43610fb16d
Replace the vendored ~33k-line apps/argocd/argocd-install.yaml with the
argoproj/argo-helm chart argo-cd 10.4.0 (app v3.5.1). Values live in
apps/argocd/values.yaml; the local kustomize wrapper now only carries the
Traefik ingress and the sealed secrets. The root apps/app-argocd.yaml
Application becomes multi-source (chart + this repo as $values), enables
ServerSideApply + ApplyOutOfSyncOnly, and pins the resources-finalizer
explicitly.
Behavior-equivalent to the previous install: same URL, OIDC (Pocket ID),
argo_admins RBAC mapping, resource.exclusions list, and per-component
memory limits (DEV-281). Ingress is disabled in the chart; ours stays in
kustomize with cert-manager letsencrypt-prod annotations.
README.md updated with the Helm bump procedure. argocd-install.yaml
removed.
Verified locally:
helm template argocd argo/argo-cd --version 10.4.0 \
-f apps/argocd/values.yaml -n argocd
# renders 34k lines, image: quay.io/argoproj/argocd:v3.5.1
kustomize build apps/argocd/
# renders 1 Ingress + 3 SealedSecrets, no errors
Refs: DEV-521, plan DEV-519 §3, §8.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
108 lines
3.9 KiB
Markdown
108 lines
3.9 KiB
Markdown
# Argo CD Deployment
|
|
|
|
This directory contains the Argo CD deployment configuration for the basicstack.de k3s cluster.
|
|
|
|
Argo CD itself is installed from the community Helm chart (`argoproj/argo-helm`, chart `argo-cd`). This directory holds the chart values file plus a small kustomize wrapper for the ingress and sealed secrets that stay in git.
|
|
|
|
## Files
|
|
|
|
- `values.yaml` - Helm values for the `argo-cd` chart (image tag, OIDC/RBAC config, resource limits, ingress disabled).
|
|
- `kustomization.yaml` - Kustomize wrapper for the ingress + sealed secrets (does NOT install Argo CD itself).
|
|
- `argocd-ingress.yaml` - Ingress configuration for the Argo CD UI (Traefik + cert-manager `letsencrypt-prod`).
|
|
- `argocd-oidc-secret-sealed.yaml` - Sealed secret for Pocket ID OIDC integration.
|
|
- `repo-*.yaml` - Sealed secrets for Git repository access.
|
|
|
|
## How the install is wired
|
|
|
|
The root [`../app-argocd.yaml`](../app-argocd.yaml) is an Argo CD `Application` with two sources:
|
|
|
|
1. The public Helm chart at `https://argoproj.github.io/argo-helm`, chart `argo-cd`, `targetRevision` pinned in git.
|
|
2. This repo (`ref: values`) providing the `values.yaml` used by source (1) AND the ingress/sealed secrets applied via `kustomize`.
|
|
|
|
Once bootstrapped, Argo CD manages its own install by syncing this Application.
|
|
|
|
## Resource limits
|
|
|
|
Memory limits were added after DEV-281 (resource exhaustion incident on 2026-07-12) and are now driven by `values.yaml`:
|
|
|
|
| Component | Memory Limit | Memory Request |
|
|
|-----------|--------------|----------------|
|
|
| application-controller | 512Mi | 256Mi |
|
|
| repo-server | 512Mi | 256Mi |
|
|
| redis | 256Mi | 128Mi |
|
|
| server | 256Mi | 128Mi |
|
|
| notifications-controller | 128Mi | 64Mi |
|
|
| applicationset-controller | 256Mi | 128Mi |
|
|
|
|
## Deployment
|
|
|
|
### Steady state (managed by Argo CD)
|
|
|
|
Once the cluster is bootstrapped, changes to this directory are picked up by the root `argocd` Application on the next sync. No manual `kubectl apply` is required.
|
|
|
|
### First-time / disaster-recovery bootstrap
|
|
|
|
Argo CD cannot install itself while it is gone. Bootstrap with helm, then hand ownership back:
|
|
|
|
```bash
|
|
helm repo add argo https://argoproj.github.io/argo-helm
|
|
helm repo update
|
|
helm install argocd argo/argo-cd \
|
|
--version 10.4.0 \
|
|
--namespace argocd --create-namespace \
|
|
--values apps/argocd/values.yaml \
|
|
--wait --timeout 10m
|
|
|
|
kubectl apply -k apps/argocd/ # ingress + sealed secrets
|
|
kubectl apply -f apps/app-argocd.yaml # hand ownership back to GitOps
|
|
```
|
|
|
|
## Updating Argo CD
|
|
|
|
Bump the chart and the image tag in a single PR:
|
|
|
|
1. Refresh the local helm repo cache and check what's available:
|
|
```bash
|
|
helm repo update
|
|
helm search repo argo/argo-cd --versions | head
|
|
```
|
|
|
|
2. Bump both fields together, keeping them in sync with the chart's `appVersion`:
|
|
- `apps/app-argocd.yaml` -> `spec.sources[0].targetRevision` (chart version, e.g. `10.4.0`)
|
|
- `apps/argocd/values.yaml` -> `global.image.tag` (app version, e.g. `v3.5.1`)
|
|
|
|
3. Optionally render locally to sanity-check the output before opening the PR:
|
|
```bash
|
|
helm template argocd argo/argo-cd \
|
|
--version <new-chart-version> \
|
|
-f apps/argocd/values.yaml -n argocd | less
|
|
```
|
|
|
|
4. Open the PR. After merge, Argo CD syncs itself onto the new version.
|
|
|
|
## Troubleshooting
|
|
|
|
### Check resource usage
|
|
|
|
```bash
|
|
kubectl top pods -n argocd
|
|
```
|
|
|
|
### Check applied resource limits
|
|
|
|
```bash
|
|
kubectl get deployment,statefulset -n argocd -o custom-columns='NAME:.metadata.name,MEMORY_LIMIT:.spec.template.spec.containers[0].resources.limits.memory'
|
|
```
|
|
|
|
### Rollback if a chart upgrade misbehaves
|
|
|
|
```bash
|
|
helm -n argocd history argocd
|
|
helm -n argocd rollback argocd <previous-revision>
|
|
```
|
|
|
|
## History
|
|
|
|
- **2026-08-23**: Switched to the community Helm chart, bumped to `v3.5.1` / chart `10.4.0` (DEV-519).
|
|
- **2026-07-12**: Added resource limits via kustomization to prevent OOM incidents (DEV-281).
|
|
- **2026-07-11**: Initial deployment (vendored `install.yaml`).
|