feat: initial ArgoCD GitOps self-management setup

- Base references upstream ArgoCD v3.3.6 install.yaml - Production overlay applies all cluster customizations: - KSOPS CMP sidecar on argocd-repo-server - Custom ConfigMaps (argocd-cm, argocd-cmd-params-cm, argocd-rbac-cm, argocd-notifications-cm) - Redis migrated to shared-redis.data:6379 - Traefik IngressRoute for argocd.olb42.com - SOPS-encrypted secrets (age key, redis auth, gitea tokens, repo-creds) - Bootstrap Application with prune:false for safe self-management
2026-04-19 23:36:09 +01:00
commit 40eb3b842c
17 changed files with 531 additions and 0 deletions
@@ -0,0 +1,41 @@
+apiVersion: ENC[AES256_GCM,data:nAs=,iv:DjVwuYqCpa9e9TY59qPUqG2yjrGOykfDUI/bH00cYC8=,tag:AgFF0Bb3YXZeUKb2BmA9Pg==,type:str]
+kind: ENC[AES256_GCM,data:oBkqTrVH,iv:/M+hMx4ioTgtqjySJ0SvIv2W7huDyH1jAFCRXfHl4MQ=,tag:Qmq8JHdpdbpTA1WRrt8kuA==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:MhdiC/arAhFbp2yzt4o=,iv:8pmcBcIj+iiVymud92ZIbMgEt9XCN7EFEYnL1ocwkWQ=,tag:T7/Dr24TtqACE7J171U/Rg==,type:str]
+    namespace: ENC[AES256_GCM,data:60vOnJKT,iv:t9Fapbuu9Ya311uzqZ86YjwEAR76PpOjxMDdGgfbxpA=,tag:6ERx/f670/SNOMikO+q/4w==,type:str]
+type: ENC[AES256_GCM,data:i+s8ejKv,iv:LOqBlClSNxZY/RA50V0LNWD8a2XsHOI7bZSastpQ2E8=,tag:hlJ3TVaK6c4j/GSAK4EbqA==,type:str]
+stringData:
+    key.txt: ENC[AES256_GCM,data:BYd7VuC7Tpu+fBfT2f+UwdmbzQnxDbAcapvNyoQR4qmcV/t4y7gjiD5Og5Tcpw3WhLLA3JBTuea7R/FqLwsHxqM1ZFsO17dUSZw=,iv:rodtfLRQUTyyt9P+7bhP6i/BEgZe5fePPDSYC1VHlq0=,tag:WGNFEStQo6CInbvNFbhrVw==,type:str]
+sops:
+    age:
+        - recipient: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqTVFMS3hqVFpFYkJPYkdl
+            QTU5ZTNtL3NhbWhFRUt4N1ZmOHNUT2Z6SnhjCmFGYTdsVm9lWWJBMURQdExkQ3pD
+            eFZvYTdzaS9Eb0dURGNXaERVSm1jSUEKLS0tIGpJSjJqU2NDZXBNSmIxRWg5Nk1G
+            aFNPeGdCUUxuUHJPZWdkWU1QWW8yN2MKo5P8YpmEx1K6n2KmJ5ZinI8tHTt79U+x
+            QIPHIOsL0vyRRDwDrhxagd1MX4OEOZl590GvT6IiNY0lN4gCdjoNow==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-19T22:34:54Z"
+    mac: ENC[AES256_GCM,data:5Ya2agLt9jHqylYh72cN9SNWpinNkSnbfAoUYXtPI+lp69qxYIq3SelE8vulWcDoOZIDxEepttVpIo+pkyQbxKwMms/iHLyEC1EIFg9MVIaP5KIdrr93p/aExMkFyPcDLiqC0XcCMuBhNTaZvQ5IE+wDs3JthUIa5F1ZL+3eTt4=,iv:iQLvWgAegOMYas/nxD3k3lXZ7wOjMGXYq/fuiin1+zU=,tag:F/YLP8oDDlGMisz0XLCJDA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.2
+---
+apiVersion: ENC[AES256_GCM,data:THQ=,iv:kX/yYct8NmlujHHZ2Ui29wcGsjHojnHvYzx24i6CGxA=,tag:XtQInMnByeiit852ZAom7Q==,type:str]
+kind: ENC[AES256_GCM,data:4NDGjFRb,iv:ImM1RSLM7Sa0J/RNPOeSmBUdDbxg32yIImurjgAIocM=,tag:5HLeek7XNSHDZ9ZlZsbahQ==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:EotC086GrXiwxc2a,iv:xC5j6+Wokph7O5few7Kkzxwg8PW9eCE56QynyJftdUE=,tag:MvHqWXnwj3cVoie3VbTf/Q==,type:str]
+    namespace: ENC[AES256_GCM,data:Vo+Jc74Q,iv:Xfl7xjj8obV62L5U7IcK9XhY81aOvjWpQVu4XveMU/E=,tag:FDL3yxeO9DtVvHJY6LpWGA==,type:str]
+type: ENC[AES256_GCM,data:U6aSqKrG,iv:iDBCN4GNTF01+c1sURCRDMXyY+WZ8IYYEYCQx3AX2As=,tag:QzwWCRXZWzncLo668Ei9RQ==,type:str]
+stringData:
+    auth: ENC[AES256_GCM,data:IoYCciqcZIahHzyqIfs9dPtOU9//DU8ISSf/w5R2Og==,iv:1xqmXww4P+C/auZ6IjTISChTfhDEC76fYPi7beNl7Pc=,tag:c5ze7wDGfCxp2xiACbRcQg==,type:str]
+sops:
+    age:
+        - recipient: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqTVFMS3hqVFpFYkJPYkdl
+            QTU5ZTNtL3NhbWhFRUt4N1ZmOHNUT2Z6SnhjCmFGYTdsVm9lWWJBMURQdExkQ3pD
+            eFZvYTdzaS9Eb0dURGNXaERVSm1jSUEKLS0tIGpJSjJqU2NDZXBNSmIxRWg5Nk1G
+... (145 lines truncated)