Initial argo deployment

cluster/platform/ingress-nginx/application.yaml

@@ -0,0 +1,29 @@
+# ------------------------------------------------------------------------------
+# Platform: ingress-nginx
+# Wave 5 — depends on Cilium LB pool (wave 4) to get a LoadBalancer IP
+# ------------------------------------------------------------------------------
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ingress-nginx
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "5"
+spec:
+  project: default
+  source:
+    repoURL: https://kubernetes.github.io/ingress-nginx
+    chart: ingress-nginx
+    targetRevision: 4.12.1
+    helm:
+      valuesFile: values.yaml
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: ingress-nginx
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

cluster/platform/ingress-nginx/values.yaml

@@ -0,0 +1,43 @@
+# ------------------------------------------------------------------------------
+# ingress-nginx — Helm Values
+# Chart: https://kubernetes.github.io/ingress-nginx
+# ------------------------------------------------------------------------------
+
+controller:
+  # Request a specific IP from the Cilium LB pool
+  # 10.1.71.80 — first address in the pool, reserved for ingress
+  service:
+    loadBalancerIP: 10.1.71.80
+    annotations:
+      # Tell Cilium which pool to use (optional if only one pool exists)
+      io.cilium/lb-ipam-ips: "10.1.71.80"
+
+  # IngressClass name — referenced by all Ingress resources
+  ingressClassResource:
+    name: nginx
+    enabled: true
+    default: true
+
+  # Pass real client IPs through to backends
+  config:
+    use-forwarded-headers: "true"
+    compute-full-forwarded-for: "true"
+    use-proxy-protocol: "false"
+
+  # Prometheus metrics
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: false  # enable once Prometheus operator is in-cluster
+
+  # 2 replicas for basic resilience across worker nodes
+  replicaCount: 2
+
+  # Spread across worker nodes
+  topologySpreadConstraints:
+    - maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: DoNotSchedule
+      labelSelector:
+        matchLabels:
+          app.kubernetes.io/name: ingress-nginx