Deploy Sealed Secrets with Argo CD

bootstrap/install.sh

@@ -17,3 +17,9 @@ kubectl --namespace argocd wait application/immich-sync \
 kubectl --namespace argocd wait application/immich-sync \
   --for=jsonpath='{.status.health.status}'=Healthy \
   --timeout=5m
+kubectl --namespace argocd wait application/sealed-secrets \
+  --for=jsonpath='{.status.sync.status}'=Synced \
+  --timeout=5m
+kubectl --namespace argocd wait application/sealed-secrets \
+  --for=jsonpath='{.status.health.status}'=Healthy \
+  --timeout=5m

bootstrap/kustomization.yaml

@@ -2,4 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - project.yaml
+- platform-project.yaml
+- sealed-secrets.yaml
 - immich-sync.yaml

bootstrap/platform-project.yaml

@@ -0,0 +1,32 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: platform
+  namespace: argocd
+spec:
+  description: Cluster services installed from maintained upstream charts
+  sourceRepos:
+  - https://bitnami.github.io/sealed-secrets
+  destinations:
+  - namespace: sealed-secrets
+    server: https://kubernetes.default.svc
+  clusterResourceWhitelist:
+  - group: apiextensions.k8s.io
+    kind: CustomResourceDefinition
+  - group: rbac.authorization.k8s.io
+    kind: ClusterRole
+  - group: rbac.authorization.k8s.io
+    kind: ClusterRoleBinding
+  namespaceResourceWhitelist:
+  - group: ""
+    kind: Service
+  - group: ""
+    kind: ServiceAccount
+  - group: apps
+    kind: Deployment
+  - group: monitoring.coreos.com
+    kind: ServiceMonitor
+  - group: rbac.authorization.k8s.io
+    kind: Role
+  - group: rbac.authorization.k8s.io
+    kind: RoleBinding

bootstrap/sealed-secrets.yaml

@@ -0,0 +1,36 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: sealed-secrets
+  namespace: argocd
+spec:
+  project: platform
+  source:
+    chart: sealed-secrets
+    repoURL: https://bitnami.github.io/sealed-secrets
+    targetRevision: 2.20.0
+    helm:
+      releaseName: sealed-secrets
+      valuesObject:
+        fullnameOverride: sealed-secrets-controller
+        metrics:
+          serviceMonitor:
+            enabled: true
+            labels:
+              release: prometheus
+        resources:
+          limits:
+            memory: 128Mi
+          requests:
+            cpu: 10m
+            memory: 32Mi
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: sealed-secrets
+  syncPolicy:
+    automated:
+      enabled: true
+      prune: false
+      selfHeal: true
+    syncOptions:
+    - CreateNamespace=true