to unseal these because they were encrypted for the 'paperclip' namespace but Kustomize was deploying them to the 'argocd' namespace. Sealed secrets use strict scope by default, so namespace/name must match exactly. Fixed files: - apps/argocd/argocd-oidc-secret-sealed.yaml - apps/argocd/repo-basicstack-org-secret-sealed.yaml - apps/argocd/repo-stack-basicstack-de-secret-sealed.yaml Root cause: DEV-284 investigation revealed controller error logs showing "no key could decrypt secret" for all three Argo CD sealed secrets. Co-Authored-By: Paperclip <noreply@paperclip.ing> |
||
|---|---|---|
| .. | ||
| argocd-ingress.yaml | ||
| argocd-install.yaml | ||
| argocd-oidc-secret-sealed.yaml | ||
| kustomization.yaml | ||
| README.md | ||
| repo-basicstack-org-secret-sealed.yaml | ||
| repo-stack-basicstack-de-secret-sealed.yaml | ||
Argo CD Deployment
This directory contains the Argo CD deployment configuration for the basicstack.de k3s cluster.
Files
argocd-install.yaml- Auto-generated Argo CD installation manifest (DO NOT EDIT DIRECTLY)kustomization.yaml- Kustomize overlay that adds resource limits and other customizationsargocd-ingress.yaml- Ingress configuration for Argo CD UIargocd-oidc-secret-sealed.yaml- Sealed secret for OIDC integrationrepo-*.yaml- Sealed secrets for Git repository access
Resource Limits
IMPORTANT: Resource limits were added after DEV-281 (resource exhaustion incident on 2026-07-12).
All Argo CD components now have memory limits to prevent OOM incidents:
| Component | Memory Limit | Memory Request |
|---|---|---|
| application-controller | 512Mi | 256Mi |
| repo-server | 512Mi | 256Mi |
| redis | 256Mi | 128Mi |
| server | 256Mi | 128Mi |
| notifications-controller | 128Mi | 64Mi |
| applicationset-controller | 256Mi | 128Mi |
These limits are based on observed usage patterns and provide headroom while preventing unlimited memory consumption.
Deployment
Option 1: Apply with kustomize (RECOMMENDED)
kubectl apply -k apps/argocd/
This will apply the base manifests plus all patches defined in kustomization.yaml.
Option 2: Direct apply (not recommended)
kubectl apply -f apps/argocd/argocd-install.yaml
kubectl apply -f apps/argocd/argocd-ingress.yaml
# etc.
Note: This skips the resource limit patches and is NOT recommended.
Updating Argo CD
When updating to a new Argo CD version:
-
Download the new install manifest:
curl -sSL https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml > argocd-install.yaml -
Apply with kustomize (resource limits will be automatically applied):
kubectl apply -k apps/argocd/ -
Verify resource limits are in place:
kubectl get statefulset,deployment -n argocd -o custom-columns='NAME:.metadata.name,MEMORY_LIMIT:.spec.template.spec.containers[0].resources.limits.memory'
Troubleshooting
Check resource usage
kubectl top pods -n argocd
Check if resource limits are applied
kubectl get deployment,statefulset -n argocd -o json | jq '.items[] | {name: .metadata.name, limits: .spec.template.spec.containers[0].resources.limits}'
Rollback if needed
If there are issues after applying resource limits:
# Remove limits from a specific component
kubectl patch deployment -n argocd argocd-server --type='json' -p='[{"op": "remove", "path": "/spec/template/spec/containers/0/resources"}]'
History
- 2026-07-12: Added resource limits via kustomization to prevent OOM incidents (DEV-281)
- 2026-07-11: Initial deployment