26 lines
1.3 KiB
Markdown
26 lines
1.3 KiB
Markdown
# Argo CD on Kubernetes
|
|
|
|
Argo CD is pinned to chart `10.7.2` (Argo CD `v3.5.2`) and deployed in
|
|
`argocd`. CRDs, notifications, Dex, and the chart-supported Redis backend stay
|
|
enabled. Login is delegated directly to the Authentik OIDC provider at
|
|
`/application/o/argocd/`; members of `authentik Admins` receive Argo CD admin
|
|
access. The committed values deliberately render no Secrets: existing
|
|
`argocd-secret`, `argocd-notifications-secret`, `argocd-redis`, and
|
|
`argocd-oidc` stay inside Kubernetes and continue to be consumed by the
|
|
enabled components.
|
|
|
|
Run `./install.sh` for administrator bootstrap or `./test.sh` for local chart
|
|
rendering and schema validation. Gitea Actions validates every change and
|
|
updates only exact existing Argo CD objects and its three exact CRDs on `main`;
|
|
it cannot read Secrets, create objects, or delete objects. Because it manages
|
|
privileged Argo CD workloads and their exact RBAC objects, protect and review
|
|
`main`.
|
|
|
|
Create the CI identity with `./create-ci-kubeconfig.sh` (or set
|
|
`KUBECTL_SSH_HOST=arschrock`), then store only its final line as the repository
|
|
Actions secret `KUBE_CONFIG_BASE64`.
|
|
|
|
The Authentik repository's administrator install provisions and synchronizes
|
|
the OIDC client secret into `authentik/authentik-runtime` and
|
|
`argocd/argocd-oidc`. CI can reference that Secret but cannot read or alter it.
|