cilium, argo

docs/city-hall-setup.md

@@ -59,6 +59,8 @@ Required for provisioning and managing the `fastpass` Talos Kubernetes cluster.
 | `talosctl` | Talos cluster CLI | See below |
 | `kubectl` | Kubernetes CLI | See below |
 | `helm` | Kubernetes package manager | See below |
+| `cilium` | Cilium CNI CLI (status, connectivity tests) | See below |
+| `argocd` | ArgoCD CLI (app management, account operations) | See below |
 | `age` | Encryption key generation (used by SOPS) | `sudo apt install age -y` |
 | `sops` | Secret encryption for `talsecret.sops.yaml` | See below |
 
@@ -108,6 +110,37 @@ Verify:
 helm version
 ```
 
+#### Cilium CLI
+
+```bash
+CILIUM_CLI_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/cilium-cli/main/stable.txt)
+curl -L --remote-name-all \
+  https://github.com/cilium/cilium-cli/releases/download/${CILIUM_CLI_VERSION}/cilium-linux-amd64.tar.gz
+tar -xzvf cilium-linux-amd64.tar.gz
+sudo mv cilium /usr/local/bin/
+rm cilium-linux-amd64.tar.gz
+```
+
+Verify:
+```bash
+cilium version
+```
+
+#### ArgoCD CLI
+
+```bash
+ARGOCD_VERSION=$(curl -s https://api.github.com/repos/argoproj/argo-cd/releases/latest | grep tag_name | cut -d '"' -f 4)
+curl -sSL -o /tmp/argocd \
+  https://github.com/argoproj/argo-cd/releases/download/${ARGOCD_VERSION}/argocd-linux-amd64
+chmod +x /tmp/argocd
+sudo mv /tmp/argocd /usr/local/bin/argocd
+```
+
+Verify:
+```bash
+argocd version --client
+```
+
 #### SOPS
 
 ```bash
@@ -274,48 +307,67 @@ talosctl --talosconfig clusterconfig/talosconfig \
   --nodes 10.1.71.66 kubeconfig ~/.kube/config
 ```
 
-### 8. Approve Worker CSRs
+### 8. Approve CSRs
 
 ```bash
-kubectl get csr
-kubectl certificate approve $(kubectl get csr --no-headers | awk '{print $1}')
+kubectl get csr --no-headers | awk '{print $1}' | xargs kubectl certificate approve
 ```
 
+Run periodically until no pending CSRs remain.
+
 ### 9. Install Cilium (CNI)
 
+Cilium is managed by Helm only — never via ArgoCD.
+
 ```bash
 helm repo add cilium https://helm.cilium.io/
 helm repo update
 
-helm install cilium cilium/cilium \
+helm upgrade --install cilium cilium/cilium \
+  --version 1.17.3 \
   --namespace kube-system \
-  --set ipam.mode=kubernetes \
-  --set routingMode=tunnel \
-  --set tunnelProtocol=vxlan \
-  --set kubeProxyReplacement=true \
-  --set k8sServiceHost=10.1.71.65 \
-  --set k8sServicePort=6443 \
-  --set securityContext.capabilities.ciliumAgent="{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}" \
-  --set securityContext.capabilities.cleanCiliumState="{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}" \
-  --set cgroup.autoMount.enabled=false \
-  --set cgroup.hostRoot=/sys/fs/cgroup
+  --values talos/cilium/cilium-values.yaml \
+  --wait \
+  --timeout 5m
 ```
 
-Note: The explicit `securityContext.capabilities` flags are required for Talos — Talos
-restricts privileged container capabilities by default. The `cgroup.autoMount.enabled=false`
-and `cgroup.hostRoot` flags are required because Talos manages cgroups itself.
+Apply IP pools:
 
-### 10. Verify Cluster
+```bash
+kubectl apply -f talos/cilium/ip-pools.yaml
+```
+
+Verify:
+
+```bash
+cilium status --wait
+kubectl get ciliumloadbalancerippool
+kubectl get ciliuml2announcementpolicy
+```
+
+**Important:** The `cilium-values.yaml` contains required Talos-specific overrides:
+- `securityContext.capabilities` — removes `SYS_MODULE` (blocked by Talos permanently)
+- `cgroup.autoMount.enabled: false` — Talos manages cgroups itself
+- `l2announcements.interface: ens18` — Proxmox VMs use `ens18`, not `eth0`
+- `l2podAnnouncements.interface: ens18` — same reason
+
+### 10. Bootstrap ArgoCD
+
+See `cluster/argocd/BOOTSTRAP.md` for the full ArgoCD bootstrap sequence.
+
+Summary:
+1. `kubectl apply -f cluster/argocd/namespace.yaml`
+2. Add Gitea SSH host key to ArgoCD known hosts
+3. Create `gitea-repo` secret with SSH private key at `~/.ssh/argocd_gitea`
+4. `helm upgrade --install argocd argo/argo-cd --values cluster/argocd/values.yaml`
+5. `kubectl apply -n argocd -f cluster/argocd/apps-of-apps.yaml`
+
+### 11. Verify Cluster
 
 ```bash
 kubectl get nodes
-kubectl get pods -n kube-system
+kubectl get pods -A | grep -v Running | grep -v Completed
+cilium status --wait
 ```
 
-All nodes should show `Ready`. Cilium pods should be `Running`.
-
-### 11. Post-Install HA Setup
-
-See output of `terraform output` for the full HA registration commands.
-Register VMs with Proxmox HA and add to node-affinity rules once the
-cluster is stable and the ISO is no longer needed for boot.
+All nodes should show `Ready`. All pods should be `Running` or `Completed`.