1.3 KiB
Argo CD on Kubernetes
Argo CD is pinned to chart 10.7.2 (Argo CD v3.5.2) and deployed in
argocd. CRDs, notifications, Dex, and the chart-supported Redis backend stay
enabled. Login is delegated directly to the Authentik OIDC provider at
/application/o/argocd/; members of authentik Admins receive Argo CD admin
access. The committed values deliberately render no Secrets: existing
argocd-secret, argocd-notifications-secret, argocd-redis, and
argocd-oidc stay inside Kubernetes and continue to be consumed by the
enabled components.
Run ./install.sh for administrator bootstrap or ./test.sh for local chart
rendering and schema validation. Gitea Actions validates every change and
updates only exact existing Argo CD objects and its three exact CRDs on main;
it cannot read Secrets, create objects, or delete objects. Because it manages
privileged Argo CD workloads and their exact RBAC objects, protect and review
main.
Create the CI identity with ./create-ci-kubeconfig.sh (or set
KUBECTL_SSH_HOST=arschrock), then store only its final line as the repository
Actions secret KUBE_CONFIG_BASE64.
The Authentik repository's administrator install provisions and synchronizes
the OIDC client secret into authentik/authentik-runtime and
argocd/argocd-oidc. CI can reference that Secret but cannot read or alter it.