Initial argo deployment

cluster/argocd/BOOTSTRAP.md

@@ -0,0 +1,136 @@
+# fastpass GitOps Bootstrap
+
+This document is the complete procedure to go from a freshly provisioned Talos
+cluster to a fully GitOps-managed platform. After completing these steps, all
+future changes are made via git — never `kubectl apply` again.
+
+## Prerequisites
+
+- Talos cluster running (`space-mountain`, `big-thunder-mountain`, `splash-mountain` CP nodes)
+- Cilium installed as CNI (done at Talos bootstrap via talhelper)
+- `kubectl` configured and pointing at `fastpass`
+- `kubeconfig` on `city-hall` at `~/.kube/config`
+- 1Password Connect credentials JSON downloaded from your 1Password account
+  (Developer Tools > Connect Servers > New Server)
+- 1Password Connect token generated for the `mk-labs` vault
+
+## Step 1 — Install ArgoCD
+
+This is the only `kubectl apply` you will ever run against this cluster.
+
+```bash
+kubectl create namespace argocd
+
+kubectl apply -n argocd \
+  --server-side \
+  --force-conflicts \
+  -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.2/manifests/install.yaml
+
+# Wait for ArgoCD to be healthy
+kubectl wait --for=condition=available deployment/argocd-server \
+  -n argocd --timeout=120s
+```
+
+## Step 2 — Bootstrap the 1Password Connect secret
+
+This is the only secret you will ever manage manually. Everything else flows
+through ESO from here.
+
+```bash
+# Create the namespace first
+kubectl create namespace onepassword-connect
+
+# Apply the credentials file (downloaded from 1Password)
+kubectl create secret generic op-credentials \
+  --from-file=1password-credentials.json=/path/to/1password-credentials.json \
+  -n onepassword-connect
+
+# Apply the Connect API token
+kubectl create secret generic connect-token \
+  --from-literal=token=<your-connect-token> \
+  -n onepassword-connect
+```
+
+## Step 3 — Apply the App of Apps
+
+This is the second and final manual apply. From this point on, ArgoCD manages
+everything, including itself.
+
+```bash
+kubectl apply -n argocd -f cluster/argocd/apps-of-apps.yaml
+```
+
+## Step 4 — Watch it go
+
+```bash
+# Watch all Applications come up in wave order
+kubectl get applications -n argocd -w
+
+# Or use the ArgoCD UI
+kubectl port-forward svc/argocd-server -n argocd 8080:443
+# Then open https://localhost:8080
+# Default admin password:
+kubectl -n argocd get secret argocd-initial-admin-secret \
+  -o jsonpath="{.data.password}" | base64 -d
+```
+
+## Step 2.5 — Vendor Gateway API CRDs
+
+Before applying the App of Apps, vendor the Gateway API CRDs into git.
+Run from the repo root on city-hall:
+
+```bash
+curl -L https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.1/standard-install.yaml \
+  -o cluster/platform/gateway-api/manifests/standard-install.yaml
+
+curl -L https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.1/experimental-install.yaml \
+  -o cluster/platform/gateway-api/manifests/experimental-install.yaml
+
+git add cluster/platform/gateway-api/manifests/
+git commit -m "feat(platform): vendor gateway-api CRDs v1.2.1"
+git push
+```
+
+## Wave Order
+
+| Wave | Application         | Depends On                      |
+|------|---------------------|---------------------------------|
+| 1    | external-secrets    | (none)                          |
+| 2    | onepassword-connect | external-secrets                |
+| 3    | cert-manager        | onepassword-connect (CF secret) |
+| 3    | gateway-api-crds    | (none — CRDs only)              |
+| 4    | cilium-config       | gateway-api-crds (CRDs exist)   |
+| 5    | ingress-nginx       | cilium-config (LB pool)         |
+| 5    | gateway (resource)  | cilium-config (GatewayClass)    |
+| 6    | external-dns        | ingress-nginx (IP to register)  |
+| 10+  | applications/*      | platform complete               |
+
+## Upgrading ArgoCD
+
+```bash
+kubectl apply -n argocd \
+  --server-side \
+  --force-conflicts \
+  -f https://raw.githubusercontent.com/argoproj/argo-cd/v<NEW_VERSION>/manifests/install.yaml
+```
+
+Update the version comment in `cluster/argocd/install.yaml` to match.
+
+## Troubleshooting
+
+```bash
+# Check sync status of all apps
+kubectl get applications -n argocd
+
+# Check why an app is out of sync
+kubectl describe application <name> -n argocd
+
+# Force a sync
+kubectl patch application <name> -n argocd \
+  --type merge \
+  -p '{"operation": {"initiatedBy": {"username": "admin"}, "sync": {}}}'
+
+# Check ESO secret sync
+kubectl get externalsecret -A
+kubectl describe externalsecret <name> -n <namespace>
+```

cluster/argocd/apps-of-apps.yaml

@@ -0,0 +1,45 @@
+# ------------------------------------------------------------------------------
+# App of Apps — Root
+#
+# This is applied ONCE after ArgoCD is bootstrapped. It is the second and
+# final manual kubectl apply:
+#
+#   kubectl apply -n argocd -f cluster/argocd/apps-of-apps.yaml
+#
+# From this point forward, all changes are made via git. ArgoCD self-manages.
+#
+# This Application watches cluster/platform/ and cluster/applications/ and
+# creates child Applications for everything it finds there.
+# ------------------------------------------------------------------------------
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: apps-of-apps
+  namespace: argocd
+  annotations:
+    # Wave 0 — this is the root, everything else comes after
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+    targetRevision: main
+    path: cluster
+    directory:
+      recurse: true
+      include: "*/application.yaml"
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+  ignoreDifferences:
+    - group: argoproj.io
+      kind: Application
+      jsonPointers:
+        - /spec/syncPolicy/automated

cluster/argocd/install.yaml

@@ -0,0 +1,21 @@
+# ------------------------------------------------------------------------------
+# ArgoCD Install — v3.4.2
+#
+# This is NOT applied by ArgoCD itself (chicken-and-egg).
+# It is the ONE manual bootstrap step:
+#
+#   kubectl create namespace argocd
+#   kubectl apply -n argocd --server-side --force-conflicts -f install.yaml
+#
+# After this, everything else is driven by apps-of-apps.yaml.
+#
+# To upgrade ArgoCD: update the version below and re-apply.
+# --server-side --force-conflicts is required due to CRD size limits.
+#
+# Source: https://github.com/argoproj/argo-cd/releases/tag/v3.4.2
+# ------------------------------------------------------------------------------
+# kubectl apply -n argocd --server-side --force-conflicts -f \
+#   https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.2/manifests/install.yaml
+#
+# We reference the upstream manifest directly rather than vendoring it.
+# Pin upgrades by changing the version tag above and re-running the command.

cluster/argocd/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: argocd