Initial argo deployment

cluster/platform/argocd/certificate.yaml

@@ -0,0 +1,41 @@
+# ------------------------------------------------------------------------------
+# Certificate — ArgoCD TLS
+# Issued by cert-manager via letsencrypt-prod + Cloudflare DNS-01
+#
+# The secret produced (argocd-tls) is referenced by the Gateway listener
+# in cluster/platform/gateway-api/gateway.yaml via ReferenceGrant.
+#
+# Per the thematic naming convention: argocd.local.mk-labs.cloud is the
+# service DNS name. No VM hostname alias needed here.
+# ------------------------------------------------------------------------------
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: argocd-tls
+  namespace: argocd
+spec:
+  secretName: argocd-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - argocd.local.mk-labs.cloud
+
+---
+# ReferenceGrant — allows the Gateway in gateway-system to reference
+# the TLS secret in the argocd namespace
+# Without this, cross-namespace secret references are denied
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: ReferenceGrant
+metadata:
+  name: argocd-tls-grant
+  namespace: argocd
+spec:
+  from:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      namespace: gateway-system
+  to:
+    - group: ""
+      kind: Secret
+      name: argocd-tls