added multica agent hosts

fastpass/argocd/apps-of-apps.yaml

@@ -0,0 +1,45 @@
+# ------------------------------------------------------------------------------
+# App of Apps — Root
+#
+# This is applied ONCE after ArgoCD is bootstrapped. It is the second and
+# final manual kubectl apply:
+#
+#   kubectl apply -n argocd -f cluster/argocd/apps-of-apps.yaml
+#
+# From this point forward, all changes are made via git. ArgoCD self-manages.
+#
+# This Application watches cluster/platform/ and cluster/applications/ and
+# creates child Applications for everything it finds there.
+# ------------------------------------------------------------------------------
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: apps-of-apps
+  namespace: argocd
+  annotations:
+    # Wave 0 — this is the root, everything else comes after
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: default
+  source:
+    repoURL: https://mad-tea-party.wdw-labs.cloud/rblundon/homelab.git
+    targetRevision: main
+    path: fastpass
+    directory:
+      recurse: true
+      include: "*/application.yaml"
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+  ignoreDifferences:
+    - group: argoproj.io
+      kind: Application
+      jsonPointers:
+        - /spec/syncPolicy/automated

fastpass/argocd/externalsecret.yaml

@@ -0,0 +1,29 @@
+# ------------------------------------------------------------------------------
+# ExternalSecret — Authentik OIDC credentials for ArgoCD
+#
+# Targets argocd-secret directly — ArgoCD reads oidc.authentik.* keys
+# from its own secret. ESO merges these fields into the existing secret
+# without overwriting admin.password etc. (creationPolicy: Merge)
+# ------------------------------------------------------------------------------
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: argocd-oidc-secret
+  namespace: argocd
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  refreshInterval: "1h"
+  target:
+    name: argocd-secret
+    creationPolicy: Merge
+  data:
+    - secretKey: oidc.authentik.clientID
+      remoteRef:
+        key: argocd-oidc
+        property: client-id
+    - secretKey: oidc.authentik.clientSecret
+      remoteRef:
+        key: argocd-oidc
+        property: client-secret

fastpass/argocd/install.yaml

@@ -0,0 +1,21 @@
+# ------------------------------------------------------------------------------
+# ArgoCD Install — v3.4.2
+#
+# This is NOT applied by ArgoCD itself (chicken-and-egg).
+# It is the ONE manual bootstrap step:
+#
+#   kubectl create namespace argocd
+#   kubectl apply -n argocd --server-side --force-conflicts -f install.yaml
+#
+# After this, everything else is driven by apps-of-apps.yaml.
+#
+# To upgrade ArgoCD: update the version below and re-apply.
+# --server-side --force-conflicts is required due to CRD size limits.
+#
+# Source: https://github.com/argoproj/argo-cd/releases/tag/v3.4.2
+# ------------------------------------------------------------------------------
+# kubectl apply -n argocd --server-side --force-conflicts -f \
+#   https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.2/manifests/install.yaml
+#
+# We reference the upstream manifest directly rather than vendoring it.
+# Pin upgrades by changing the version tag above and re-running the command.

fastpass/argocd/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: argocd

fastpass/argocd/values.yaml

@@ -0,0 +1,135 @@
+# ─── ArgoCD Helm values — fastpass cluster ─────────────────────────────────────
+# Chart:   argo/argo-cd
+# Version: 7.8.23
+#
+# Install:
+#   helm repo add argo https://argoproj.github.io/argo-helm
+#   helm repo update
+#   helm upgrade --install argocd argo/argo-cd \
+#     --namespace argocd \
+#     --create-namespace \
+#     --version 7.8.23 \
+#     --values cluster/argocd/values.yaml \
+#     --wait
+#
+# Then apply the root app-of-apps (second and final manual step):
+#   kubectl apply -n argocd -f cluster/argocd/apps-of-apps.yaml
+# ───────────────────────────────────────────────────────────────────────────────
+
+# ─── Global ─────────────────────────────────────────────────────────────────────
+global:
+  domain: carousel-of-progress.wdw-labs.cloud
+
+# ─── ArgoCD server ──────────────────────────────────────────────────────────────
+server:
+  # Run insecure — TLS is terminated at ingress-nginx, not at ArgoCD itself.
+  # Without this, ArgoCD redirects to HTTPS internally and breaks behind ingress.
+  extraArgs:
+    - --insecure
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: true
+  ingress:
+    enabled: true
+    ingressClassName: nginx
+    hostname: carousel-of-progress.wdw-labs.cloud
+    tls: true
+    annotations:
+      cert-manager.io/cluster-issuer: letsencrypt-prod
+      nginx.ingress.kubernetes.io/ssl-passthrough: "false"
+      nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+
+# ─── ConfigMap — core ArgoCD settings ───────────────────────────────────────────
+configs:
+  params:
+    server.insecure: "true"
+    server.session.duration: "720h"
+
+  cm:
+    url: https://carousel-of-progress.wdw-labs.cloud
+
+    # Authentik native OIDC SSO
+    # Client secret pulled from 1Password via ESO → argocd-oidc-secret
+    oidc.config: |
+      name: Authentik
+      issuer: https://authentik.local.mk-labs.cloud/application/o/argocd/
+      clientID: $oidc.authentik.clientID
+      clientSecret: $oidc.authentik.clientSecret
+      requestedScopes:
+        - openid
+        - profile
+        - email
+        - groups
+      groupsClaim: groups
+
+    # Resource health checks — ignore progressing Cilium CRDs
+    resource.customizations.health.cilium.io_CiliumLoadBalancerIPPool: |
+      hs = {}
+      hs.status = "Healthy"
+      hs.message = "IP pool ready"
+      return hs
+
+    # Ignore ESO-injected default fields on ExternalSecret resources.
+    resource.customizations.ignoreDifferences.external-secrets.io_ExternalSecret: |
+      jqPathExpressions:
+        - '.spec.data[]?.remoteRef?.conversionStrategy'
+        - '.spec.data[]?.remoteRef?.decodingStrategy'
+        - '.spec.data[]?.remoteRef?.metadataPolicy'
+        - '.spec.dataFrom[]?.extract?.conversionStrategy'
+        - '.spec.dataFrom[]?.extract?.decodingStrategy'
+        - '.spec.dataFrom[]?.extract?.metadataPolicy'
+
+  # RBAC — argocd-admins group from Authentik gets full access
+  rbac:
+    policy.default: role:readonly
+    policy.csv: |
+      g, argocd-admins, role:admin
+      g, argocd-viewers, role:readonly
+
+  # Repository credentials — Gitea SSH
+  repositories:
+    homelab-repo:
+      url: git@gitea.mk-labs.cloud:rblundon/homelab.git
+      name: homelab
+      type: git
+      insecure: "false"
+
+# ─── Redis ──────────────────────────────────────────────────────────────────────
+redis:
+  enabled: true
+
+# ─── Notifications ──────────────────────────────────────────────────────────────
+# Disabled for now — wire into n8n via webhook later
+notifications:
+  enabled: false
+
+# ─── ApplicationSet controller ──────────────────────────────────────────────────
+applicationSet:
+  enabled: true
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: true
+
+# ─── Dex ────────────────────────────────────────────────────────────────────────
+# Disabled — using Authentik as the native OIDC provider
+dex:
+  enabled: false
+
+# Disable default admin user
+admin:
+  enabled: false
+
+# Enable Prometheus metrics for ArgoCD
+controller:
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: true
+
+repoServer:
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: true