ArgoCD is installed once into the local cluster; everything after that is declared through the root Application. The root uses the app-of-apps pattern: it watches argocd/apps/, and each child Application owns one platform or workload boundary.

Bootstrap

Push this repository to the configured Git server and use the repository URL in the Application manifests.
Create the local cluster from local-quickstart/.
Run:

kubectl create namespace argocd --dry-run=client -o yaml | kubectl apply -f -
kubectl apply --server-side --force-conflicts -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
kubectl -n argocd rollout status deployment/argocd-server --timeout=180s
kubectl apply -f argocd/app-of-apps.yaml
kubectl get applications -n argocd -w

The first command is idempotent. The official install manifest is fetched at bootstrap time rather than vendored into this repository, keeping the repo reviewable and making the ArgoCD version choice visible in the command.

For local UI access:

kubectl -n argocd port-forward svc/argocd-server 8081:443
kubectl -n argocd get secret argocd-initial-admin-secret \
  -o jsonpath='{.data.password}' | base64 -d; echo

The initial admin secret is for local bootstrap only. A later hardening phase should replace this with SSO/RBAC and remove the bootstrap credential.

For a kube-proxy-free Cilium cluster, install Cilium before ArgoCD using the profile in local-quickstart/cilium.md or the Flatcar cloud bootstrap. The Cilium Application is stored under argocd/optional-apps/ and is not watched by the default root app until the cluster is ready for it.