Let Argo CD manage its own deployment

apps/argocd/.gitignore

@@ -0,0 +1,2 @@
+Chart.lock
+charts/

apps/argocd/Chart.yaml

@@ -0,0 +1,9 @@
+apiVersion: v2
+name: argocd
+description: Self-managed Argo CD deployment for the homelab cluster
+type: application
+version: 0.1.0
+dependencies:
+- name: argo-cd
+  version: 10.10.5
+  repository: https://argoproj.github.io/argo-helm

apps/argocd/values.yaml

@@ -0,0 +1,40 @@
+argo-cd:
+  global:
+    domain: cd.brunner.ninja
+
+  crds:
+    install: true
+
+  configs:
+    cm:
+      oidc.config: |
+        name: Authentik
+        issuer: https://auth.brunner.ninja/application/o/argocd/
+        clientID: argocd
+        clientSecret: $argocd-oidc:client-secret
+        requestedScopes: ["openid", "profile", "email", "groups"]
+        requestedIDTokenClaims:
+          groups:
+            essential: true
+    rbac:
+      policy.csv: |
+        g, authentik Admins, role:admin
+      policy.default: ''
+      scopes: '[groups]'
+    secret:
+      createSecret: false
+    params:
+      server.insecure: true
+
+  notifications:
+    secret:
+      create: false
+
+  redisSecretInit:
+    enabled: false
+
+  server:
+    ingress:
+      enabled: true
+      annotations:
+        traefik.ingress.kubernetes.io/router.entrypoints: websecure