update irnote statefulsets replicas

disable.auth=true (from e712652, for the Headlamp argocd plugin) turned off
login globally, so Keycloak SSO and local admin login were bypassed and the
UI reported 'not logged in'. The Headlamp plugin reads Application CRDs via
the k8s API and does not require this.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

.gitea/workflows/validate.yaml

@@ -14,22 +14,26 @@ jobs:
         run: |
           curl -sL https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-amd64.tar.gz \
             | tar xz -C /usr/local/bin
+          curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
 
-          # Traefik IngressRoute is a CRD, so kubeconform needs an extra schema source.
-          mkdir -p .ci-schemas/traefik.io
-          curl -fsSL https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/traefik.io/ingressroute_v1alpha1.json \
-            -o .ci-schemas/traefik.io/ingressroute_v1alpha1.json
-          cp .ci-schemas/traefik.io/ingressroute_v1alpha1.json .ci-schemas/traefik.io/IngressRoute_v1alpha1.json
-          cp .ci-schemas/traefik.io/ingressroute_v1alpha1.json .ci-schemas/traefik.io/IngressRoute.json
-          cp .ci-schemas/traefik.io/ingressroute_v1alpha1.json .ci-schemas/traefik.io/ingressroute.json
+      - name: Helm lint
+        run: |
+          found=0
 
-          # ArgoCD Application is also a CRD.
-          mkdir -p .ci-schemas/argoproj.io
-          curl -fsSL https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/argoproj.io/application_v1alpha1.json \
-            -o .ci-schemas/argoproj.io/application_v1alpha1.json
-          cp .ci-schemas/argoproj.io/application_v1alpha1.json .ci-schemas/argoproj.io/Application_v1alpha1.json
-          cp .ci-schemas/argoproj.io/application_v1alpha1.json .ci-schemas/argoproj.io/Application.json
-          cp .ci-schemas/argoproj.io/application_v1alpha1.json .ci-schemas/argoproj.io/application.json
+          for parent in helm custom-charts; do
+            [ -d "$parent" ] || continue
+
+            for chart in "$parent"/*; do
+              [ -d "$chart" ] || continue
+              found=1
+              echo "Linting $chart"
+              helm lint "$chart"
+            done
+          done
+
+          if [ "$found" -eq 0 ]; then
+            echo "No Helm charts found"
+          fi
 
       - name: kubeconform - raw YAML
         run: |
@@ -41,11 +45,9 @@ jobs:
           mapfile -t manifests < <(
             find . -type f -name '*.yaml' \
             ! -path './.gitea/*' \
-            ! -name '.sops.yaml' \
-            ! -name '*.secret.yaml' \
             ! -name 'kustomization.yaml' \
-            ! \( -name 'secret*.yaml' \) \
-            ! \( -path '*/config/*' -prune \) \
+            ! -name 'values.yaml' \
+            ! \( -name '*patch*.yaml' \) \
             ! -path './bootstrap/config.yaml' \
             | sort
           )
@@ -53,7 +55,7 @@ jobs:
           if [ "$bootstrap_enabled" != "true" ]; then
             filtered=()
             for manifest in "${manifests[@]}"; do
-              [ "$manifest" = "./bootstrap/application.yaml" ] && continue
+              [ "$manifest" = "./bootstrap/applicationset.yaml" ] && continue
               filtered+=("$manifest")
             done
             manifests=("${filtered[@]}")
@@ -68,26 +70,11 @@ jobs:
             | xargs kubeconform \
                 -strict \
                 -kubernetes-version 1.35.0 \
+                -ignore-missing-schemas \
                 -schema-location default \
-                -schema-location '.ci-schemas/{{.Group}}/{{.ResourceKind}}{{.KindSuffix}}.json' \
-                -schema-location '.ci-schemas/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' \
+                -schema-location 'https://git.olb42.com/olb042/kubeconform/raw/branch/main/crdSchemas/{{ .ResourceKind }}_{{ .ResourceAPIVersion }}.json' \
                 -summary
 
-      - name: SOPS - check no secret files committed unencrypted
-        run: |
-          fail=0
-
-          while IFS= read -r file; do
-            if ! grep -q 'sops:' "$file"; then
-              echo "ERROR: $file appears to be unencrypted"
-              fail=1
-            fi
-          done < <(
-            find . -type f \( -name '*.secret.yaml' -o -name '*.enc.yaml' \) | sort
-          )
-
-          exit "$fail"
-
       - name: Apply bootstrap Application
         env:
           KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}

.gitignore

@@ -5,5 +5,6 @@
 *.swo
 
 # Local plaintext twins for sync-managed secrets. Keep these untracked.
-manifest/overlays/**/secret.yaml
+manifest/overlays/*/secret.yaml
 manifest/components/**/secret.yaml
+manifest/overlays/**/*.plain.yaml

.sops.yaml

@@ -1,5 +0,0 @@
-creation_rules:
-  - path_regex: manifest/(overlays|components)/.*/.*\.enc\.yaml$
-    age: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
-  - path_regex: manifest/(overlays|components)/.*/secret\.secret\.yaml$
-    age: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43

README.md

@@ -0,0 +1,45 @@
+# argocd
+
+GitOps source for the cluster Argo CD installation. This app is self-managed by
+Argo CD and intentionally uses a conservative sync policy.
+
+## Current deployment
+
+- Bootstrap: `enabled: true`, applied from `main`
+- Argo application: `argocd-production`
+- Target namespace: `argocd`
+- Render path: `manifest/overlays/production`
+- Repo URL used by Argo CD: `http://gitea-ha-http.apps:3000/olb42/argocd.git`
+- Live state observed via `document_state` on 2026-06-14: `Synced` and `Healthy`
+- Live revision: `aa13430d2464162e4f4f7e68ee99deef02234a80`
+- Config management: native Kustomize overlay with
+  `kustomize.buildOptions: --enable-helm`; Lovely CMP sidecar is installed on
+  the repo-server
+
+## Runtime
+
+The base installs upstream Argo CD `v3.4.3` from the official install manifest.
+The production overlay adds the Traefik route for `argocd.olb42.com`, repo
+credentials, notifications, Redis credentials, Image Updater `v1.2.0`, the
+Lovely `v1.2.4` CMP sidecar, ArgoPlane UI extension loaders, and patches for
+Argo CD config, RBAC, command parameters, repo-server behavior, and bundled
+Redis disablement.
+
+The live `argocd` namespace currently has the core Argo CD workloads ready:
+`argocd-application-controller` StatefulSet `1/1`, plus
+`argocd-applicationset-controller`, `argocd-dex-server`,
+`argocd-notifications-controller`, `argocd-repo-server`, and `argocd-server`
+Deployments all `1/1`. `argocd-redis` is intentionally scaled to `0/0` because
+the bundled Redis is disabled. Extension workloads such as
+`argocd-extension-pod-files` and the ArgoPlane backend Deployments are managed
+as separate Argo CD applications in the same namespace.
+
+Secrets for the Argo CD control plane and Gitea repository credentials are
+tracked as `SealedSecret` resources. The application resource tree shows those
+SealedSecrets healthy and owning the generated Kubernetes `Secret` objects.
+
+## Sync policy
+
+Automated sync is disabled for the Argo CD application itself. Prune and
+self-heal are also disabled so a bad self-management change cannot remove the
+control plane that would be needed to repair it.

bootstrap/application.yaml

@@ -6,14 +6,15 @@ metadata:
   labels:
     app.kubernetes.io/managed-by: argocd
     app.kubernetes.io/name: argocd
+
 spec:
   project: default
   source:
     repoURL: http://gitea-ha-http.apps:3000/olb42/argocd.git
     targetRevision: main
     path: manifest/overlays/production
-    plugin:
-      name: ksops
+    # plugin:
+      # name: ksops
   destination:
     server: https://kubernetes.default.svc
     namespace: argocd
@@ -21,8 +22,9 @@ spec:
     automated:
       # prune: false — ArgoCD self-managing itself; never auto-prune to avoid
       # accidentally removing ArgoCD components and losing cluster management.
+      enabled: false
       prune: false
-      selfHeal: true
+      selfHeal: false
     syncOptions:
       - CreateNamespace=false
       - ApplyOutOfSyncOnly=true

bootstrap/badge.yaml

@@ -1 +0,0 @@
-badge=https://git.olb42.com/olb42/argocd/actions/workflows/validate.yaml/badge.svg?branch=main

manifest/base/kustomization.yaml

@@ -3,5 +3,8 @@ kind: Kustomization
 
 namespace: argocd
 
+commonAnnotations:
+  glance/parent: argocd
+
 resources:
-  - https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.6/manifests/install.yaml
+  - https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.1/manifests/install.yaml

manifest/overlays/production/argocd-age-key.enc.yaml

@@ -1,23 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:6DE=,iv:jmCYy0QZYlBVpnuskjcYwjFD78h4oHwiCZUUFmO9LGg=,tag:B/MqUiYVkcD8kI3tbpMGSw==,type:str]
-kind: ENC[AES256_GCM,data:Wxy9n8fQ,iv:VTC3D0lqQfL3v9mVubEjlkbrFzwHKENX7TEaRwHHJas=,tag:GCkfev+cNdboclIRmy+81Q==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:V9MD1Ep17zBd8RsXPTk=,iv:JYdyor8U2/M5xu9Elx2OONEEI69XtTrvjunr4QtvbDI=,tag:diAsRb17TfxRvh8hqeJPdw==,type:str]
-    namespace: ENC[AES256_GCM,data:FPWqsFwo,iv:J3T2KTD5Pz0M2Hj8UCkzsoeEp6dvVXI8vCdyzE52t7k=,tag:pIJh0kFzHzDSm0Bmtis2PQ==,type:str]
-type: ENC[AES256_GCM,data:m74topXX,iv:TIfxgPckr3CdlY+BfZreuqPgYzWu8iQJ3yS7Uu0QFnk=,tag:a1tUAGF3eBYPoLys0z/Nsg==,type:str]
-stringData:
-    key.txt: ENC[AES256_GCM,data:FgFRiXd9kdgqArIlm70Fr2S7Yxcq32s0OzLnfxZhTk7PGbeBdhDHo+pclcM9htHd/uJKoOtxwjBBxacAkojD5Sfp4QnDOOysZpo=,iv:QFpW2dgR14HyuPs8IijdImzVOEvfMUm6NhOrg1gXB1s=,tag:0U8hQz8ibma/XNaloUJ17Q==,type:str]
-sops:
-    age:
-        - recipient: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrekcwSy9xT0Zla3Rza0oy
-            ZjlpaUo4QUF2NW5kSGNIekozVEhnRC9Wa2tvCnZXL0syUWFSWGpydDN3VXAwSVB3
-            elZ2Y3BHMy96bTJQOWg1QzVJRzZZeXMKLS0tIHVrSmF1THJQZW9sYnZlTmxiZVlz
-            SG5HMWlmRitpUTBEOXg4clh4K2hNN00KKr7D8oIXoGc72kUsSvcA3P10REYMzyAC
-            3NGQmfkDSXcbXTWsOGUPkjtqt/boinEMvUpid8AH+xtEzKblBsIcTw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-19T22:38:11Z"
-    mac: ENC[AES256_GCM,data:/ybCzs14eKMlwEgqXajKUjHt3vRvIwTWqAo0RWohCCI/oOn/PQtBWd9vXM58NaKWNbG0pohHvI2QC1XQ717Da3ZfE6bD8DJTKerCcpkHGXKUVj1pd8B/lL5OYnvPrMOgvb0EqIQZd0E2vsildBySHQonrYX2ryF6VR9pmWIXcAs=,iv:y1KLAxrOVUBp4iSGH5WwW+hdFT1UNhvgI/C4Oj8yFtY=,tag:1mG+YzZwKXSkZOKi8R2r+A==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.12.2

manifest/overlays/production/argocd-age-key.sealed.secret.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: argocd-age-key
+  namespace: argocd
+spec:
+  encryptedData:
+    key.txt: AgAH1fIhZzPappr79MuofsbpCGGiFU6aMruZqKe+qVcr0WnMsE2Ao86/PSZMyvRls38roE6p0fX0/rbVrcDrNexzt4MqC4lURaYCcp2qCXhNfvxCisSRIHgSC4HzD4x4poleo/V935+wyAbaptw2OWZ7rUGjAdoLvte1noZhNrmBTdhlv87oW/ON1MFzFkjbKKiEXV76eO0woo4c/BVsuCF983CwIHqeHoEJsIDkm2MtY4TTgRm4KZR0iA+IPWVW6zoA7LniGE3Xsnv1BOql6AhcaFnUkkvuRx2vhbWjxyjzoU727OZb3Z1hu1VfYDiZXkRXcoJb53nEz9W/psSylrHyiGf5Vf/RGWnaYZ/H9VhgTwlHzrZmXLukT9HVDMQ1OQFTK4HUPbvlO9HVyaZ73IAcLvnPh4/gQppjAmz1TH6r0dmwJULYKpLbCy4OE8ppZjakBGb+s+xE8Py2V3TCW+gA966+A47GRMdKRfP4heG+Wkbi4cWspaZkYO+iEo446EpHZZ31dqzuzZZBUKp2FqcX10SVDNtjs4wMQHwaPwxxTSROj+sWWbKOEERpHIT1TYHah7xZStrMC8L3J7O0A09CsatJJNOLGeCZdLZJxbt6TNQ1s6uc9QmS0+mHpekjinnd6eYwyX47+0e8NZ/+20mhF3ePgFzKlvae6X1iWaHnwjGlPwVpQKj7ICKlerKr0a2H3HIC+iZRW3ArsZxtb481X8QuclNA5pasGh4by7Zqaeyda03monbH+vbVrqYwWzDTYHrGfrGd+hSTJyw3FhO9FfJ0b7T84mAczw==
+  template:
+    metadata:
+      name: argocd-age-key
+      namespace: argocd
+    type: Opaque

manifest/overlays/production/argocd-application-controller-headless-service.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: argocd-application-controller
+  namespace: argocd
+  labels:
+    app.kubernetes.io/component: application-controller
+    app.kubernetes.io/name: argocd-application-controller
+    app.kubernetes.io/part-of: argocd
+spec:
+  clusterIP: None
+  publishNotReadyAddresses: true
+  selector:
+    app.kubernetes.io/name: argocd-application-controller
+  ports:
+    - name: metrics
+      port: 8082
+      targetPort: 8082

manifest/overlays/production/argocd-cm-patch.yaml

@@ -6,9 +6,15 @@ metadata:
 data:
   accounts.homepage: apiKey
   accounts.mcpserver: apiKey
+  accounts.anonymous.enabled: "true"
   statusbadge.enabled: "true"
+
   exec.enabled: "true"
   kustomize.buildOptions: --enable-helm
+  ui.bannercontent: "Homepage"
+  ui.bannerurl: "https://home.olb42.com"
+  ui.bannerpermanent: "true"
+  ui.bannerposition: "top"
   resource.customizations.ignoreResourceUpdates.ConfigMap: |
     jqPathExpressions:
       - '.metadata.annotations."cluster-autoscaler.kubernetes.io/last-updated"'
@@ -17,6 +23,12 @@ data:
     jsonPointers:
       - /metadata
       - /subsets
+  resource.customizations.ignoreDifferences.apps_Deployment: |
+    jsonPointers:
+      - /spec/replicas
+    resource.customizations.ignoreDifferences.apps_StatefulSets: |
+    jsonPointers:
+      - /spec/replicas
   resource.customizations.ignoreResourceUpdates.all: |
     jsonPointers:
       - /status
@@ -40,6 +52,21 @@ data:
       - '.metadata.annotations."autoscaling.alpha.kubernetes.io/conditions"'
       - '.metadata.annotations."autoscaling.alpha.kubernetes.io/metrics"'
       - '.metadata.annotations."autoscaling.alpha.kubernetes.io/current-metrics"'
+  extension.config.metrics: |
+    services:
+      - url: http://argoplane-metrics-backend.argocd.svc:8080
+  extension.config.networking: |
+    services:
+      - url: http://argoplane-networking-backend.argocd.svc:8082
+  extension.config.logs: |
+    services:
+      - url: http://argoplane-logs-backend.argocd.svc:8083
+  extension.config.events: |
+    services:
+      - url: http://argoplane-events-backend.argocd.svc:8085
+  extension.config.pod-files: |
+    services:
+      - url: http://argocd-extension-pod-files.argocd
   resource.customizations.ignoreResourceUpdates.discovery.k8s.io_EndpointSlice: |
     jsonPointers:
       - /metadata
@@ -94,3 +121,14 @@ data:
       - BackgroundScanReport
       - ClusterBackgroundScanReport
       - UpdateRequest
+  url: https://argocd.olb42.com
+  oidc.config: |
+    name: Keycloak
+    issuer: https://cloak.olb42.com/realms/home-lab
+    clientID: argocd
+    enablePKCEAuthentication: true
+    refreshTokenThreshold: 2m
+    requestedScopes: ["openid", "profile", "email", "groups"]
+    # requestedIDTokenClaims: {"groups": {"essential": true}}
+    # enablePKCEAuthentication: true
+    # logoutURL: https://auth.olb42.com/oidc/v1/end_session

manifest/overlays/production/argocd-cmd-params-cm-patch.yaml

@@ -4,5 +4,11 @@ metadata:
   name: argocd-cmd-params-cm
   namespace: argocd
 data:
-  redis.server: shared-redis.data:6379
+  redis.server: valkey-primary.data.svc.cluster.local:6379
   server.insecure: "true"
+  # Keep auth ENABLED so Keycloak SSO + local admin login work. (Was set to
+  # "true" in e712652 for the Headlamp argocd plugin, which disabled login for
+  # everyone; the Headlamp plugin reads Application CRDs via the k8s API and
+  # does not need this.)
+  server.disable.auth: "false"
+  server.enable.proxy.extension: "true"

manifest/overlays/production/argocd-cmp-cm.yaml

@@ -3,24 +3,4 @@ kind: ConfigMap
 metadata:
   name: argocd-cmp-cm
   namespace: argocd
-data:
-  ksops.yaml: |
-    apiVersion: argoproj.io/v1alpha1
-    kind: ConfigManagementPlugin
-    metadata:
-      name: ksops
-    spec:
-      generate:
-        command: ["sh", "-c"]
-        args:
-          - |
-            if [ -n "$ARGOCD_ENV_BRANCH_SLUG" ]; then
-              sed -i "s/BRANCH_SLUG_PLACEHOLDER/$ARGOCD_ENV_BRANCH_SLUG/g" kustomization.yaml
-            fi
-            if [ -n "$ARGOCD_ENV_IMAGE_TAG" ]; then
-              kustomize edit set image "ngorse/swarm-dns-watcher:$ARGOCD_ENV_IMAGE_TAG"
-            fi
-            kustomize build --enable-alpha-plugins --enable-exec .
-      discover:
-        find:
-          glob: "**/kustomization.yaml"
+data: {}

manifest/overlays/production/argocd-gitea-token.enc.yaml

@@ -1,23 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:+rE=,iv:6V8DIeiL+5j7kzS3OuSXgArPhqLn04Wa/KoifCDOciQ=,tag:j+JJW61bELsePwJ2dfqKxQ==,type:str]
-kind: ENC[AES256_GCM,data:pIWaoeQi,iv:1yRMsEKS+fktnQW+uKnnmJVD4L0ddD63TY6eidSIKOs=,tag:jL4WmDBtfOG6sm5FBXrMHA==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:d6dDrnkNCf29T5Z1gFoJ85hb,iv:LdDvcvglvpoovGrHPSGLWxtXk8waS9i/zYMsYBpG8NE=,tag:gkF68mCh1jMixrFXC7Z+jw==,type:str]
-    namespace: ENC[AES256_GCM,data:TrRrdNXM,iv:Xf3AXVlR93CWBBhlRMB7q0SQdKiohzK/V9wOKXGTyis=,tag:Lf1z3FdESjPLa/tTApRU0Q==,type:str]
-type: ENC[AES256_GCM,data:FGwbGyKf,iv:yX05oJnqDKecf1Fs0KDPodFwXSSXGNK8EVhPzdZFGPM=,tag:b5KB4nfulU3ObEVDZOHn2g==,type:str]
-stringData:
-    token: ENC[AES256_GCM,data:ihpfWRkB41/g/NFje3WeF1YRUgFTKdKOGiiCH4uWMPFlTGwU074xKA==,iv:DrFTGMksxYw/2uyPLjR8lwmSwu7R8iVx1Wim8AzdEfI=,tag:NXbCHsrv0q4SklkvGMhMzw==,type:str]
-sops:
-    age:
-        - recipient: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQcTJPcXlSTHlJVG9WSEpL
-            UXh6eEhoTkV3T1JTcGpsTmRPcWtreFYvakNnCjllQUdUQm5vV0plSlpvU3g4bzh3
-            Wkh6THB1NTJqR21VMFM1VDNGTkVLOEUKLS0tIDdRVU9LR2lLWEFZVG9aTnkrLzBK
-            RVRKc01FZ28zT0s4NWVXSit4U2RZMmcKMkJlvMXPjT41/zpN0RM5XJOKCJwRiuOe
-            Ht0dm2182nT+cRzndX90gyItwqHiLcYb/JVjejln1JcD5fFGyiPqNA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-19T22:38:11Z"
-    mac: ENC[AES256_GCM,data:jRlYu7vjxV2LwAXMUqxrXhW2e2zh5EAPWgRH9hX6Ozr9UFoDPtpwSFOlX1ZGoqig37UwfK7no/aWIwejPUsPPjyPSX8XoR7OmDQVDBOX986/8xgT9AuEk209+Bau4mLptJQvELUGgQvUTJC6f8Q0mM6SRDICeVVo3p49LCXuhmQ=,iv:qjBED3IZtkZ+d3nb8KH2xBm1yuP5q5nkCR92FlP4piQ=,tag:ifTij0bliApEqpehke+omQ==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.12.2

manifest/overlays/production/argocd-gitea-token.sealed.secret.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: argocd-gitea-token
+  namespace: argocd
+spec:
+  encryptedData:
+    token: AgB/Ll5YQ8VtVjif0E0sngk2lB0SVkBmSREeZhJ9DrC0s1eWkY2QjnfBlny+iAb//VkDNEKqrN5Bkv2UrNdAXVp5blQ83M0OHpXxy2lSDkXgco6WiWsSYoua2hI/xq6XG9UxM78NSFaxmvo2nqUWcMxWZkcmqM6ne8zkORjiJN7DhXBqsklXeQTHAmJObEhiAXvcj1vNR69hIB/lwcU4+pxiLPsIsrhy4vTRA/Xtn/hRLoA4NyMrnjM7ZiOOwDP9/EDWCDQ6uT56X4DJP8xO/lJ1KOEhbvsobA9Mr5mTx/pYYBpFa5umPbnBDhNS+fs9P7IrLP7Ho4y9JfYpGCh8vithg2BX9WbbFQGoVbTWCsNdIZgjdhY4iyuMbxPR6VhsSwmo9bVvl3BH926NAgq3Ca5Ld1bi0x62uZJ6uqYYAfetmkHAkS67WlmgbkwO4s+24YyWD+lMeq6DRrEmXhBfJrDdLUany/1JJXi/JKsYGa9Ydj3E7Q8dad+oZ9NhxCFVG2r+uyx8PBEAmiVbc9I4Yp+Xj+LZ1a/FLVN+TDd9BQYX2cYlG27KzHSs4Tw+jlPKLnJH8VLJuauIYtW4bKzpwuLgmMv13UXtD2LBu3kruFWzgn/C5JFAKd28Gk0K4Iv309dtbkXeswX32N4rlRO7Tp2LFRgH5LJV3fZW2zOGvfCN1ZWX+T8E+K6EiytfCAZrbpy6Hnmewr0VXgg6iUwHdg9E8rdNk9yIIQGj4PK6QTuU93EbVIZGUFFu
+  template:
+    metadata:
+      name: argocd-gitea-token
+      namespace: argocd
+    type: Opaque

manifest/overlays/production/argocd-headlamp-clusterrole.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: argocd-headlamp-plugin
+rules:
+  - apiGroups: ["argoproj.io"]
+    resources: ["applications"]
+    verbs: ["get", "list", "watch", "patch"]
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    resourceNames: ["argocd-cm"]
+    verbs: ["get"]

manifest/overlays/production/argocd-headlamp-clusterrolebinding.yaml

@@ -0,0 +1,11 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: remote-admin-argocd-plugin
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: argocd-headlamp-plugin
+subjects:
+- kind: User
+  name: remote-admin

manifest/overlays/production/argocd-image-updater/config/conf.env

@@ -0,0 +1 @@
+interval=240m

manifest/overlays/production/argocd-image-updater/kustomization.yaml

@@ -0,0 +1,19 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+resources:
+  - https://raw.githubusercontent.com/argoproj-labs/argocd-image-updater/v1.3.0/config/install.yaml
+  - regcred.sealed.secret.yaml
+  - overall-image-updater.yaml
+
+commonAnnotations:
+  glance/parent: argocd
+
+generatorOptions:
+  disableNameSuffixHash: true
+
+configMapGenerator:
+- name: argocd-image-updater-config
+  behavior: merge
+  envs:
+  - ./config/conf.env

manifest/overlays/production/argocd-image-updater/overall-image-updater.yaml

@@ -0,0 +1,49 @@
+apiVersion: argocd-image-updater.argoproj.io/v1alpha1
+kind: ImageUpdater
+metadata:
+  name: argocd-overall-production-updater
+  namespace: argocd
+spec:
+  commonUpdateSettings:
+    updateStrategy: semver
+    forceUpdate: true
+  applicationRefs:
+    - namePattern: traefik-production
+      writeBackConfig:
+        method: git
+        gitConfig:
+          writeBackTarget: "kustomization:."
+      images:
+        - alias: traefik
+          imageName: docker.io/traefik
+          manifestTargets:
+            kustomize:
+              name: docker.io/traefik
+        - alias: traefik-manager
+          imageName: ghcr.io/chr0nzz/traefik-manager
+          manifestTargets:
+            kustomize:
+              name: ghcr.io/chr0nzz/traefik-manager
+    - namePattern: headlamp-production
+      writeBackConfig:
+        method: git
+        gitConfig:
+          writeBackTarget: "helmvalues:.manifests/overlay/production/helm-values/values.yaml"
+      images:
+        - alias: headlamp
+          imageName: ghcr.io/headlamp-k8s/headlamp
+          manifestTargets:
+            helm:
+              name: "image.repository"
+              tag: "image.tag"
+    - namePattern: glance-production
+      writeBackConfig:
+        method: git
+        gitConfig:
+          writeBackTarget: "kustomization:."
+      images:
+        - alias: glance
+          imageName: glanceapp/glance
+          manifestTargets:
+            kustomize:
+              name: glanceapp/glance

manifest/overlays/production/argocd-image-updater/regcred.sealed.secret.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: regcred
+  namespace: argocd
+spec:
+  encryptedData:
+    .dockerconfigjson: AgBI6LXdbT9OxBAMvJrEgqGgJ5rtnUo7cE2Zjsgp+BaoIn9cll76Jx8RxZ7I1s1Kzov1LZu38Li4s3/fo3DxkSmn+7YtePYAxD/VrZZhPcnmEaA7GOH3Yzmbkmb4ffqK+J2VCM3rTIvVUGykzRPhq8Jhs4sMb6o7YrdsjeqtfuWafQLL9aBwePzZyUbsjuzu1F2JFTOyf/0fDIds51WpbkHAzUah7BrLYk6Lte1u60KWwVCG0+cqQbGf6ovc9RP8ebCXnG34Kq5/gqwtl9U/MrUOXGegHTW84+jm6UZLQr7DuZFN/rtQZ8BwMT08JqpId+eeo3GEQ3DGpbQq+bH/JFLSsfWBE7j/id7d5JvO61mLYIg0KydStdFmNUROnD1TTRZ7Fi1wPUp9hlF5t9hgmQoD9aOuW6e+hOhkvxUMtpKhQg1Bz0Y+UKNwL+hF84YMbelo1zI9MaGRKy4e8/3F9Fao9W92MNYPT2BGmn8hpZzPpWFqmX4TeZrl+v4tgWMauIwQb+jmXnc4Pm4tzIqZmh8tHRfZQfBinwP8GQPM6x7apBeEh7Tsq00dTkdsCB3U/Uq5pflsR2oGvws7wQUkTa3GIrP3vnvpBd3joQYl3BU4+uSmbCzcs6m6UpEjVO1VKHjNe9iEBkZvrWOq2RNuBW8sHVCvXhceLbK+Ez2gimN6iA5qoBrxw5DCUQUeS/I9Ua3uzlea6y1SivDY/i05RrGhVeYFSscl33nv7Hj5I1eDwmCJaIoU8YmxL14TvgRBmU762TbbQ8AUUF4rF1t4fkGoGuMdthl46qI9a0CZkVVjtdkzVvYBGpDtrjQBxbWvsm8/nstrszZbcFGw5KvaTm+HFWUZ05rBcVVYjaAQYsgFLF6SBUzIQe+0ymYOmQ3stcAe5Yvz5Xe44hdHpRRG3Z+ZqNbxJHpI0QSkpVX50wqPpJqINBCAFwooigBNsKN5uS/EcYmdBpnpdBYAtHPRv9sksrpw9lV86Zl03PhO/6Vc3usdQz+ergoDW/mboxfVqWZ0Ht6JA2szJPkCAXmytgBzBDUrsFgu1v0vRf/EcaRh6zRTv+quPxlqjEuon6jyEpbPjJ6l+g7uOlvgyTf7wS11a7pZlWm2eH2tY3KXJxS7RPqsT/aaGyNQ+TV2H/VRw3dC4cjrxH1ar5CJ2u14QVNNBKkCNVBt7I/xOQxAC4D/4w4ATZ5nDgE1biwcniF3jMHdkwdemTRM70DtVVgzpyQa+l2zauOzc1RRSIwPzIG6wVg0m70MhHPsRg5kT0BNt4gWpbP65+pLYeKlK/a5ocHJtSDktuQSdEbW1PXGCsUV+f9lFuKJR3+7vl64BtPnkhkbk8ema5VgJFqds6pe5ppY7/ghUrspVEKRFmDkG/VvAgj/3TT4Hl0SKHHbt58qFh2VYLD6DwCIXlQBMHsAmaz4DEYT2zNS37bdzgiol3TItdaeulmKPu6/HkOchMAQlX81Xem6a6J13IJ9K2NQxfRkkHgEAkR8XC41yq+TB3MkEx/ox/5QNhlDD1Xzhl4LXajaf3I4O3bQyAT+G/Y+SJtICuu1hHKEsIubxx/hbdZF2EFViIChLNEvXtf4DahgWt25RimcquTUm64VRuwbcFz7MPnqwlCnodLDjb9CJ88SZ2JaLtS5hJaQtQ161eod8/1vohwXdIxmYVo2jE7IgBjSekexkUhARYGVdOCeCSIBrE+NaUkp0FLwiCbzrkOMV0xL2/5irPVsr9/Fe7AwgtHVzNFSBJugc0Frky6sg3g2y/g/wlQpd1LHzHmTebPy/BEz0LCYl/IjQ0LgtPIG/hT60VZ3E5K+F+ubwKMEPg/NmCg2nfwGts/Ks2kHprccJD8p1bEkZQcroKP7DmM/R+tlzhnzN97al3gWzd16gXV6bNOII9kTkKqS2t646Y3WLzlAoH0rIYbf5S1Ess4tMBSG8eyd/Zn5aoPLm6czBsY3b69rxb+QOgHjIDEliiUcX1XFhULS3fEbfEQU0YxAkYcEr7EijlphJY+erflMrySJw5GQA1TzarC41QDfmqNLunwuz2rzH1n8wT0qlYBr6Ih4QWilEvHIEdEQ5lLfY1CsFyh6QCN3n4DZv+Txsf3rwuTxlcZgehO/O5SSoJonLnsZZapbxCG6Hwr5CGlxREI61Zs3RMGZXMLmrP88stcHw4kY14A1ZpPeD01vX6vz8brvxwhbV7kJklL+Ma3LMTgsd6LhoKqhTiPVATpvKrMzbJcYX7eM1ydYrM5p0GWjDXUUzyer1GC/mzn+6YFWvk9WDGkoQfrGk09JV9u3+t2iFToQUt9JVX6PpkxOIQL1AugB2P31j69RJ+nTPWnHA/jhdM6uFe7IuSbh8o5mwgCrKNLV1hExe2mi3o0h4oNZfnIlYy+/pgFTmjjnHNc9hq790ijM3j/rv9amEy6aVgYcWF85sdfe8vNSvCBZdkkPwL3qrOu7fbNyUpgyowww1s24NihsClBMjr5TR60HNyPpZwA16oZLji5olPadKHaIn8WF7bavnorsjOJY5WZphl7m49ZusJEOssRdbl3DxpcbSKDfrC/MGFFmbsX+6SjzonTawo5BQ/lm7gP9Cp6YUss2cYfJq7UXfxt/B2hObw2/nDiaWJBcREwB+7lu+MBsvKDjA+VaZY9m1M8ik8W0wzDAoJLnpXbHe0ibMQYUmvoHMowvcAgyU+5QhgwpvGxLa/ABbkGP8flujS9pUQiG11i/+Sx9d48vvZOf4Y6gmQXLooauvSnS+378/Wmeorexv23deoeo/cFFGEWQ931r+bisWfnISNMlRZawKL+f5+kqCv0G5aTrxmukVuaOSpez7qvmFDmRTdrKw4nFhpHhc7rEHn/NZWeCKAk4ClTP6fyFF5QEP+yVyHFPcRCLq6fqzJ5cHA4k1EdrafDXQmFQKHKX7SlAz1DQa9MtLXgiw7fFlQEtH+q9/PPwg9HOxVrWivd7uWDovuiSfcssdCDO+mvZZHleZLUrplhg2T+J5VcBj13RanYBVcEdkqvQ97MV4hjQGrB/bNxnYXXfLoc1mluaG+dl67mEaPK7UaF2Rk31y2h8YX1EDvuTjcyc5MOXdtzOASIgr7Of2i84ny7+Vrdcyz4/At07ptx1LKXB0D/OfkWCsYnm3i76lgrNiMYzDRt9rq84hES9VLcXwTCOYC4PJcDZ6owYUZPfn0jJkeKiDjY+ZTM/DKFbGI388c3ODKGXOs0BnHKWjCIjmwIVtEQn7QnuSskfMnQeA2xZ1lVJzst5+toQ4k9BNQiI91wWIWbTOiOy89Whbyzws4jvPMrKwWGc4d9SHA7+uJ3MMwsm0mn3xnTdk5I2GWJ+oHACamFqk1FztCRdwkezn6sgFhL2Uv7GIYhAjARpq79hSbbhtdDoSg3RMom0dZCSV1d0/AgkgfQPUKS4YKYChdliQ225c7YP5ah0kAvahVbfxJhyTsb0Kpuu1/mo1Db5+faQYmVQSGctIczx3EL79vIsND5n5hiqUgnAELyo1YmBDIijQ4b1++XhkqKPEd7Qi75umxykj2Fu6upreW51k5TaOxG9RuZHy3vHi/wyEnsh6GLhi46gxYfYMHRxAmoX87Kgh7qA/kfgBN5xV/yIMZMTZzWIpOsO2OZhDDghi8VY8UgAi8Bd/IYAKoQpUJm5lE/taoSXrQ==
+  template:
+    metadata:
+      name: regcred
+      namespace: argocd
+    type: kubernetes.io/dockerconfigjson

manifest/overlays/production/argocd-notifications-cm-patch.yaml

@@ -5,10 +5,10 @@ metadata:
   namespace: argocd
 data:
   service.webhook.gitea: |
-    url: https://git.olb42.com
+    url: http://gitea-ha-http.apps:3000
     headers:
       - name: Authorization
-        value: token $GITEA_TOKEN
+        value: token {{ .secrets.gitea-token }}
       - name: Content-Type
         value: application/json
   template.gitea-create-issue: |

manifest/overlays/production/argocd-notifications-secret.enc.yaml

@@ -1,29 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:uDM=,iv:5zJ9zeBF9HcDpeW5pa2V8DKod7it0QmpJbPYbC2C5l8=,tag:VG3DWeTa0BrkAyy4IEPZgw==,type:str]
-kind: ENC[AES256_GCM,data:jSg5p1A0,iv:IQJbzH8kwB8MDtvPODxnVjyHPDJZsmk7pJAsxQgXvIk=,tag:2Z/s7DoQHq1PWCzYyxPdkQ==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:nTkL/kAqE63tkjbiJfMAi/FVktLgoXtvBMXU,iv:bjBX8Zw3jkNOXNqKcX1QiKAESRvVAlmy8iKPYWm9bXs=,tag:ZwkFTOOTSq1tx5G6VCCzwA==,type:str]
-    namespace: ENC[AES256_GCM,data:6wXXTlFW,iv:MNaxNMCC37T4cwcH7QvluctCD4hso/LTYZPGfc3Dl8s=,tag:W81+Q/KyX0mIrfbk/gNwKg==,type:str]
-    labels:
-        app.kubernetes.io/component: ENC[AES256_GCM,data:mIBkwyxqAgtQYHpKpvscsSOgGpEweCYX,iv:4Dq0AnGByGTtAUY5dgiRfpdcnyoqSHnLnyYJZ/mJTvM=,tag:qI7ETqJhfQtZ/1uJP4/LVA==,type:str]
-        app.kubernetes.io/name: ENC[AES256_GCM,data:fJliyNDZ4Rfa6D2QIKLKcmxGk7Pv59DNGLKqjVC78g==,iv:ziFzw+V3crWBdW5Z9mIpRUpuY1Y8xk0fPMrFfHuuxvk=,tag:6OF9t2bn/temQMEhrahnuQ==,type:str]
-        app.kubernetes.io/part-of: ENC[AES256_GCM,data:lCtXuuKf,iv:XaxeTocZimiU0q0QbDW0N66aKUFX5XHUnSaI95YdLQk=,tag:gEEpdYJ2wG95StL4Dr3J1g==,type:str]
-    annotations:
-        kustomize.config.k8s.io/behavior: ENC[AES256_GCM,data:CNXKM2k=,iv:CMLFoADwTlFdkL79xzF1wmqxWbtOM6h9GAfwniZz8Iw=,tag:xBpOixAte8XFalWYOTkbyg==,type:str]
-type: ENC[AES256_GCM,data:OCyLelpq,iv:Y1DFcVAFKY4X1gXuNyjciZfFNpfYUByk9qGudC90ebM=,tag:IS9Eqe5NwaiwjOfCNzKFpw==,type:str]
-stringData:
-    gitea-token: ENC[AES256_GCM,data:HtJ71iZcM9EBnYbzbpwnpdx8ErpEYxP+ud//klM7z1DllyaPpSy5JA==,iv:t2IvB5MsFEDC8XkDnKxACj6USz1z9cAwzNYMvpH2a/4=,tag:65N0OlkQgQt+74vI0MEDcQ==,type:str]
-sops:
-    age:
-        - recipient: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2STlCQXN3dkJRZ2s2SGNl
-            Wk44bHpjVUhSNmV1MEV1cjB0S3cyR2F5YkVZCk9sZmNaT2kzVVRjZEFyMkdIb1ZX
-            amY3bFpLOCtMSFdNZnQ5azVwcEdxbm8KLS0tIGo2WU82eVMzUlFtc3JUSkduQVZB
-            dVNGRTNyTmNjUlVBRy9sOVV3STBZMTAKukXeDMUklESDFF17XezNj1lkNg68Pkng
-            oFtBnxqsTDNN5WWIR/VWor8GQlA6uGKymIsEtIsMsKtvxCSnOf3+TQ==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-19T22:41:25Z"
-    mac: ENC[AES256_GCM,data:lD3x8ysEmZQwKzzFOAgdmmnxM5qhqm0iMwlxW/vcYBh6MyMGqcFC0qOCZMd1eo7EbyNYKdBpZrJvp+QXGQWjebPc8sqX0PgGPbWmuk/SqMo0ZMJnre4C59SSIUo9DdQhWRGZoOrbZ7xl20bV/HCab1ACqeoamBNXow7eeeaosKE=,iv:Igy0kZnu98uTpjJyvAOhrj3AC9H7eyU1I++6kpFtNY0=,tag:oWa4jnOTMTfRp28TMUvLFg==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.12.2

manifest/overlays/production/argocd-notifications-secret.sealed.secret.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: argocd-notifications-secret
+  namespace: argocd
+spec:
+  encryptedData:
+    gitea-token: AgBM3UGPsq7DkEVNwPdV3KACOepf8ojtaLv6R4ji7EbeJd5K4zgliHPvAFPQluZwFDs/xNq0/fr2gzhXltgQKm1hDW5+nF/DxzQgf/saiiiy/r6ykE04hP4TLo4pBtBIpzqL4TvPiwucR9GjU6zIx1oBI8vOFIl4SL2ONxhqa9h7X5EwQXuLli+Iuek35An5FaCw2VTk80F9gu0TN1/PLjTR2DsFm9mm7p5OFF3aMlxKhvdn16eGsYtBZU8O49/r3b/6upCBtnCvHfQpzfgdIaXiHRHeoo55lyVTa6dcz1oi4COqNVWyKgb7HcW0A3Gg+hQzR6wu3gOFZ7wrnnsifuFch6cDnqwE0tRJCGz7umrawuiFO0zkvQt92B3w4k/SnoLo60tKFDKZAzcBuZHEURfnOMjbiC+kIj/c8XCcScqPunXgelVLrIV0FrtLGEnJNFC6ZaKALKR94VM/jKvd3Dn0Ddwlwb3NwtAmYtDzPPcjzW2Duo0S+1ve1BcAOFod3OqEvqd5FzKMwUHMEro+tmoky7Ic8L2JXBmlz85/PlG1vfXUIT5sRGzqIWyxeiKYH3QxSrkQ2LwQJ1O5G2SK+HWAxVrsDuVB/en/BFZRkypLAJZkve0IQg6+MDyYAaopE1thargvCd6A4gIklHNE4uYFrEV2e0w6v/AUwhDVXyQ3F4xu9gBMpiZcP4ZfE7/MqOUfjpvRjJjW+3GCKB0jhZmZyniqMLTflrzauVgMaoHyEfrxVxFo+5su
+  template:
+    metadata:
+      annotations:
+        argocd.argoproj.io/tracking-id: argocd-production:/Secret:argocd/argocd-notifications-secret
+        glance/parent: argocd
+        kustomize.config.k8s.io/behavior: merge
+      labels:
+        app.kubernetes.io/component: notifications-controller
+        app.kubernetes.io/name: argocd-notifications-controller
+        app.kubernetes.io/part-of: argocd
+      name: argocd-notifications-secret
+      namespace: argocd
+    type: Opaque

manifest/overlays/production/argocd-rbac-cm-patch.yaml

@@ -4,9 +4,17 @@ metadata:
   name: argocd-rbac-cm
   namespace: argocd
 data:
+  scopes: '[groups, email]'
   policy.csv: |
     p, role:app-manager, applications, *, */*, allow
     p, role:app-viewer, applications, get, */*, allow
-    g, mcpserver, role:app-manager
-    g, homepage, role:app-viewer
+    g, ArgoCDAdmins, role:admin
+    g, mcpserver, role:admin
+    g, homepage, role:readonly
+    g, role:admin, role:readonly
+    p, role:admin, extensions, invoke, metrics, allow
+    p, role:admin, extensions, invoke, networking, allow
+    p, role:admin, extensions, invoke, logs, allow
+    p, role:admin, extensions, invoke, events, allow
+    p, role:admin, extensions, invoke, pod-files, allow
   policy.default: role:readonly

manifest/overlays/production/argocd-redis.enc.yaml

@@ -1,23 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:6AA=,iv:gn8Ynq2QIxaGq9yswYC1Lyn1u+64cs6itrioyp0xOi8=,tag:NirvNuZgGG89uSsPgC+g3A==,type:str]
-kind: ENC[AES256_GCM,data:U3lfmJE4,iv:dHbOBZflefIr3lrO/lgID+tyN4SpD9mJvolRwyYsh/E=,tag:r5dUwc1XIptNU02mKq7MRg==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:4oAtnzl73wEJxs/W,iv:5itZEVxJ8CubFFvB1u3xQCU/W+JcXr5EnPZUihV13fg=,tag:LySd+k+BECqSUshltsvslg==,type:str]
-    namespace: ENC[AES256_GCM,data:DylT9Hzi,iv:GR7tz4/NtwoXO0CqMfTApH7M+gG412xlCGoEW+D3QTc=,tag:9cFvr6USxK9+GyzFWxAM6w==,type:str]
-type: ENC[AES256_GCM,data:n2AEVnYN,iv:vEJzlQx3KmPpZ68uEuNwA3naVQUdU7hUu/qN5jw3YnY=,tag:9Q8Y2bM/3rffsxCosevueQ==,type:str]
-stringData:
-    auth: ENC[AES256_GCM,data:zvczuvAnQ7l5gXDqRxHoURrlsL6BMIDD5JH3L3ZxDA==,iv:UC8/24LpZkOMgqnE+gDkQS2hfGCiRNiQwatQq4B5KOY=,tag:OejCCqhG7ylvNNCOnCPL7w==,type:str]
-sops:
-    age:
-        - recipient: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0SG45WjN2UFhzRWU4Snh5
-            RFNiNXVMMU1wWUNrRzNlVkwvSWFULzdUd0VrCmJJT2piSWxqK0xRNWJYdlhxKysx
-            VVlZbngxV1YwNldveG5reXc3ODdGREkKLS0tIFRhVjlJcFNITlUwemxvMlArS3lW
-            QjZoODdNSGV1NWFhNTZCVWY4eHpOeDQK6RWdSxGF5dtKKXS9wMcl4D8X9zeqP4S6
-            z+u4yAZ3M4xPw9AHPZKlTJ7HGXs7e94cvXNVPgDKyT+lkCvFcU58LQ==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-19T22:38:11Z"
-    mac: ENC[AES256_GCM,data:CckEIo7zJYo5uQ58Se/yi67iaUXd4IrLQ1Op72L4BNZRDWDR9vOALn7Kt54tpBKLN8SN/5pCJkURCFUgzgF4WbRY5yNSNxMmzZ6PuALYppzbBzQetadEKMY2DvnCNypFRAf5N02nPF86Wp8a5AVBJEjxwgQBS9hPNVo4k7X2duo=,iv:+ddDScNMImUWpa7O206esJMpv3gMyaUjxm28fATNjoQ=,tag:GMGxtkdWl1cLzb82mNzaAA==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.12.2

manifest/overlays/production/argocd-redis.sealed.secret.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: argocd-redis
+  namespace: argocd
+spec:
+  encryptedData:
+    auth: AgAMk6c3Vl2S2cdvp1C+PzaZDrGfcn34h5JU4qGraLW9/R66v2+4ik53FGXeQp9Petd5IoFGd3TfODFPz0ulPnAHZYdIWG3RiEOSilXppgwksqgPr1hI8uRm8SwCQPA/oJM0rPxLX7Yb7qkWmQ3+PSyXazlfgZNap/uf99BwO8/MkOXs8BGD8SQBf00G3HFtNLgcXRZoDp3bGXd5KTfbHTIYn1PR/XcQNw2DjxtRQF7zQOukpspE78uFV9IK8fzzyCa1y9EozXjD7w9ICHCyGw+aJV6rp+gzqxMGi5orhsA5Hr4+x7AZO3MgsQSJdnPepETATLY2zlGml3NqxEn9/hFLlQqgzDeHdzTSxjJkREMe0HRJ8+kzosHC9NaS/BTJxntDse6yg6Jav42I7pgRiGTOhWAfUk4Nczv25+Cxu4WBywiapfgmBULVqcDrhHd7PhahphT2u0ECGnshNFV6BYWZVUUvOTXo29ArUUuZKYHXZU9+9IHxhvrYAfsad9XKx6/Z5IluOR+y3BOiX0N3SUxzgh/stgu2Ms1yeD8clbKd5A+LATCUl1FqEOdzooSWCkDmj602BjhziNbCifWRAkPunNYiWXcoc+4/ylsVWbICYTX3Exr8GBxezY93E1/lU09xEupn8ZqkmTVgWRmtgFZEDZV7XaTvynbOdUYYMCwrq7yuA8rvrENGThIMb4lQ0wyRY2Axn5zpj/mKf7oh59Tac5ujV5Mko9oO7SOWp2AQ
+  template:
+    metadata:
+      name: argocd-redis
+      namespace: argocd
+    type: Opaque

manifest/overlays/production/argocd-secret.enc.yaml

@@ -1,29 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:0Dk=,iv:MBWmnkHji7VXquHkJIuzpSTHDsTmN6OuvtGq1BIyeyM=,tag:JFW/1HOaByUdx+gXE/z5gA==,type:str]
-kind: ENC[AES256_GCM,data:3xOGEszG,iv:LHUezglyWj7/zCdJtk12iBZoAO3fL7J3iN5fJgirXVU=,tag:ByU5f2TfIcPy1dvyQeiTRA==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:hzVHdyJNqK4L763uoA==,iv:frXtAV6aGIKKtdBfESHTla24kqJ4tWadJyPOniZLQY8=,tag:U/7mylj9q+tdn3zy71CG0w==,type:str]
-    namespace: ENC[AES256_GCM,data:ChUXhzu1,iv:Ha5cKWFVdk1vByysEpg1weZ4APJL8mCXUhySoKrvrFM=,tag:K0rAPI1cCKAa1s3grwk20A==,type:str]
-    labels:
-        app.kubernetes.io/name: ENC[AES256_GCM,data:goqINPH4t07kdDGySQ==,iv:681ojmz83BAMcpDBZ1/Q7vh+HKGCaCsSnFUTXAmeX+E=,tag:fcjXO+BB5NNGMUPTmRODow==,type:str]
-        app.kubernetes.io/part-of: ENC[AES256_GCM,data:SLtRJ/GB,iv:4eHOqd/0FHjdNC5pAg1rRU4RM9GH6V4/28g8AcWfT5M=,tag:Y4O58iWeUi9zOrn4loNrlg==,type:str]
-    annotations:
-        kustomize.config.k8s.io/behavior: ENC[AES256_GCM,data:gU3w9y8=,iv:6Ktt02hCJtAC4WycmLl7/kHMPoAnDa7OSX32teOfcRA=,tag:xAz3NkBxInS0HU80kcCRog==,type:str]
-type: ENC[AES256_GCM,data:kkRWsfy7,iv:x8tBB4mO2Yl/By53IPgadKsmtbLXyitXs885tk4+bOU=,tag:b6yYiS1d17D8kFSE29uc8w==,type:str]
-stringData:
-    admin.password: ENC[AES256_GCM,data:n/F+kRLtOct4ZfZ8+5eQjwjLDjT6paDUSYKupAcN41+wdvdYHXEKG7xh92N5lycUYlb2FKCQUvQtQIx0,iv:zL7koqBy7j2N68Vg8MU7k7rL3OfgmS578WZIyJ3Uk+w=,tag:xjdVzaky5cR/6lP4MvlqJQ==,type:str]
-    server.secretkey: ENC[AES256_GCM,data:U8HySATKld5H+1qiY3l+p5h3VAOnA2HIbdoGU4e+rxJc0D7WVBJc/s9qqoI=,iv:nAVWcA1lBIruOKkJ39/E/2eYqFKj8KEmk8GaXYNJ2e4=,tag:XGSl3SpVbNcSeEMaavfbVA==,type:str]
-sops:
-    age:
-        - recipient: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxQm1Bd3VIU2NRU0NQbEx0
-            elRJTC93ZGNBeFVIZmxmL2ZOUmUxa3R1WVhZCkhOZnJGOVdQM3A2ZGNFTm5HK2tW
-            NEsrbnI5alFiY2xUUGlLWjV0ZFBidm8KLS0tIHBTSFlyMkpJR2JZY0lOcS9NQzJC
-            VmtYNy9FOW5zTEtGNVFhclJXejBWejAKMNd9TpbVKcMWCCbXVIIqrw2lalsiIH3Q
-            yZoCIszujQMpomaHtPgRYSBdfqa2/WWgxNO0jE9EWEClW6awOce1/w==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-19T22:41:25Z"
-    mac: ENC[AES256_GCM,data:6U5XlgHdnojCNXZGjP7bmm8MKQGgA9CJNuR+muJ87D6HQxaiCv3vii6WDf4bSkKoewZ8/NX5+ISPg+ntKra9dS5Ggr7QFT09xzL4wuDVm5StPZcUwbYeJnrGuMd0cGhHbTSCJEFnFDHk+pb4SMa3KojfNJHmCMIvzLAjmEv9eWU=,iv:PbU58ASf1ltuaoCYsg8nCk1jnlC51zmuhMoIuqnvec8=,tag:wltrBLCx3bI5vnKBUusIPw==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.12.2

manifest/overlays/production/argocd-secret.sealed.secret.yaml

@@ -0,0 +1,23 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: argocd-secret
+  namespace: argocd
+spec:
+  encryptedData:
+    admin.password: AgC+lPhvANEdlzWzDqYOl3KWrKge9/067Odr/CKjqYAdi6TDppyt+lT+R4MwmBok64iQYjaZQa4/0BEgaVAP1sy1NzoXLeXPMa7x0sQWFhITkFAAnwWjoyI2MwGnIsX2Met0OClLzrSTHpusepIEcHCoGNbQ8hFxEHmrKdwHjmdWvDnedYGqkFGhQhoypaRm1MY+mhxyKsIawcZgo+/PurlunoeTJVFeUSWliB7Q0Yce9U2p6oElMSaQXLPkwL7cj834OPe3wPhcjAzbmxPCsSdyqk/8P4vRJwlLZ836sIwXjUsApmS2WgfGcaMeDDB3Vcsn0lRzqnBQ2O82r6vT3yZrzFSSKeF4qBo7g+Ra2lIpfilzrCg58ZjSm1zpeSD3WR2o9Cu4OCPcUbvFX5mnn5Fk3LQd40AKhCm/aeES1ddb9qLJfpRVf/PZiUb2tD5+9JlZMjTdGhyN7crcqaAuBC+eRP9agAuRZioMU+xbHpWV3VVEt2vHuwixeq7Epclv7AAfIo/uLdp86/e8DTBfesZ4CwCNlGrBFv/k+WPchgWjsIja0rpSJMTTl3dgRbmAmbrmXx59QBRKDLsiydnawumb3bccQMFK5/RYsZ2gEYKdF3nkabuoH4aO1T+8sNkxunskcmRMXe/L7CXPIlEzF4PZ/nti4nh9D7d7MpvcVsCJoDzx2ylyDWCqzWJCnFc/dwbBbORw5P1JdVCpoE47b3jwkx0fwrVdExEDP6jtXny7NWOjHr5LqqFmNCLWp356jFSyEWZS2fZSmjmSD0o=
+    oidc.auth.clientSecret: AgA/oAxo5cgW39jUzoWlQC8MLmPtoqYepOFkGvp01wNjXUCj7TdM7+PRSxT/jWuGZINgZ+FUNerZrV2KQ1RdK+km+BKdjdtqjI2SskTK2UpqgbXKE+IhbTRLdiICFDwHc53dr2F7xKe5ouNu4cel+LeDebQyszjHaH7NrFnMB0QDVlnQtsiHreZyCmKCNVAl0RKR4XmKctrc+hNz81tvbnLuPgr9cjhFKFdRK/2KJnkDO+jGsfUHbhpJEwbzFGtNbuYnMxfvOjmcuuDKaHg/+1XbXRD2e6Xohs4fKWj+hDcg/z/fCvq9BG8RcCdwSZTgiAu+0PBo3CUMutYztGHu9MEpyDeozudjrhN4jnnL0q/77F25x+nZupbJDGZtrxLDu9yoAhFViI9/Rlk6gkrrNIxg2RYEO3ma8I30JcuvZQJ3E8isZRHqj83dd8xIDFq3CHUtasf2VzI9nuxUBv79VkTdSb4fj39rs2D+5mC4iNQlzWjlbmn3nlIp3vSMEGCohN4vhe8RNlegWpEZ3/XtasNaIQFg5lQiyGodOLZDr4z9hWkBD9df0dt0DP2gmy8iiq7RgKx+bfgZmTEye4/6qYGRYUKAUQ7p2sYsgWIK26KnlY9p0TAmixOfy+2BQlB/5NPo6DAgSCDrKsG+AnRtpsdbFPpW0Sy2vlyK51FzZRO/IvCei3gVpSiFARIq9JAv6GtHN11QKBDcEMzcMN/G53sN1hKH42iUbPy+zAQDv8uJ9xaOpbknu+4mSMqxjkYXzjtVDbr3f5npxM1X7q1nQNMQ
+    server.secretkey: AgCo1O0X3rHMTmmKzQsWBNjYkUApsC/MmPVJJwPscoG/yQsdWYIcjoFv9klKLXT+knNw09+IzpfWzACUAsl0GBT9G9akUrEhxAm+vgLJ6zhTFxPW5CmfgrSxodMO2uZgxjjzGzOKqp97+2P3ELC/BpgiiVGdO6OWpVzxxREH4U+DbtZ6ZHJWz1YcNMLsOZbvv28/ZsUJ/0iY/HKcGkD61LpVTj7i/+QcT5p+YqKupdVVMmXHQLkYVbd9o1CzV4cR1J4hN2WI0VWxgZzshlYYgshL6OEjnrH65le4lbjgMKNh91O7HeuIDQPaQy0eeB/tZj/53ltQnDu6J1LilBN3sSdj3277rgrP+XY6OaaVB5vThe0S4WVykIuMczLk6rvqQMQuAwNfAvGZBlvuXHPiPECFZL1PU8xfOgajf4HwrAoHDLS8xqSzskUU7qdqStE1UJg08JcLg4bG6XbOVh1izqDnLUGk2QF+kQVzayEW9v6i30sbnRpLjRBnk/nJ0wlJMzIPCZaSH8lFBrDWjVh+a1cY5ZvWmEipXMr4tSGdmrKR94S8dCGHp7QGcjiiNI6iEP2FaAOHuN9ohfyPMZ1TQ7CdY3T4dHIrg2vZvS+arc+XXOZ0ISleychG3hN27UEZm0CJS3+6H7+Qn6ir+BmDjPGKXwy3r7U312NZuHWePR2+epiSgnben5KljImObU+bw/BHXL7guVVllfsrLL4D+YeI5kM2hTtOHLZeUA21aA7hw8spdP98NxzefvO6Zg==
+  template:
+    metadata:
+      annotations:
+        argocd.argoproj.io/tracking-id: argocd-production:/Secret:argocd/argocd-secret
+        glance/parent: argocd
+        kustomize.config.k8s.io/behavior: merge
+      labels:
+        app.kubernetes.io/name: argocd-secret
+        app.kubernetes.io/part-of: argocd
+      name: argocd-secret
+      namespace: argocd
+    type: Opaque

manifest/overlays/production/argocd-server-patch.yaml

@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-server
+  annotations:
+    glance/url: https://argocd.olb42.com
+    glance/description: CI Deployment
+    glance/icon: di:argo-cd
+    glance/id: argocd
+spec:
+  template:
+    spec:
+      initContainers:
+        - name: extension-pod-files
+          image: quay.io/argoprojlabs/argocd-extension-installer:v1.0.1
+          env:
+          - name: EXTENSION_URL
+            value: http://argocd-extension-pod-files.argocd/ui/extension.tar.gz
+          volumeMounts:
+            - name: extensions
+              mountPath: /tmp/extensions/
+          securityContext:
+            runAsUser: 1000
+            allowPrivilegeEscalation: false
+        # ArgoPlane UI extension bundles. Copies only the enabled bundles into
+        # the shared /tmp/extensions volume. "argoplane" is the required shell
+        # bundle that renders the feature views (Metrics/Networking/Logs/Events)
+        # into the ArgoCD UI — without it the feature bundles register into a
+        # window event that nothing consumes, so no tabs appear. Keep the
+        # feature names in sync with the enabled backends in apps/argoplane.
+        - name: argoplane-extensions
+          image: ghcr.io/natrontech/argoplane-ui-extensions:1.5.1
+          env:
+            - name: ENABLED_EXTENSIONS
+              value: "argoplane,metrics,networking,logs,events"
+          volumeMounts:
+            - name: extensions
+              mountPath: /tmp/extensions/
+          securityContext:
+            allowPrivilegeEscalation: false
+      containers:
+        - name: argocd-server
+          volumeMounts:
+            - name: extensions
+              mountPath: /tmp/extensions/
+      volumes:
+        - name: extensions
+          emptyDir: {}

manifest/overlays/production/argocd-server-service-patch.yaml

@@ -0,0 +1,6 @@
+- op: replace
+  path: /spec/ports
+  value:
+    - port: 80
+      protocol: TCP
+      targetPort: 8080

manifest/overlays/production/disable-bundled-dex-patch.yaml

@@ -0,0 +1,7 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-dex
+  namespace: argocd
+spec:
+  replicas: 0

manifest/overlays/production/ingressroute.yaml

@@ -4,6 +4,7 @@ metadata:
   name: argocd-server
   namespace: argocd
   annotations:
+    gethomepage.dev/group: Infrastructure
     gethomepage.dev/app: argocd-server
     gethomepage.dev/description: CI Service
     gethomepage.dev/enabled: "true"
@@ -33,4 +34,4 @@ spec:
           port: 80
           scheme: h2c
   tls:
-    secretName: olb42-com-tls
+    secretName: olb42-wildcard-tls

manifest/overlays/production/ksops-generator.yaml

@@ -1,16 +0,0 @@
-apiVersion: viaduct.ai/v1
-kind: ksops
-metadata:
-  name: argocd-secret-generator
-  annotations:
-    config.kubernetes.io/function: |
-      exec:
-        path: ksops
-files:
-  - ./argocd-age-key.enc.yaml
-  - ./argocd-redis.enc.yaml
-  - ./argocd-notifications-secret.enc.yaml
-  - ./argocd-gitea-token.enc.yaml
-  - ./argocd-secret.enc.yaml
-  - ./repo-creds-internal.enc.yaml
-  - ./repo-creds-external.enc.yaml

manifest/overlays/production/kustomization.yaml

@@ -1,23 +1,46 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
-namespace: argocd
-
+  # - argocd-cmp-cm.yaml
 resources:
 - ../../base
-  - argocd-cmp-cm.yaml
-  - ksops-cmp-config.yaml
+# - argocd-image-updater
+- argocd-application-controller-headless-service.yaml
 - ingressroute.yaml
+- argocd-cmp-cm.yaml
+- argocd-gitea-token.sealed.secret.yaml
+- argocd-notifications-secret.sealed.secret.yaml
+- argocd-redis.sealed.secret.yaml
+- argocd-secret.sealed.secret.yaml
+- repo-creds-external.sealed.secret.yaml
+- repo-creds-internal.sealed.secret.yaml
+- repo-creds-helm-external.sealed.secret.yaml
+- scm-creds-internal.sealed.secret.yaml
+  # - argocd-age-key.sealed.secret.yaml
+  # - ksops-cmp-config.yaml
+
+  # - path: disable-bundled-dex-patch.yaml
+
+components:
+  - argocd-image-updater/
 
 patches:
+- path: repo-server-patch.yaml
 - path: argocd-cm-patch.yaml
+- path: argocd-server-patch.yaml
 - path: argocd-cmd-params-cm-patch.yaml
 - path: argocd-rbac-cm-patch.yaml
 - path: argocd-notifications-cm-patch.yaml
-  - path: repo-server-patch.yaml
 - path: disable-bundled-redis-patch.yaml
+- path: argocd-server-service-patch.yaml
+  target:
+    kind: Service
+    name: argocd-server
 
-# KSOPS decrypts secret.enc.yaml at render time.
-# The presence of ksops-generator.yaml activates the KSOPS CMP plugin.
-generators:
-  - ksops-generator.yaml
+# # KSOPS decrypts secret.enc.yaml at render time.
+# # The presence of ksops-generator.yaml activates the KSOPS CMP plugin.
+# generators:
+#   - ksops-generator.yaml
+
+commonAnnotations:
+  glance/parent: argocd

manifest/overlays/production/repo-creds-external.enc.yaml

@@ -1,28 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:1wE=,iv:ficrVUo+uP8C5J/iXKy8+h1O26XVRDOI+ZYK0+LFbnY=,tag:Nv6smBHA9KXzCV5V/xMhdA==,type:str]
-kind: ENC[AES256_GCM,data:ROFGmJxz,iv:pT/eVSwFvFU7Yh7jt9KsT9ZUXPgt2YI8w0miXjqg9oo=,tag:qIv3AetT6B/68sP52OHXOQ==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:492q0gdP9XAl01Xpdr0JSRWqRBo/4UTuRQ==,iv:t0dtGisAlzR6REQEagDs7WKvNkTFxvd69MhxKE1wsUo=,tag:WSlH05eYMLg1vXahnGvxsw==,type:str]
-    namespace: ENC[AES256_GCM,data:eXTVlw6u,iv:xfaxh28LpCSIAplxZ8epORxk0jbkkceYMNs5w9ojiYU=,tag:zR/OVbIyJzlu9ZtYaIyfTw==,type:str]
-    labels:
-        argocd.argoproj.io/secret-type: ENC[AES256_GCM,data:2vzzPNyKXYnPxQ==,iv:JIzBGW2vIK7v507zFSmfHsQigZsw8ZQwBWzsQfqEvqc=,tag:qt8Kp8kB5LGxE+TDNNnVSQ==,type:str]
-type: ENC[AES256_GCM,data:J7FpF6wc,iv:GZYqsHm7NYGVYwDEzrFI0Py5xjGQ9IIRm4Ms5FYZIqM=,tag:WaCIIDDK8K9fKhVw/CWuqA==,type:str]
-stringData:
-    url: ENC[AES256_GCM,data:NDdACSJI+bnYwZuVXbfuCDpoyrX6jw9WMcrd,iv:IYQCC5G7/uPqPPeusrwcEjNpD3M4zrFcyecMejwazu0=,tag:1gy+wmjSKmcfhZZEVcWdVw==,type:str]
-    type: ENC[AES256_GCM,data:Yssu,iv:s/VoPna0rykWa0Yotl277UYx+SQfTOl2MQocQDdXaiY=,tag:m7yYbCGFiTAsSRf1nD/89w==,type:str]
-    username: ENC[AES256_GCM,data:TBk4XpEi,iv:CDjD/YwCFCeH8zG1dXIM8UwbTWwkpL886NWdXp0/nIc=,tag:nLyX1vFRCDTe/qZAtY3EtQ==,type:str]
-    password: ENC[AES256_GCM,data:MUnIsZIwWrhlNiqw+gy8tJrXyeMIrVFef3muGflMJkNve9amPMqPpg==,iv:PfCRY8eVhRCO4ysRdgH5j72kT4RF/kthGdAgedxHiUc=,tag:9FN5cgxFouJ9/t5nLeuFEw==,type:str]
-sops:
-    age:
-        - recipient: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPdmRDdFFNby9iV2lFVUhJ
-            THEzOElYRlpTSVNtWldKSzhYTmJRdnorOFZJCmIzSVgyZiszWURMckxrL3BBLzAx
-            djhpL0o5V2F5c0ZjaHQ1TFlqYm5pZGcKLS0tIE9RWXJaUXdKK2ptdlJ3cTdyUnBx
-            c0tNUStCTWtwNWVEN2Mvc09QdzhRWlEKjZUDiIndwFcXkoO19bjaSxcJpOuwt84k
-            52pIF+PX+mrQIxT9Jc352ZZ0dw/pca/wy3/t9OzCOw9shdVUyO9PGw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-26T17:28:56Z"
-    mac: ENC[AES256_GCM,data:vmQNle032FXN6zQ/KEiwFJKQZKPoLCHEjrn8w4Kdk1MEohK3i3NnSiyL3vut1TYhJGIKTHNMDTP/+jV0oughkQwM3eXMOStF7IE2Lf4Rq0CRA1YcMOVUQvwJ4wwT8O6DwIBCtZRlfT9Na/4RevY4yvk29+gR5es4SLvf8UAU1fo=,iv:RFKitAjWfRrAtNyb3fqFba3BoMoHniES6IDCJbuyDs8=,tag:3apP07EpncSCOkw1fHskSg==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.12.2

manifest/overlays/production/repo-creds-external.sealed.secret.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: repo-creds-gitea-external
+  namespace: argocd
+spec:
+  encryptedData:
+    password: AgBWn1SRqyssTnLmLR4EaINdP1uQJiiQnnc7/cXhewbEc0Jk4sLLVgb6AKM75aq8EwVmK7mnjPGSjWbk9yBQ2OC90XAfBw3onqmp7sx7wcJcVJKCmfcNrfRf7MjLXUt5S2CxtxsbvXdRRHmEwu6DvsajErvBLMxEiJB0uSyLsraM+uoZGLsiU+nAjC81vRP/aFMne0hFg3/3SrbE8rAKRnTkuUr1gysEZc/0RINR1H7JpzcBtsJj8VVdlAKv3ZT/SLkg7ecvM3WfNFoBgZSoWro9S5N1m4JZFu+AazJxRkYL0mk1YdDOLcgcWE97uOLvfCbTVJwXt/gI9Mpv1ZgYH0x3gJN361FwcNsRTHrRovR5GvrO56Eo2xcjGuDte5vorqBee+tnLIATfh6Myi/0Xq7/KrD6E85LpHuOZ0zKqp2WIm0zf+K5Qek8QFiMoCjEc0JTY+v1acOkSAGdd9m8WvEESjC2o+UJLpFDszPCwen3EJ+Zak7ZWCUJNI1h5bwSDpf/7o72Iw2DGJTlWbKd4jpZSTk/njebdj5fSn6YDl5lDN08nSq4K1xEn9fyBDm6p0RgnYRS06HhSzvDh0hNc1tUqmgdsSLmUj+yf9kCaU9sqBmC/3aFe7Ug7c478Jphszam5Pl0dgWY/RJQOphbcqxhzxrNdRfBwiZkXWG3O1GsLuEK/z7ihZjb7e9UVtjZZDmrLtahFKP7JypDLJjvWOZgatEyGmhASJTL3bOeh4HQC0b+P958z/pU
+    type: AgAD1bzjj2lwlUv0ldBi57e4qoEov4Xpyek/r0lKvrGlXqCb5wden52aL/P0Qn9gCi4ZAEksymBd1khVEonPzfkLpdXkZDZP4QeNUaO+SF6moycXk7IDjurhf/IFNEMKu6R0vZ59TqZkxzaUn7ldLvHU2zsacw3OnoGImvcohIw3MrdRylVN8zi7MDFdmR3wD+bTkyLol8uJFYRqtGKCQvKoPb6F7TkSs9RofTF6uqxS/aNJNkgBw9Kj55EP9VQ55Z+vqclRQE7NT03Wp9gXSg+a6dWzKIF6YHE9pTXU9BpqHU++WpluEgN0TrSUOTO3lUalXX/jZ37NTKDoEbxZLppGtVZpfkofx1fTWaW8Jusk+luBbEMlDNAeynKS1P9k09VyRSoxBYqzT7XT4+HWMwkGLYXZ0sSvkP72681C5iLmuY3+noLM0Ew8WI4Rbrc9i3HCM1UM7wZfvx+INVSnVjyyOiJSnmrZEXUvLoxA0ivW2rf4O6saH0KKAujvdBi7wx4VeoDqhBdRNoMaXEbB/LawxqvhvvakC4SpyByb5DAyeQ3DeraOAU0AbVLEcZaSVohAS2R8/ECFRTbgjkYOtZ4yBfvB84nXkiM9FKVRIRyUxAbDW9yZUv2oTXfbpbQHmYaaM00OJH732fn2EBZOJSYWvkKNdgDZlg0UDZalKHt/iHA3WL+ZPcio+bAvprEDY0Jypig=
+    url: AgATolwThJhFEfmZSdGYrJJbalF736jGCKkV5JEAZorbQmVuRe2rFKBWCtcoYoVbz8TuYnDadzUrFxRc79VfOlVghYduNq9GuCph5zAoCAeRqQOUQLmsQy1Lcg/CylH9LWQXbl1VjPZZLaDfpDIpkyikFQADwfIO5/Ab/U+8S22R5M+Uw8zqyyCkPs32iAMOTtYGpecrVlbFGxR4T42g3dJksH28pt1zaoycq9N1cAwFxnCFznaIul3XF7aNUgNflHFvmnqRsSYsSynoOgBsKJA1OERYHCAmpzByQmOQEjtKBHlFFrFZTz4PU+yIqUbg4HAKFgC+0l/saGBCZ70n7IPzmXIzq4rG332ArSf824+vwEjTXpEmy24aYguQls9KmMHQVJT/7L+1JKEZnSNg9GXT8E1mh2jIfCa/oRWiAWK5n0kogV6cIc554bMkoSOJOn4U9zecE57SmDoXbeHhyu6L+Au26X4UgdwkuD7EhfT1Hakb1ym5KoQPd1wUBCSBN9InZ184gVOqE7jSX3CbdE9YVoEz1vJsaamep3hmcWzCMfIlKwrfxScvPQ9RCvYB7/yq0D/lkQGe7ZX8pc/BLH04txjlkA4krEfSlmNa3oHl60oikmeQFbD+mzLvpcOnN7ZdwI21H6uKruSMThc814goQAKYhVgFHUToTJfNu7qso8/lfLFFDJ9nBz/RU04MS139KBfBocoR9G8PrjOxGcOQC24+UB+rDooXb/I=
+    username: AgAZ9K23111h5j+X2cg3kYIh9gH5AURCxKdjnpWsRISe6r21pxHsSYhdOp1WPYqYvEA4WkzVaT2BItoQVFWKyc89X1Q7L2Vp1zMmMHeRF5odc2sFZR7VzK83NmOIZjU3W17RcY7HIuFV+y21L28Nx8wortbQVV9/3s6k/vRsRWaR/IdWCl+4+ofsrBntTZPUbMct9t/b1v3ynuq0/gJiXGJ+OyhaFW537cvSrlUV+EMjtYRe8GsNHjxqfK5aFxYav7DjLHkzW7A/lX7/mlSRS6z9xX4K04gQKyDCjxY9+tfCiSM4wZmoEpUFY/5R08dHwcmpuIgYvEEnB9JdCzFSXzOg/7t4qX3QkFkQOAdYYB0Zz886m0splTrmPeEVeUXOV9KBrWi3kFcXBJqMfmWElZ5oJFlx/NdXLjXhb98dccXC4pS5HIBEIrGN548BjsMBx9mvGRJrE5Ydw4n3NwYD8YuO2yto1s70EQaaTP+NRp/CP2ej0v5ggcyBg4H1sgt4ub2IEUkOSp9Ay49h1Argx0y1rgJ23kWguNwKNTYKaT0NL1sw66ZmW8rWoxijpTDXKzFZyefCzJfVoMhUfqLymVW9/O3Swka9qGwIE4oMCnBHS6u9niGqZAIiJAxtvQFltfz2fY+S9B94AkfcPDrlGfZ/kt3/lacmyjEvafDX7SCkAHKKG7aBBUBvQ6emVX/LjR2smJNOHyA=
+  template:
+    metadata:
+      labels:
+        argocd.argoproj.io/secret-type: repo-creds
+      name: repo-creds-gitea-external
+      namespace: argocd
+    type: Opaque

manifest/overlays/production/repo-creds-helm-external.sealed.secret.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: repo-creds-gitea-helm-external
+  namespace: argocd
+spec:
+  encryptedData:
+    name: AgAAqZ30srJ9RVTiuq3YiP9GJyV2B+oNRBsPxxCbCRGn687uIfHJOAkdzW/sSbKErWyco/v97Ptej3tbmsoTRLpLrAVRQp5BOl7ssJMUvp1hcL8OzxjgZSRtYo+lpKrgRrCZpvdqtrxVjlQqcwUBI66PVkQCKPfVY5vin8tWJIsfn7Gp0MLaaF3yBD3JEQvGR4/eAmoPleB3SEI7vGDq7e84XhBssjKa6svAblAG9RjZktwwhAuN7iFA+a4i/b9nrQCXxH5KJwzCBsmQINAELlqTP4q7wCCrDENB6k4lbR/kxR2hz3j4g0J7KDEe2WS646DuIwYSUNNftrzKd+vCbsF9a/3fWCU+YU7uG9U8OIHpOtfGyaVDbnTogxpiYfMONTrrsWGH8wfNMDspBT0aCrf9bz7UVeyb0ZfQdxPqkSb/2RNqLJGEXjyT1z+MNd3jc2QQzxaiOLkjj6C9VUOAfBnRLWkxhJzFrFpy0hQTYuub0Z55NSOlrSHpmFRb4FHpP/3njh4cK/r1YPFZe1WMy2TNHNiK8h6cKrfHQDcjXg/1Xg9wh9KG3EPO/KGKrK2udLj41qaP3KjKLJBpIec9MCIZgGbtTkA2ZWtbUvFvDbDEOm0YhbVRvAI3hEY41oZIg46RtVIOP0l22Vu/BDuMQ0RdifMKNtHkgJigGHyllXjiqMAV7KfGknxzJOx/Ckbbw4oSeUv5Xg==
+    password: AgCJmG0OHFma7w1fUDpHx4SXRw88YZ7qrZvd/ngmCKSTh0rtDqDpUUNkPd8Bb0wsRhtN1AaVCR/66CqJECet5a4W8R0ycbjKICnoEIN0tujyq16yIBmofYEa0vArpTmIKyFIF3efNlkO79O4xGDFxc/ImApoR3J1K3ikrXV8tziIovANchxCMCNsWRu5EKrNvpkNPTxGt7ys2NGXQSg4z7pqcRYzmEtLaQiTmovwtxpicB+zjBZUWoxce3K06CEdrGAbS5QAc71AxXnSwOGwbi2JtT25O8xts2NsaAxOXdw7uSmE1VRYxNz6mpF2B/fVc/oQtGs5hu3yQYyt29/7yYzNTb8aF/5md7XDbfVrJbz7O1PFS5wQi89j9u7gn5RnvSAQtVSPAFEwxJeXV0+R4BZ0byqmU0cD5yO8CacLHLh/+4vpqi4OOhx7uiKJf4nVEnVWSxv5V+DbePl2lMa/2ne8BHeaNfFtfV+ZuDI9lCqKuvCIBbdYpyk8jJjiJipN8ef4ljnGtNAK8RT3Ii30xsBT9kYqRky7einay4Qrn23F3KHqqSKvI/1OXEDh3I11WgikdIGCFZJ+GcCY3pHdRwG8ISDNPc+wZ+5l3dR7n8Yk/m+6146wHG1rle9FGp2PebbnqdT0d/xV/z6gzDx5SgV5K3rCFBWFfYYt9usTYFd3+mt2yIYL42UcPLVfd0hoBInzQaw17X2jg4wO5RX+kvFlD88kT4C4DsmzbjdayYMNKkjAr+JYlhMf
+    type: AgCiTGkd+0JE8KKPtxC5vRP5yDIQgB0GFe+hs1+N93AprRAHxPdEN3/j8ilOkPTk9zdbptIBJTRiEofvyZRMDpaKUAeGIVvu9Nuk+sFRqbdCH0GNxxdePt8qoe6oJBkjeyWxtTmAc6hBiU8lgZGundoGy8QQZKQ7Fz6NbArGDnZ7FAqrsL2ZomZz0aKNzbqsBFv3lO5SjcpgmuXd6lFE5dOf+FzaWpc1RBTfV+IgveCcGDKTpvYWOtDRWIxRQEInPOcVoqyU+mBAlRjwHucF5/XPfw0+zXLxjVgLhQ6wzUoqCmuC2mGO2J1SAK9eIEloOge3YVMo+YXJRlOCvAOX+6oMNAQLYeRNu9BgvK7vmZv74u1ku2BjML46hkOCj5TRDDo1KZtT2z548sNoKmIvz4vIV26IiyLSoaMrZr7v/Vi3xk+8CKryaDPp5ytDx0l/G5+gYBYtQYgePGnKo5hSzNLmQE0t3fUkr4nbOetdPeUABGnvarasjVb1HCYYdRNCnPgDOmMkxi2hw9Hj7YonXzMds1/npuDPSOOW5nexz6zTcBib2rLWZgldUzz7udL/p3pcCsS4jPBxuLIBfDDSKjF8frQ13ZvkLdJFxqr0bDknjbbDyAxfLmCucoBlRJ8Bk8xP89jtbKUk1aI0FqVHJkm/ma7emqn9KJsTiGdcNX4wMPSElIcDZeJROwEp7hPP5+C49TwW
+    url: AgCTVTsSa64JFT0RJJGzzOETvm34DZlccgPSt4Gx8ojZEzsOKTVHPYzFLx3FTy60cu/teyYZyrUWRVKyPATS93EbHnY+NSeY5lqwEjMSU9+s8BSh5kuGFQFaRSyhhphJiY/IjlGx5cSbH12P8KDKr5QsRUqw5dFAT/e+HP9TaB5ntbiulVe+EJTvOJDy5U70lHwtv/4hPFWyOxjFn3+076QqOk0V7c0AQnNHfC561kfs6vKcSwdWgrXoeOrID5gXvPCCrQHRrrnuobzJwLtmYQQc0eUpk+vPxboNqtKN4olB7TWUXug4uhkWVy35xwHF9Wn8quVHCTTfAdey8bVE5GLW6R4pF2/qr+yl2FeL8XbgCOp42p4eDAL9D45Ziv/HjyWlF37lrfHeaRRMcvBsQXyXqeeXOvSJ9MtqELmIHu+zX55SiJXIWLG3IgT9EvFXBvrU7jW6VKnZwO/QFkfgd5IVwSnKUgiPrcfpqvP/Um5dXYaG/az9r3q3e5zJsugdURmDRm5UEzAwMk4XXS+A1/8cPbdcWVQ3ako8JhOmQDrqjQugcZpCLT/V/2/XWC+aGKrOXxVbXRbo7BhP38UkHWM2z46yPCOFQLWwz2I7YFUkDrXqzR+z7g9HcGtmf0ikiOVuE8D2UCzPxv2WRF/0ZSFoohlJHg+C9//ehAzO4THgCRZksMNAaIsJFg/++UOSqTysPIPOByShcX4NrY0Io0A3ahFliK5UT1xYA9U0I4xxWxGruKaPwG0NnMru5PA=
+    username: AgChBizrcCAU9g++QD39mTW5qc06W/gqiUdovUh1o/k+CzpzbpzdYVMYSs5oblp5/bv6ouwOcgyo3/AKK2psD4ryuDrr5zSTR7kLQBQ7ofim2Mo2Bo/VBk4hhZ7riLObzrSUqW03nHzqqttvb4aBAjsOSRrUlwTmjB+VbsMB00gt8HVPmdemRPRYjqB37ebalAq8yH8VduNxck2xyDYIMRl6mtgyUJ4+h/zpkMx4TQSj7hj66cUuxB579vwhI2vNCJx8KTU2qhYKax+6jM6vNfjVIyaeHc95D7/3VswItX/U3eb7zzDbMvITfLloM8XCuTO84L5zbHlz8IyccK4QuutcKAIHeBG9IdHwYVH1r+8Q2qGhzy2CNzTGk8aP4vGavzhnuvgjcp/h4mpJGGgtzlIX7tBVXG8Ny892KOG4F3MEzYpmjUx3P1g4zPQS/g+OvBOuzEgD3suVg6LmXuIP0g1DZN7b9D56K81YtjpjAK6d+8giXVnXOQJVeRwECXOrNxjgxxT/tnr4IEOTyiJJZi4RJRq3gK9iDaIb8HncowNqN3WsHkBK9plFRMR8d/R2l/MnOw7trOpJJCH8NqzrtrkIh1nmvw6lTGLN/v21nW0nSgH2HVOfhjI793wj5pMiC/rnmNlk9AP7ZLCZebu1hVDUMkjU6i32IO0qvPSII09LSaJ7YlPeMr8JJ3w3N+9VR+7Jg+sOxFQ=
+  template:
+    metadata:
+      labels:
+        argocd.argoproj.io/secret-type: repository
+      name: repo-creds-gitea-helm-external
+      namespace: argocd

manifest/overlays/production/repo-creds-internal.enc.yaml

@@ -1,28 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:4aQ=,iv:76qiONBk3QpJ7Tz60YNpHgxebIlzMsDhS6k0rw6v8ns=,tag:auUNlBQuYen3MpBnTNR1Eg==,type:str]
-kind: ENC[AES256_GCM,data:ormNIbHH,iv:4JnS6tLJKeAecL2rbX9umKpEGvcsn411+sO8/wtCakc=,tag:adFmPv6raMnWaVdikPjC0Q==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:yolAoLPQ3kK+iVyLFxzipmy+A+xHig==,iv:yI6O2s1jTzaSKnkKTEt7EVLzAmfIjd/ekvcpdz0NRTk=,tag:dUt+A5DGoSf5z76wJTV46A==,type:str]
-    namespace: ENC[AES256_GCM,data:bcPmoGEm,iv:Zx50hY7eG4jD3aYzTiUyEunAd0tVILlmJ0Hf0IaBYO4=,tag:5EUNdJE1l0FmpHO2w/bJlw==,type:str]
-    labels:
-        argocd.argoproj.io/secret-type: ENC[AES256_GCM,data:/QstfuDU9t3Ixg==,iv:vk7XQ/KQeMYL0QnWhu2a5PikU80hPRG1BqS4CBUigCs=,tag:GMDiftPBtJOa1ZrnEyJixA==,type:str]
-type: ENC[AES256_GCM,data:HEnT/QcZ,iv:miDP2Xk+g65eeZ8pKSFFXILSDcJmer87Oj8jOLZxeE8=,tag:Z9DhDdoxQL3rIZYdvvw72g==,type:str]
-stringData:
-    url: ENC[AES256_GCM,data:c7LN77QqOmMKGqJWRXL3u0jgGIaGxn3cSUIPETI8TUnzR3s9,iv:d+hiyvEq+DI5nGryHeKYKd/4H5rngcGg69UPY+w4Qms=,tag:1n22xhONic3Rzmks2H+sJw==,type:str]
-    type: ENC[AES256_GCM,data:59g7,iv:n3g1uxZSUmxRTuDB2vz07vhZlOCag7MUqywwHi4mhOw=,tag:qZjthGZ+oxuEknHw0zDgfg==,type:str]
-    username: ENC[AES256_GCM,data:CnszfxeQ,iv:8lUSmnZitX8TKKAn9CBUocGZJqRsa3cUknywk96u/Tg=,tag:XTqipJPG5e3f/yeYotHc7Q==,type:str]
-    password: ENC[AES256_GCM,data:BBxrsEYlTGtgQKxrixLrMg2GdOOdUzKdF+it2A9ryrEOPjDN2cLzXQ==,iv:nvls/EJ+P67AlyNvVs2w/1b2h3NcKGJQHf6/0AakZjU=,tag:X9abzAzbUJLcgdSWwmlCjA==,type:str]
-sops:
-    age:
-        - recipient: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjdXVCUnFVL1c1bzVaYXVh
-            SjVlb0t1OE5zc2Fpc3lnQXZYSGkzWXl5MmtRCmUvVGNsSWcyd0pIVmMyNHFTaERj
-            ZEp1T2U3OURNL2FiOGlyMlBVdU1jaGMKLS0tIHpDSThaaDI2anl3UXRZU0VnZ2dj
-            cDlzZ0I5Q2Z5R2dSZnBUZXFaRndjY28KGEMm55rzNJcUm0/F39f6zg82WUEBZyY4
-            7Ckmw+ZzrN0tDg8mTvbRpPdubZUSKqPko6LPpx7LK178uAuVBsARkA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-19T22:38:11Z"
-    mac: ENC[AES256_GCM,data:d9ZJON0ZhuU/Ols5YYYvRk/fHuzHG3p/JEeOB1jTA8E97sp8dQAHpd6dkBU7YMwKdhYnYkcpHIh1tHn8VHu9SbDtCH5yqTXzQk2cE+b9YIrDkNMLstkgKdHUv3kZXOLq3xlH9STGXcX43/4jFG+nwUlCMgmxhLVQPIv4/yWooME=,iv:f/NqJL+sdACShLdstQEAfa5IwMKmN8KEVQSqTCi+5LI=,tag:iExFIJMOBLNoubp9HTsPjg==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.12.2

manifest/overlays/production/repo-creds-internal.sealed.secret.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: repo-creds-gitea-olb42
+  namespace: argocd
+spec:
+  encryptedData:
+    password: AgAMeg7zlP8816g4mBzjE5Cz58f246hT4lzjbRiJj2uXsVw3wy30d9trbp4+xbdf3c6DTwY7087qCPc279BWcqvpGEdFeibzkTHZgjUkOt5WHvlzeDlJauNA+MF2YaYYa06kaKpRmsgKI7qulVfz/AHlIdpykQq4UaBY9NKSeKqI3S/jDpgqTY8lyM+K0cOTk6oQU+LzPlJ/9HTuySKPnKaINRuyFnqcmJRLZx+znPAWr0W8CJvJVr/aJtl5GfmRCbYipaBUL+1777LW5R7PgCpwBUc7ubwMofftSHPzE7BqB/ZNS5XykSM1ub2O1jCO5ZgZVuygWyrii6JXuoZLqOuQ6LCJ6CFSfoBknU/BNy0FRtfLRRZe73dIhgP1JFo/NecqACjXSr4HJs5OZA2eoDDpv1oow8o3kTKvPGpUc6yC3dqHyKSHXK4oEgaA++ec7ggVL8qmS1cjLnkmB/uoB0X+wgtT7VLUPLIw9kmtuHb7CeWVnW9WCIJwDZKpZvHlMBZK1FzTrU3P0Wcy/NvbfICuGQF+Ol3r3oiuQChaevL18NsygIuJeHylxJERx9O+TXA3udhP2ErsaPHoM0Q/KDg97x2dPIHK8fVx/yUNVaSz2V0PWRt2UIqHZnc0QCx6/r6b8xdAIFlGuOEgqj7u89eCUsx6XEF+6Rmaqe48OxTq+Fw/w/My58rwZhaHu8eyZ7AYKMAmXAIhhM8saEPGzmfAeSLp8koJ6qhIWxcHDAXqxFepi2ajiHiM
+    type: AgCU+nqQDNNtXRfDrU0f+BQgvr57estt1pQIIGVoyw95fQq7BIYWf97smvKmLni3A6wGbFbPeD40mAq1Qllpqt7sNps3M+FB0fYg607AFAIgJthIifkc0SqhQvx+JuORJRi1eTPGKGAcZRxa8hrXacsWqDgO1gEd8mMzt7Cwe1sj6TtfzQzoapVgoJqNYikeR5QqwZKrTMCzDdMrHgkbFcJHfKjugT2Lld0CgeALyMfyb0zqGNy/CurC0gKbikEI6A1LlwnILMHbdGUUGQY7hWfePWb6HLyneQrswV0n/bbBXUwWgEaHyMcPxlH1LCxlawYgL77aoXr/dz4NDCVAeLchGxkjRjA+TYA3dmWAl3mVmnMO4E0l5eH1bLYl5cvYcqtmEqfJ/FZq2DAZfd+LbDC9V0/f9pI6QbfO1FOQCl5iV0Q4vYONH9cS4E+WNGJAlwMoafveGc99trxw5kANytar+rW21o78QUTkGTFinVRtLtWCyqNtmNV239n0Q3Ml3skcwV0b2YAUhGbtnWjbdr++GoOgXg0pWPwSbwGkPC8ymdCSTI6MYDPrTHtwtCPbrIXz1RXu3tT0Ck8M2nMFoskHChDbiKdMyFqQJkEV9w7DpozN6bkdpIcfOd8BAMjKohVrElfXbFxuJxWUOTbaIASC02sM5r8zDYd2MCW0sVEB1wvdiw/GhbIghETVxTGW/ieGJyg=
+    url: AgBihFAAbwqnJhQF0zS5l09V1L8m0nahi6iZR713rZPIP5naSfVXmY2UV6XueHg0Ma7HnlmAQHEkTCvB7/i1mYnv57pyaz0vXdHomNnimCpkcqws+qr/xZr5vr5J2bmkhhbBwxMYFtn0FZe3MiWi3dGZtwbcrV/YBOhLYsuACOJoHM58CGNpcSQOyinjSBkXnD+JXnbPOQ+GvV1GsgoeCkQV9/GSS0vSVJYLZoFP4RIRckgjE0sr++tDpzAhX+obX1WhAIs3TsaRoHyd2nbXL6WlHOZxxwqZz5acJf5H3JKvUt+3o5lH0lNL7sR02Z9BcbXX0ST4VrAi5rSb2c+ywPgO6Q0qEJblXsoBOpNnoffNfypbQf+C1IxjtT1tAjtsama/XdVVHkDTkCvmjwf6QwAaTCUXBoDPrwlKSrdSJhxM7gGmBwmFbfX9w04eh3rkLsvvIexkWdFIw+qJwaY/Itb3KEfiY6tSNu6yqAO8zWZfJ0xlUL9yWz9h613KQNxli/k71FHCLiHOyqOJp6ptS2HyHEADAiBm8/jH2UB/NyxduLMMnhWdXSeECtbRKxfAWMGUZZKYdoPcFqhTEZjiJBDKwtPjbZejt6KLM/eZgfuA9UnH3M+0wWZeMYfZAlXGhQgK2vKZk2q0MPYIjevjV3jjYoBKJ8269f58+ZFFrNwUCSSGvva70eQWJ3qlv+4nIh70lP3E8bqZ/xoXg8pzG0SsBv1axVhtTBTtAK3+XZV7kmJZJXk=
+    username: AgBL2P2y2phxb4bgdk2X9i2pLoiY4gZHniI0msCAmYsx1zm9zejjRZHhnl2H4d33TYGGrggezY31u6V9yEpOab4Kjibo4dxaXqFUHiI61kiowQrCllvaH6VEPh2SpvWoeIP722zWl967QCGzIAJw+c9/+xRYX0nnGyLGOuVWmL2sx5THpLYNFRoYdeyWY83iiOmxdNFUlWoogbKOidQ3CdM9WI7SpbldLcqORFnAgV0B7qEtrafEghNMaMx94nQz2Orf/Yit8JxGtF4cYI+3hu0hjjd6BRzI4whrD6hg3preBhUDh6TARK58WKLjZrdp2NvWvTeCIZxIceXivOGIRXOWKWTO8Qim+3rnkmIuUodCyZ5irOA3O8NZsjUEC3FasdFAdMku+nwfOHNvLMB+HYtbUlUTAs7Clz8ZI3f50LLvHS8KbzL8bWiGSRWErD/U46KwvCy3i8oNeK+cbidVNPHWJXPW7+s79pgEeZrAnf8srrD+vXP4uFi41aIOIPIpEqNgwxYxgB74mui/ZlOS6veisO58oJNA8pWQqZkM9vEehB0WTSc2ZjAgq7avoIIePtdhurj5HT56073thZQ8AmvxZYD96CR/7Zy4u/xPHQM3dUDaRJahgrXbimTieJufaC4MrVw5Cqs0LMhAlYimyjzoUPjDeKOUuimTcYGgGBFZAgqZOWoI3QsgKTfaMKukHtI4OJ5e83k=
+  template:
+    metadata:
+      labels:
+        argocd.argoproj.io/secret-type: repo-creds
+      name: repo-creds-gitea-olb42
+      namespace: argocd
+    type: Opaque

manifest/overlays/production/repo-server-patch.yaml

@@ -3,12 +3,17 @@ kind: Deployment
 metadata:
   name: argocd-repo-server
   namespace: argocd
+  annotations:
+    glance/parent: argocd
 spec:
   template:
+    metadata:
+      annotations:
+        glance/parent: argocd
     spec:
       initContainers:
         - name: copyutil
-          image: quay.io/argoproj/argocd:v3.3.6
+          image: quay.io/argoproj/argocd:v3.5.1
           command:
             - sh
             - -c
@@ -26,36 +31,69 @@ spec:
           volumeMounts:
             - mountPath: /var/run/argocd
               name: var-files
+        - name: ghcr-auth
+          image: quay.io/argoproj/argocd:v3.5.1
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            seccompProfile:
+              type: RuntimeDefault
+          env:
+            - name: HELM_CONFIG_HOME
+              value: /helm-working-dir
+            - name: HELM_REGISTRY_CONFIG
+              value: /helm-working-dir/config.json
+            - name: GITEA_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-basic-authregcred
+                  key: username
+            - name: GITEA_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-basic-authregcred
+                  key: password
+          volumeMounts:
+            - name: registry-auth-dir
+              mountPath: /helm-working-dir
+          command:
+            - /bin/bash
+            - -exc
+            - 'echo -n $GITEA_PASSWORD | helm registry login git.olb42.com --username $GITEA_USERNAME --password-stdin -'
       containers:
-        - name: ksops
-          image: viaductoss/ksops:v4.3.2
+        - name: argocd-lovely-plugin
+          image: ghcr.io/crumbhole/lovely:1.2.4
           command:
             - /var/run/argocd/argocd-cmp-server
-          env:
-            - name: SOPS_AGE_KEY_FILE
-              value: /age/key.txt
           securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
             runAsNonRoot: true
             runAsUser: 999
+            seccompProfile:
+              type: RuntimeDefault
           volumeMounts:
             - mountPath: /var/run/argocd
               name: var-files
             - mountPath: /home/argocd/cmp-server/plugins
               name: plugins
-            - mountPath: /home/argocd/cmp-server/config/plugin.yaml
-              name: argocd-cmp-cm
-              subPath: ksops.yaml
-            - mountPath: /age
-              name: age-key
-              readOnly: true
             - mountPath: /tmp
-              name: cmp-tmp
+              name: lovely-tmp
+        - name: argocd-repo-server
+          env:
+            - name: HELM_REGISTRY_CONFIG
+              value: /helm-working-dir/config.json
+          volumeMounts:
+            - name: registry-auth-dir
+              mountPath: /helm-working-dir
       volumes:
-        - name: argocd-cmp-cm
-          configMap:
-            name: argocd-cmp-cm
-        - name: age-key
-          secret:
-            secretName: argocd-age-key
-        - name: cmp-tmp
+        - name: lovely-tmp
+          emptyDir: {}
+        - name: registry-auth-dir
           emptyDir: {}

manifest/overlays/production/scm-creds-internal.sealed.secret.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: scm-creds-gitea-olb42
+  namespace: argocd
+spec:
+  encryptedData:
+    password: AgDQk0B6HgE9WtVvAw2xSRP3CR7+ElFk4CFsj+/mDipfNGqL3bonp9DjwFTTCVZzb/E0oTz4urgotzBSsoddv3f+28Elzy8SVxZhSd/HoNxSwz6Zqo6GVtwPZAVAP41cV9gUVDm1BBR1f3X/MS99fWBSHv9UP5QbrxFv7pRNOrPjoWti0Cd7V+ea2BN7ObpM5trZsTelHY1teSWehtJdySdIMBQdfsAsjemVs/CMwENxxEeoTxahO2mGuEQ+/5GgK5BhEVbzq2sdo/mk7bYXyjzZ1xwy2mXnha96F5DZ4iJVkzRNnY+4xnKKGCj/pdgNimRiABq3y3Pp4g6jY4NK5DtH1zlN2oC0bB0zKqR0Cu0hjl5gIwipzb9j+UAgU8DvPibDnch1iKzpSkeXo9kmZDzVHLzvKY3ND8tqY8vu6kOfxSHBnT4kfCoEC4Oo1DaUritB6U90mVvNUrgonVGr7TlOx+pop7kzJKTKXghb5Gjuqcw87jokk2CArjmy2QWEmStPJP2Xlox9h5AN/p0hgKP73Zx8wf5f1ATJ6hAWcP6iLyCm5PaCx273qAWUEYYN847wrdxM0hx4g9QcT+0vNZNdplHxWLKktvfQ7ii6MifPQ5WwnGodcG1QasXU3vpOCg2xAIrmxfseUamHyPNwuHen9qKCJagRFdBjn+x5G4aH3zQqtzMmz36BnFBzg5M3tZ5KQO3qc2gs9CVacUr6wiNPULA3Zlk5S8JpE0SCnti6Y7eWP7HIGlIp
+    type: AgAJ/RrPr0uedVU+d36BQKrLujaa24AWmWf8NIM6NiGsxkLVwGp0GOM5tucfloNd7A7kKlbAYXnPyYlOzlqQ7KWT2DSM0NenZaKkZvad7ZsFyE3t4FWxYEnUaGJhhE7AR5NLwbhRd3i3Ux71LfnGbxAmN0QRnH1NtrUigHiAP5VvOcd53kYe2JLd52P8Cj4S3hdB2mL3ngkCnca3UKrn530I5D+svpfGNMyOvCaG0UGdVLjAHRUVna6Y6Aw4VumoVuU/GiFukiU2sB6rzxCCayATJNASs4rBlOMDVy3tFtZIoqV9MI3b7antTta6zRBlB2/quGwS5fmVkNBpgxezIohILScu7t3gX6mKeolU8Y3Y864U0YJjlycUfsPruIRr9APEAG+bvkffnbaZTjexx06uhYxXRWC1s1NoBsCSPqFBbS3b489fS4saBKBgLzZL+motgZEpdI4noCa8dqo5JMo9NTqer7+HZIoZlZNum0o0Aerl2k0xKyV6KQewCHeinlO2RGG3odHHo9KdeibxbtsvZ/+/hYeZ1XiCNsWDE5AxQBRhDzrh7k/necoRfuChmk5X05JtxomJhDHjXCQ7lWqjAVtNxqitLneBvDoV163r77O6QJv0J6/1wbaf/c3p8cOXhv41OJb7jNU1PGfiawYbofCyVsfw42MciPCaXNCBL1q1qc0j+Y4maQFTtDVFEc2jLOU=
+    url: AgCNeLbF5wJdcKJwty+DXxM4IfupsKpr/9+s5q0+S0909be15vtMH8xZMe2CB0QYN6ZRGTIVGrZDWRWmTGqakeuEZ1IHjYjxIvMpenx+ahYwVNR9uTWsGLwEEbR3D3gFOH2rHkiIY2HA6+Trw+97r7MvXsNO60Tk8G+/NF9TDQ302O9BF+5+/ol1UgUNDzKXK84YwN0Jbd0fGUcNuCRlkvtGFpZKnLMTJmMLV1PDyNK4hyFZlNXaKZp19z0VbbgvIokiyrv/kLQD41R+/EvtjePAuPRhtoqe501unktNkEakxPM2G/XdPLExeWJG/7MZRYMmsw2XV9GTTZJffPLDyNDIeCYJRIRpzxYNIeMdob1Lld6F47osoD27NAzXLgkxs/A/OAI57NxacV6sXE+wTWVyPztsIB94cOPV3yfjsms3OC/gFG6+g3e5iOWjfzWTEClZuyamGW3PyA4W4Ewkrr+BKd9FtYH9YOvT5tGNZvmYpr/kZUxXZal4qQ0kAkoH4DDFkKnDJh1tjqb2pllGBAO/2SEvUavCeQ/UTs3HHtHGoUl3RU6oTys7aAILG0kNIizsqUgftyTuFbmrWSgaj/xOmRsXyzzNPqdqB7EfBX+oU48JZQaGOTqgPc/RR2Jj4UGr9/UzApdoj1zK4+K9qQUF+Ynv+lakFml2FIj2diP98+XoEdli9CFozlFFZz+EwzwiRS+dUFAsRZapU5aSgVO5Cr322vWXs8unIY7HW5+yNfz0R5w=
+    username: AgCYPD1WdVe8IyfKlo+K2d18FE0memD2Ty7zLffZaEw0RtHfh2cKqvo7So2ZQagLRf6+SiXjtvc2QkR2aphoKxuEq6qNGqx8kpVWaN81xYPt6SZrVQfT65i1K8TjYkPfEno49iCp0ShVF2n8+1acenYXtaya+4TTUsE+FOwuZ+eJwe2XCRB+NbRYOy74b9WTROGYl+Zswm6D0xyAUZtvGs4zF1feCyhnt4dfeKOflSQtij9/D4sR5DYJ+G5coBQ4tkgGbedGrcWgh/KH0q1Fe+FzxwxWm4CcSHJ+ECdaFOgOKM323+UqN3WV1I0rAMGm9bwwP8awr0ZPaI4N5HYnuk8LL7AOiJkO/AwpAeT1z7z2RWKd59xKinqj3Ddqz2hBLDmcBs7FdRsjo6oQJfNggQqjxcz28jQYaKNr+s60lSI/5bTcFVtcGWLh2BGsrUJbIDw7FLF2qEr2DEfw84z7xSQJJiwLa5QQO/XSLkhQkJTn7vtn7MNA3WqkjNM35lgpOEnEmyiBilGonrlq/y/jlT4wbGtlvr3PFx0pG5u7YHSWe+x7BR3Fm/VbPQwWe/0r9j6RDDdbzGl15B6ISPvrgQTGDWrLpRMibWFEIKqmKrKXjs4rx8oCYoWyV4FvmBSTr8UsHQ7z1kA3ZE6kz8t1NK3kJw55NtlTFglG2IwXCSsCvd4UpneLSV7XWZ/Y9kJfcCByepzHoQs=
+  template:
+    metadata:
+      labels:
+        argocd.argoproj.io/secret-type: scm-creds
+      name: scm-creds-gitea-olb42
+      namespace: argocd
+    type: Opaque