# ArgoCD GitOps bootstrap

ArgoCD is installed once into the local cluster; everything after that is
declared through the root Application. The root uses the app-of-apps pattern:
it watches `argocd/apps/`, and each child Application owns one platform or
workload boundary.

## Bootstrap

1. Push this repository to the configured Git server and use the repository URL
   in the Application manifests.
2. Create the local cluster from `local-quickstart/`.
3. Run:

```bash
kubectl create namespace argocd --dry-run=client -o yaml | kubectl apply -f -
kubectl apply --server-side --force-conflicts -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
kubectl -n argocd rollout status deployment/argocd-server --timeout=180s
kubectl apply -f argocd/app-of-apps.yaml
kubectl get applications -n argocd -w
```

The first command is idempotent. The official install manifest is fetched at
bootstrap time rather than vendored into this repository, keeping the repo
reviewable and making the ArgoCD version choice visible in the command.

For local UI access:

```bash
kubectl -n argocd port-forward svc/argocd-server 8081:443
kubectl -n argocd get secret argocd-initial-admin-secret \
  -o jsonpath='{.data.password}' | base64 -d; echo
```

The initial admin secret is for local bootstrap only. A later hardening phase
should replace this with SSO/RBAC and remove the bootstrap credential.

For a kube-proxy-free Cilium cluster, install Cilium before ArgoCD using the
profile in `local-quickstart/cilium.md` or the Flatcar cloud bootstrap. The
Cilium Application is stored under `argocd/optional-apps/` and is not watched
by the default root app until the cluster is ready for it.