# Argo CD on Kubernetes

Argo CD is pinned to chart `10.7.2` (Argo CD `v3.5.2`) and deployed in
`argocd`. CRDs, notifications, Dex, and the chart-supported Redis backend stay
enabled. Login is delegated directly to the Authentik OIDC provider at
`/application/o/argocd/`; members of `authentik Admins` receive Argo CD admin
access. The committed values deliberately render no Secrets: existing
`argocd-secret`, `argocd-notifications-secret`, `argocd-redis`, and
`argocd-oidc` stay inside Kubernetes and continue to be consumed by the
enabled components.

Run `./install.sh` for administrator bootstrap or `./test.sh` for local chart
rendering and schema validation. Gitea Actions validates every change and
updates only exact existing Argo CD objects and its three exact CRDs on `main`;
it cannot read Secrets, create objects, or delete objects. Because it manages
privileged Argo CD workloads and their exact RBAC objects, protect and review
`main`.

Create the CI identity with `./create-ci-kubeconfig.sh` (or set
`KUBECTL_SSH_HOST=arschrock`), then store only its final line as the repository
Actions secret `KUBE_CONFIG_BASE64`.

The Authentik repository's administrator install provisions and synchronizes
the OIDC client secret into `authentik/authentik-runtime` and
`argocd/argocd-oidc`. CI can reference that Secret but cannot read or alter it.