chore(argocd): Refactor to use helm chart

k8s-peterg/argocd/clusters.yaml

@@ -1,32 +0,0 @@
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: k8s-wheatley-cluster
-spec:
-  secretStoreRef:
-    name: vault-wheatley
-    kind: ClusterSecretStore
-  target:
-    name: k8s-wheatley-cluster
-    creationPolicy: Owner
-    template:
-      engineVersion: v2
-      type: Opaque
-      metadata:
-        labels:
-          argocd.argoproj.io/secret-type: cluster
-      data:
-        name: k8s-wheatley
-        server: "{{ .endpoint }}"
-        project: argocd
-        config: "{{ .config }}"
-  data:
-    - secretKey: endpoint
-      remoteRef:
-        key: secrets/managed/argocd/clusters/k8s-wheatley
-        property: endpoint
-    - secretKey: config
-      remoteRef:
-        key: secrets/managed/argocd/clusters/k8s-wheatley
-        property: config

k8s-peterg/argocd/httproute.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: argocd-route
-  namespace: argocd
-spec:
-  parentRefs:
-    - name: internal
-      namespace: kube-system
-      sectionName: https
-  hostnames:
-    - "argocd.peterg.nl"
-  rules:
-    - backendRefs:
-        - name: argocd-server
-          port: 80

k8s-peterg/argocd/kustomization.yaml

@@ -1,28 +1,20 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-resources:
-  - httproute.yaml
-  - install.yaml
-  - repository.yaml
-  - namespace.yaml
-  - clusters.yaml
-  - oidc.yaml
-  - applications-peterg.yaml
-  - applications-wheatley.yaml
 
 namespace: argocd
 
-configMapGenerator:
+resources:
-  - name: argocd-cmd-params-cm
+  - secrets.yaml
-    behavior: replace
+  - repositories.yaml
-    literals:
+  - applications-peterg.yaml
-      - server.insecure=true
+  - applications-wheatley.yaml
-      - reposerver.enable.git.submodule=false
-  - name: argocd-cm
-    behavior: merge
-    literals:
-      - kustomize.buildOptions=--enable-helm
 
-patches:
+# ArgoCD Helm chart
-  - path: patches/configmap.yaml
+helmCharts:
+  - name: argo-cd
+    repo: oci://ghcr.io/argoproj/argo-helm
+    version: 9.4.16
+    releaseName: argocd
+    valuesFile: values.yaml
+    namespace: argocd

k8s-peterg/argocd/patches/configmap.yaml

@@ -1,45 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: argocd-cm
-  labels:
-    app.kubernetes.io/name: argocd-cm
-    app.kubernetes.io/part-of: argocd
-data:
-  url: https://argocd.peterg.nl
-  dex.config: |
-    connectors:
-    - name: authentik
-      id: authentik
-      type: oidc
-      config:
-        issuer: $argocd-authentik-provider:dex.authentik.issuer
-        clientID: $argocd-authentik-provider:dex.authentik.clientID
-        clientSecret: $argocd-authentik-provider:dex.authentik.clientSecret
-        insecureEnableGroups: true
-        scopes:
-          - openid
-          - profile
-          - email
-          - groups
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: argocd-rbac-cm
-  labels:
-    app.kubernetes.io/part-of: argocd
-data:
-  policy.default: role:readonly
-  policy.csv: |
-    p, role:org-admin, applications, *, */*, allow
-    p, role:org-admin, clusters, get, *, allow
-    p, role:org-admin, repositories, get, *, allow
-    p, role:org-admin, repositories, create, *, allow
-    p, role:org-admin, repositories, update, *, allow
-    p, role:org-admin, repositories, delete, *, allow
-    p, role:org-admin, logs, get, */*, allow
-    p, role:org-admin, exec, create, */*, allow
-
-    g, ArgoCD Admins, role:admin

k8s-peterg/argocd/repositories.yaml

@@ -0,0 +1,35 @@
+---
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: argocd-private-repo
+  namespace: argocd
+  annotations:
+    managed-by: argocd.argoproj.io
+  labels:
+    argocd.argoproj.io/secret-type: repository
+stringData:
+  type: git
+  url: https://code.peterg.nl/wheatley/kubernetes.git
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: repository-credentials
+spec:
+  secretStoreRef:
+    name: vault-wheatley
+    kind: ClusterSecretStore
+  target:
+    name: repository-credentials
+  data:
+    - secretKey: UN_RADARR_0_API_KEY
+      remoteRef:
+        key: secrets/managed/qbittorrent/unpackerr-env-secrets
+        property: radarr_api_key
+    - secretKey: UN_SONARR_0_API_KEY
+      remoteRef:
+        key: secrets/managed/qbittorrent/unpackerr-env-secrets
+        property: sonarr_api_key

k8s-peterg/argocd/repository.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: v1
-kind: Secret
-type: Opaque
-metadata:
-  name: argocd-private-repo
-  namespace: argocd
-  annotations:
-    managed-by: argocd.argoproj.io
-  labels:
-    argocd.argoproj.io/secret-type: repository
-stringData:
-  type: git
-  url: https://code.peterg.nl/wheatley/kubernetes.git

k8s-peterg/argocd/secrets.yaml

@@ -27,3 +27,35 @@ spec:
       remoteRef:
         key: secrets/managed/argocd/authentik-oidc-credentials
         property: clientSecret
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: k8s-wheatley-cluster
+spec:
+  secretStoreRef:
+    name: vault-wheatley
+    kind: ClusterSecretStore
+  target:
+    name: k8s-wheatley-cluster
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      type: Opaque
+      metadata:
+        labels:
+          argocd.argoproj.io/secret-type: cluster
+      data:
+        name: k8s-wheatley
+        server: "{{ .endpoint }}"
+        project: argocd
+        config: "{{ .config }}"
+  data:
+    - secretKey: endpoint
+      remoteRef:
+        key: secrets/managed/argocd/clusters/k8s-wheatley
+        property: endpoint
+    - secretKey: config
+      remoteRef:
+        key: secrets/managed/argocd/clusters/k8s-wheatley
+        property: config

k8s-peterg/argocd/values.yaml

@@ -0,0 +1,69 @@
+---
+# ArgoCD Helm Chart Values
+# Chart: argo-cd v9.4.16
+# Repository: oci://ghcr.io/argoproj/argo-helm
+
+# Global configuration
+global:
+  domain: argocd.peterg.nl
+
+# CRD management - let Helm handle CRDs
+crds:
+  install: true
+  keep: true
+  annotations:
+    argocd.argoproj.io/sync-options: ServerSideApply=true
+
+# ArgoCD configuration
+configs:
+  # argocd-cm ConfigMap settings
+  cm:
+    url: https://argocd.peterg.nl
+    kustomize.buildOptions: --enable-helm
+    admin.enabled: false
+    dex.config: |
+      connectors:
+      - name: authentik
+        id: authentik
+        type: oidc
+        config:
+          issuer: $argocd-authentik-provider:dex.authentik.issuer
+          clientID: $argocd-authentik-provider:dex.authentik.clientID
+          clientSecret: $argocd-authentik-provider:dex.authentik.clientSecret
+          insecureEnableGroups: true
+          scopes:
+            - openid
+            - profile
+            - email
+            - groups
+
+  # argocd-cmd-params-cm ConfigMap settings
+  params:
+    server.insecure: true
+    reposerver.enable.git.submodule: false
+
+  # argocd-rbac-cm ConfigMap settings
+  rbac:
+    policy.csv: |
+      p, role:org-admin, applications, *, */*, allow
+      p, role:org-admin, clusters, get, *, allow
+      p, role:org-admin, repositories, get, *, allow
+      p, role:org-admin, repositories, create, *, allow
+      p, role:org-admin, repositories, update, *, allow
+      p, role:org-admin, repositories, delete, *, allow
+      p, role:org-admin, logs, get, */*, allow
+      p, role:org-admin, exec, create, */*, allow
+
+      g, ArgoCD Admins, role:admin
+
+# Server configuration
+server:
+  # Gateway API HTTPRoute configuration
+  httproute:
+    enabled: true
+    parentRefs:
+      - name: internal
+        namespace: kube-system
+        sectionName: https
+    hostnames:
+      - argocd.peterg.nl