kubernetes-security-baseline-lab/deployments/argocd/README.md

ArgoCD GitOps bootstrap

ArgoCD is installed once into the local cluster; everything after that is declared through the root Application. The root uses the app-of-apps pattern: it watches deployments/argocd/apps/, and each child Application owns one platform or workload boundary.

Bootstrap

1. Push this repository to the configured Git server and use the repository URL in the Application manifests.
2. Create the local cluster from local-quickstart/.
3. Run:

kubectl create namespace argocd --dry-run=client -o yaml | kubectl apply -f -
kubectl apply --server-side --force-conflicts -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
kubectl -n argocd rollout status deployment/argocd-server --timeout=180s
kubectl apply -f deployments/argocd/app-of-apps.yaml
kubectl get applications -n argocd -w

The first command is idempotent. The official install manifest is fetched at bootstrap time rather than vendored into this repository, keeping the repo reviewable and making the ArgoCD version choice visible in the command.

For local UI access:

kubectl -n argocd port-forward svc/argocd-server 8081:443
kubectl -n argocd get secret argocd-initial-admin-secret \
  -o jsonpath='{.data.password}' | base64 -d; echo

The initial admin secret is for local bootstrap only. A later hardening phase should replace this with SSO/RBAC and remove the bootstrap credential.

For a kube-proxy-free Cilium cluster, install Cilium before ArgoCD using the profile in local-quickstart/cilium.md or the Flatcar bootstrap. The Cilium Applications are stored under deployments/argocd/optional-apps/ and are not watched by the default root app until the cluster is ready for them.

Select cilium-k3d.yaml for the nested k3d profile or cilium-flatcar-k3s.yaml for dedicated Flatcar K3s VMs. The profile values are composed from deployments/cilium/values/common.yaml and the matching profile overlay. Ansible owns the initial install when kube-proxy is disabled. ArgoCD can own subsequent upgrades after bootstrap, but Ansible and ArgoCD should not manage the same release with different values at the same time.