The argocd-bootstrap repository contains the initial ArgoCD installation for the Kubernetes cluster. It uses Kustomize to overlay configuration on top of the upstream ArgoCD installation manifest.
argocd-bootstrap/
├── kustomization.yaml # Kustomize build config
├── base/
│ └── install.yaml # Upstream ArgoCD manifest
├── repo-secret.sealed.yaml # SealedSecret for Git SSH deploy key
├── ingress-argocd.yaml # Traefik Ingress + TLS + middleware
├── patch-argocd-cm.yaml # ConfigMap: OIDC, insecure mode, resource exclusions
└── patch-argocd-rbac-cm.yaml # RBAC: ArgoCD Admins → role:admin
# 1. Create namespace
kubectl create namespace argocd
# 2. Apply Kustomize configuration
kubectl apply -k .
# 3. Wait for ArgoCD to be ready
kubectl wait --for=condition=available deployment/argocd-server -n argocd --timeout=300s
# 4. Deploy the root application (starts app-of-apps)
kubectl apply -f k8s-cluster-config/argocd/root-app.yaml
| Setting | Value | Purpose |
|---|---|---|
server.insecure |
"true" |
TLS terminates at Traefik, not ArgoCD |
url |
https://argocd.homelab.vyanh.uk |
External URL |
oidc.config |
Authentik OIDC | SSO login via Authentik |
resource.exclusions |
Leases, TokenReviews, CiliumIdentity, etc. | Reduce API noise |
oidc.config: |
name: Authentik
issuer: https://authentik.homelab.vyanh.uk/application/o/argocd/
clientID: argocd
clientSecret: $argocd-oidc-secret:oidc.authentik.clientSecret
requestedScopes: [openid, profile, email, groups]
The clientSecret is referenced from a K8s Secret (argocd-oidc-secret) which is synced by VSO from Vault.
policy.default: role:readonly
policy.csv: |
g, ArgoCD Admins, role:admin
scopes: '[groups]'
argocd.homelab.vyanh.uktraefikletsencrypt-dns01 ClusterIssuerX-Forwarded-Proto: https headerThe Git repo SSH deploy key is encrypted using kubeseal (Bitnami Sealed Secrets):
kubeseal --format=yaml < temp-repo-secret.yaml > repo-secret.sealed.yaml
Additional secrets for Helm chart registries:
arc-ghcr-oci — GHCR credentials for ARC Helm charts (OCI)repo-bitnami-oci — Docker Hub credentials for Bitnami charts (OCI)