From e712652ef5b1db63eb70c5e8964dfb5c14a0ce6d Mon Sep 17 00:00:00 2001
From: nick-gorse <nick@olb42.com>
Date: Sat, 23 May 2026 23:24:25 +0100
Subject: [PATCH] fix: remove argocd-server https port and disable auth for
 headlamp plugin

- Removes https:443 port from argocd-server service (redundant in insecure mode)
  so K8s API proxy can resolve service endpoint without ambiguity
- Adds server.disable.auth=true to allow headlamp plugin unauthenticated API access
  (external access protected by Traefik OIDC)
---
 .../overlays/production/argocd-cmd-params-cm-patch.yaml    | 1 +
 .../overlays/production/argocd-server-service-patch.yaml   | 7 +++++++
 manifest/overlays/production/kustomization.yaml            | 4 ++++
 3 files changed, 12 insertions(+)
 create mode 100644 manifest/overlays/production/argocd-server-service-patch.yaml

diff --git a/manifest/overlays/production/argocd-cmd-params-cm-patch.yaml b/manifest/overlays/production/argocd-cmd-params-cm-patch.yaml
index c307c59..84a3c49 100644
--- a/manifest/overlays/production/argocd-cmd-params-cm-patch.yaml
+++ b/manifest/overlays/production/argocd-cmd-params-cm-patch.yaml
@@ -6,3 +6,4 @@ metadata:
 data:
   redis.server: shared-redis.data:6379
   server.insecure: "true"
+  server.disable.auth: "true"
diff --git a/manifest/overlays/production/argocd-server-service-patch.yaml b/manifest/overlays/production/argocd-server-service-patch.yaml
new file mode 100644
index 0000000..0f94f9c
--- /dev/null
+++ b/manifest/overlays/production/argocd-server-service-patch.yaml
@@ -0,0 +1,7 @@
+- op: replace
+  path: /spec/ports
+  value:
+    - name: http
+      port: 80
+      protocol: TCP
+      targetPort: 8080
diff --git a/manifest/overlays/production/kustomization.yaml b/manifest/overlays/production/kustomization.yaml
index 34db865..b16e40c 100644
--- a/manifest/overlays/production/kustomization.yaml
+++ b/manifest/overlays/production/kustomization.yaml
@@ -23,6 +23,10 @@ patches:
   - path: argocd-notifications-cm-patch.yaml
   - path: repo-server-patch.yaml
   - path: disable-bundled-redis-patch.yaml
+  - path: argocd-server-service-patch.yaml
+    target:
+      kind: Service
+      name: argocd-server
 
 # # KSOPS decrypts secret.enc.yaml at render time.
 # # The presence of ksops-generator.yaml activates the KSOPS CMP plugin.