Add Flatcar and Cilium kube-proxy-free architecture

argocd/README.md

@@ -34,3 +34,8 @@ kubectl -n argocd get secret argocd-initial-admin-secret \
 
 The initial admin secret is for local bootstrap only. A later hardening phase
 should replace this with SSO/RBAC and remove the bootstrap credential.
+
+For a kube-proxy-free Cilium cluster, install Cilium before ArgoCD using the
+profile in `local-quickstart/cilium.md` or the Flatcar cloud bootstrap. The
+Cilium Application is stored under `argocd/optional-apps/` and is not watched
+by the default root app until the cluster is ready for it.

argocd/optional-apps/cilium.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cilium
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "-4"
+spec:
+  project: default
+  sources:
+    - repoURL: https://helm.cilium.io/
+      chart: cilium
+      targetRevision: 1.20.0
+      helm:
+        valueFiles:
+          - $values/cilium/cilium-values.yaml
+    - repoURL: https://git.swaphb.com/swaphb/kubernetes-security-baseline-lab.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: kube-system
+  # Apply this Application manually only after bootstrapping a kube-proxy-free
+  # cluster and replacing the API endpoint placeholder.
+