ArgoCD
ArgoCD
GitOps controller for the cluster. ArgoCD watches a set of Gitea repositories and continuously reconciles the live cluster state to match what’s committed — push a manifest change, ArgoCD applies it automatically.
Deployment
Installed to its own argocd namespace via the upstream install manifest, pinned to v3.5.2 rather than stable so version bumps happen intentionally (via Renovate) instead of picking up whatever argoproj ships next. Runs as the standard ArgoCD component set:
| Component | Kind | Purpose |
|---|---|---|
argocd-server | Deployment | API server + web UI |
argocd-repo-server | Deployment | Clones/renders repo manifests |
argocd-application-controller | StatefulSet | Reconciliation loop |
argocd-dex-server | Deployment | SSO/auth |
argocd-redis | Deployment | Controller cache |
argocd-applicationset-controller | Deployment | ApplicationSet support |
argocd-notifications-controller | Deployment | Sync/health notifications |
Ingress and TLS
Fronted by Traefik with the same IngressRoute pattern used everywhere else in the cluster — plain HTTP from Traefik to argocd-server, TLS terminated at the ingress using a per-namespace local-example-com-tls certificate issued by cert-manager (see cert-manager). The www. and apex hosts both route to argocd-server:80; the apex route attaches the shared default-headers middleware from the default namespace.
argocd-server terminates TLS and redirects HTTP→HTTPS by default, which fights Traefik’s own TLS termination (Traefik always talks plain HTTP to backends here). server.insecure: "true" in argocd-cmd-params-cm disables that redirect — it only takes effect after a kubectl rollout restart deployment/argocd-server.
Managed applications
ArgoCD Application resources live under argocd/apps/*.yaml in this repo and each point at a dedicated Gitea repo (branch k3s), auto-syncing with prune: true and selfHeal: true — a manual kubectl change to a managed resource gets reverted back to what’s in Git.
| Application | Source repo | Destination namespace |
|---|---|---|
drawio | bjones/Drawio.git | default |
gatus | bjones/Gatus.git | default |
homepage | bjones/Homepage.git | default |
kafka | bjones/kafka.git | default |
mailpit | bjones/mailpit.git | default |
n8n | bjones/n8n.git | default |
portainer | bjones/Portainer.git | default |
tailscale | bjones/Tailscale.git | tailscale |
All eight are currently Synced / Healthy. Everything else in the cluster (ActiveMQ, Grafana, the Gluetun/*arr stack, Postgres, etc.) is applied directly with kubectl rather than through ArgoCD.
Initial admin credentials
The bootstrap admin password is generated at install time into a Secret and is not stored in this repo:
1
kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath='{.data.password}' | base64 -d