43610fb16d
Replace the vendored ~33k-line apps/argocd/argocd-install.yaml with the
argoproj/argo-helm chart argo-cd 10.4.0 (app v3.5.1). Values live in
apps/argocd/values.yaml; the local kustomize wrapper now only carries the
Traefik ingress and the sealed secrets. The root apps/app-argocd.yaml
Application becomes multi-source (chart + this repo as $values), enables
ServerSideApply + ApplyOutOfSyncOnly, and pins the resources-finalizer
explicitly.
Behavior-equivalent to the previous install: same URL, OIDC (Pocket ID),
argo_admins RBAC mapping, resource.exclusions list, and per-component
memory limits (DEV-281). Ingress is disabled in the chart; ours stays in
kustomize with cert-manager letsencrypt-prod annotations.
README.md updated with the Helm bump procedure. argocd-install.yaml
removed.
Verified locally:
helm template argocd argo/argo-cd --version 10.4.0 \
-f apps/argocd/values.yaml -n argocd
# renders 34k lines, image: quay.io/argoproj/argocd:v3.5.1
kustomize build apps/argocd/
# renders 1 Ingress + 3 SealedSecrets, no errors
Refs: DEV-521, plan DEV-519 §3, §8.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
80 lines
1.8 KiB
YAML
80 lines
1.8 KiB
YAML
global:
|
|
image:
|
|
tag: v3.5.1
|
|
|
|
configs:
|
|
cm:
|
|
url: https://argo.basicstack.de
|
|
application.instanceLabelKey: argocd.argoproj.io/instance
|
|
resource.exclusions: |
|
|
- apiGroups: [cilium.io]
|
|
kinds: [CiliumIdentity, CiliumEndpoint, CiliumEndpointSlice]
|
|
- apiGroups: [kyverno.io, reports.kyverno.io, wgpolicyk8s.io]
|
|
kinds: [PolicyReport, ClusterPolicyReport, EphemeralReport,
|
|
ClusterEphemeralReport, AdmissionReport, ClusterAdmissionReport,
|
|
BackgroundScanReport, ClusterBackgroundScanReport, UpdateRequest]
|
|
oidc.config: |
|
|
name: Pocket ID
|
|
issuer: https://auth.basicstack.de
|
|
clientID: $oidc.pocketid.clientId
|
|
clientSecret: $oidc.pocketid.clientSecret
|
|
requestedScopes: [openid, profile, email, groups]
|
|
requestedIDTokenClaims:
|
|
groups: {essential: true}
|
|
|
|
rbac:
|
|
policy.default: role:readonly
|
|
policy.csv: |
|
|
g, argo_admins, role:admin
|
|
p, role:admin, applications, *, */*, allow
|
|
p, role:admin, clusters, *, *, allow
|
|
p, role:admin, repositories, *, *, allow
|
|
p, role:admin, projects, *, *, allow
|
|
p, role:admin, accounts, *, *, allow
|
|
p, role:admin, gpgkeys, *, *, allow
|
|
p, role:admin, certificates, *, *, allow
|
|
p, role:admin, exec, *, *, allow
|
|
|
|
controller:
|
|
resources:
|
|
requests:
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 512Mi
|
|
|
|
repoServer:
|
|
resources:
|
|
requests:
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 512Mi
|
|
|
|
server:
|
|
resources:
|
|
requests:
|
|
memory: 128Mi
|
|
limits:
|
|
memory: 256Mi
|
|
ingress:
|
|
enabled: false
|
|
|
|
redis:
|
|
resources:
|
|
requests:
|
|
memory: 128Mi
|
|
limits:
|
|
memory: 256Mi
|
|
|
|
notifications:
|
|
resources:
|
|
requests:
|
|
memory: 64Mi
|
|
limits:
|
|
memory: 128Mi
|
|
|
|
applicationSet:
|
|
resources:
|
|
requests:
|
|
memory: 128Mi
|
|
limits:
|
|
memory: 256Mi
|