Update argocd via terraform

apply.sh

@@ -244,12 +244,8 @@ k apply -f wireguard.yaml -n wireguard
 
 
 # argo
-
-k create namespace argocd
-
-kubectl -n argocd create secret generic redis-credentials --from-literal=redis-password="xxx"
-
- helm upgrade --install argocd -n argocd -f argocd-values.yaml argo/argo-cd
+# ArgoCD is now fully managed via terraform/argocd.tf (helm_release.argocd).
+# Do not apply argocd-values.yaml manually anymore - it has been retired.
 
 
 # k8s github docker image pull

argocd-values.yaml

@@ -1,78 +0,0 @@
-redis-ha:
-  enabled: false
-
-externalRedis:
-  # existingSecret: redis-credentials
-  host: 192.168.1.2
-
-controller:
-  enableStatefulSet: true
-  metrics:
-    enabled: true
-    serviceMonitor:
-      enabled: true
-
-configs:
-  cm:
-    # -- Timeout to discover if a new manifests version got published to the repository
-    timeout.reconciliation: 60s
-
-server:
-  replicas: 1
-  extraArgs:
-    - --insecure
-  ingress:
-    enabled: true
-    annotations:
-      kubernetes.io/ingress.class: "nginx"
-      kubernetes.io/tls-acme: "true"
-      cert-manager.io/cluster-issuer: "letsencrypt-prod"
-      nginx.ingress.kubernetes.io/proxy-body-size: 102400m
-      nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
-      nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=https://$host$escaped_request_uri"
-    hostname: "argo.junv.cc"
-    tls:
-    - hosts:
-      - argo.junv.cc
-      secretName: argocd-tls
-  metrics:
-    enabled: false
-    serviceMonitor:
-      enabled: true
-  env:
-    - name: ARGOCD_API_SERVER_REPLICAS
-      value: '2'
-
-repoServer:
-  replicas: 1
-  metrics:
-    enabled: false
-    serviceMonitor:
-      enabled: true
-
-applicationSet:
-  metrics:
-    enabled: false
-    serviceMonitor:
-      enabled: true
-
-redis:
-  enabled: false
-
-global:
-  logging:
-    level: "warn"
-
-ingress:
-  enabled: true
-  path: /
-  hosts:
-    - argo.junv.cc
-  annotations:
-    kubernetes.io/ingress.class: nginx
-    kubernetes.io/tls-acme: "true"
-  labels: {}
-  tls:
-    - secretName: argocc-tls
-      hosts:
-        - argo.junv.cc

k8s/README.md

@@ -9,7 +9,7 @@ This directory contains Kubernetes configuration files and documentation that ar
 - **`ai-bot-serviceaccount.yaml`** - ServiceAccount, Secret, Role, and RoleBinding for ai-bot
   - Creates `ai-bot` service account in `ai` namespace
   - Grants full access to `ai` namespace only
-  
+
 - **`ai-bot-clusterrole.yaml`** - ClusterRole and ClusterRoleBinding for read-only access
   - Grants read-only access (get, list, watch) to all namespaces
   - Combined with the Role above, ai-bot has:
@@ -71,8 +71,7 @@ scp AI-BOT-USAGE.md 192.168.1.10:~/
 ## 📋 Related
 
 - **AI Namespace Manifests**: `/ai/` directory (monitored by ArgoCD)
-- **Terraform Configuration**: `/terraform/` directory
-- **ArgoCD Values**: `/argocd-values.yaml`
+- **Terraform Configuration**: `/terraform/` directory (includes ArgoCD's Helm values in `terraform/argocd.tf`)
 
 ## 🔄 Setup History
 
@@ -84,6 +83,6 @@ scp AI-BOT-USAGE.md 192.168.1.10:~/
 
 ---
 
-**Maintainer**: junv (wahyd4)  
-**Cluster**: K3s on 192.168.1.2  
+**Maintainer**: junv (wahyd4)
+**Cluster**: K3s on 192.168.1.2
 **Management Host**: 192.168.1.10 (ai-bot user)

terraform/argocd.tf

@@ -136,84 +136,91 @@ resource "null_resource" "wait_for_cert_manager_crds" {
 # We've already created it manually with the setup_argocd.sh script
 
 # Install ArgoCD
+# This is the single source of truth for the ArgoCD deployment (previously
+# also managed ad-hoc via `helm upgrade -f argocd-values.yaml`, which has been
+# retired in favor of Terraform).
 resource "helm_release" "argocd" {
   name       = "argocd"
   repository = "https://argoproj.github.io/argo-helm"
   chart      = "argo-cd"
-  version    = "9.5.14"
+  version    = "10.1.1"
   namespace  = kubernetes_namespace.argocd.metadata[0].name
 
-  set {
-    name  = "server.service.type"
-    value = "ClusterIP"
-  }
+  # Homelab: single-node K3s, no HA needed.
+  values = [<<-EOT
+    # Dex/notifications disabled - neither SSO federation nor notification
+    # channels are configured, so avoid running two extra pods for nothing.
+    dex:
+      enabled: false
 
-  set {
-    name  = "server.ingress.enabled"
-    value = "true"
-  }
+    notifications:
+      enabled: false
 
-  set {
-    name  = "server.ingress.hosts[0]"
-    value = "argo.junv.cc"
-  }
+    redis-ha:
+      enabled: false
 
-  set {
-    name  = "server.ingress.ingressClassName"
-    value = "nginx"
-  }
+    redis:
+      enabled: false
 
-  set {
-    name  = "server.ingress.annotations.cert-manager\\.io/cluster-issuer"
-    value = "letsencrypt-prod"
-  }
+    # Use the Redis instance running on the K3s host itself instead of the
+    # chart's bundled redis.
+    # NOTE: this Redis has no auth (`requirepass` empty) and listens on
+    # 0.0.0.0:6379 - reachable by anything on 192.168.1.0/24.
+    externalRedis:
+      host: 192.168.1.2
+      port: 6379
 
-  set {
-    name  = "server.ingress.tls[0].hosts[0]"
-    value = "argo.junv.cc"
-  }
+    controller:
+      metrics:
+        enabled: true
+        serviceMonitor:
+          enabled: true
 
-  set {
-    name  = "server.ingress.tls[0].secretName"
-    value = "argocd-server-tls"
-  }
+    configs:
+      cm:
+        timeout.reconciliation: 60s
 
-  set {
-    name  = "server.extraArgs[0]"
-    value = "--insecure"
-  }
+    server:
+      replicas: 1
+      # Ingress terminates TLS, so the server can listen over plain HTTP.
+      extraArgs:
+        - --insecure
+      ingress:
+        enabled: true
+        annotations:
+          kubernetes.io/ingress.class: "nginx"
+          kubernetes.io/tls-acme: "true"
+          cert-manager.io/cluster-issuer: "letsencrypt-prod"
+          nginx.ingress.kubernetes.io/proxy-body-size: 102400m
+          nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
+          nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=https://$host$escaped_request_uri"
+        hostname: "argo.junv.cc"
+        # `tls` is a boolean for this chart (not a list) - the actual secret
+        # is always named `argocd-server-tls`.
+        tls: true
+      metrics:
+        enabled: true
+        serviceMonitor:
+          enabled: true
 
-  set {
-    name  = "server.insecure"
-    value = "true"
-  }
+    repoServer:
+      replicas: 1
+      metrics:
+        enabled: true
+        serviceMonitor:
+          enabled: true
 
-  # Disable components not needed for single-node homelab
-  set {
-    name  = "dex.enabled"
-    value = "false"
-  }
+    applicationSet:
+      metrics:
+        enabled: true
+        serviceMonitor:
+          enabled: true
 
-  set {
-    name  = "notifications.enabled"
-    value = "false"
-  }
-
-  # Use external Redis instead of the built-in one
-  set {
-    name  = "redis.enabled"
-    value = "false"
-  }
-
-  set {
-    name  = "externalRedis.host"
-    value = "192.168.1.2"
-  }
-
-  set {
-    name  = "externalRedis.port"
-    value = "6379"
-  }
+    global:
+      logging:
+        level: "warn"
+  EOT
+  ]
 
   depends_on = [
     helm_release.cert_manager,