organize deployment configuration

2026-08-15 13:17:46 -04:00
parent 12f3276465
commit fc53e16dd4
18 changed files with 26 additions and 13 deletions
@@ -0,0 +1,41 @@
+# ArgoCD GitOps bootstrap
+
+ArgoCD is installed once into the local cluster; everything after that is
+declared through the root Application. The root uses the app-of-apps pattern:
+it watches `deployments/argocd/apps/`, and each child Application owns one platform or
+workload boundary.
+
+## Bootstrap
+
+1. Push this repository to the configured Git server and use the repository URL
+   in the Application manifests.
+2. Create the local cluster from `local-quickstart/`.
+3. Run:
+
+```bash
+kubectl create namespace argocd --dry-run=client -o yaml | kubectl apply -f -
+kubectl apply --server-side --force-conflicts -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
+kubectl -n argocd rollout status deployment/argocd-server --timeout=180s
+kubectl apply -f deployments/argocd/app-of-apps.yaml
+kubectl get applications -n argocd -w
+```
+
+The first command is idempotent. The official install manifest is fetched at
+bootstrap time rather than vendored into this repository, keeping the repo
+reviewable and making the ArgoCD version choice visible in the command.
+
+For local UI access:
+
+```bash
+kubectl -n argocd port-forward svc/argocd-server 8081:443
+kubectl -n argocd get secret argocd-initial-admin-secret \
+  -o jsonpath='{.data.password}' | base64 -d; echo
+```
+
+The initial admin secret is for local bootstrap only. A later hardening phase
+should replace this with SSO/RBAC and remove the bootstrap credential.
+
+For a kube-proxy-free Cilium cluster, install Cilium before ArgoCD using the
+profile in `local-quickstart/cilium.md` or the Flatcar cloud bootstrap. The
+Cilium Application is stored under `deployments/argocd/optional-apps/` and is not watched
+by the default root app until the cluster is ready for it.