feat(argo): Expose argocd dashboard

argocd-apps/add-ons/argocd-dashboard.yaml

@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+  name: argocd-dashboard
+  namespace: argocd
+spec:
+  destination:
+    namespace: argocd
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    path: infra/argocd-dashboard
+    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+    targetRevision: main
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

argocd-apps/add-ons/kustomization.yaml

@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - anubis-operator.yaml
+  - argocd-dashboard.yaml
   - argocd-repos.yaml
   - cert-manager.yaml
   - cnpg.yaml

bootstrap/argocd-cm-url-patch.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cm
+data:
+  url: https://argo.whyredfire.dev

bootstrap/argocd-cmd-params-cm-server-insecure-patch.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cmd-params-cm
+data:
+  server.insecure: "true"

bootstrap/argocd-server-clusterip-patch.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: argocd-server
+spec:
+  type: ClusterIP

bootstrap/argocd-server-nodeport-patch.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: argocd-server
-spec:
-  type: NodePort
-  ports:
-    - name: https
-      port: 443
-      protocol: TCP
-      targetPort: 8080
-      nodePort: 30443

bootstrap/kustomization.yaml

@@ -8,12 +8,20 @@ patches:
   - target:
       kind: Service
       name: argocd-server
-    path: argocd-server-nodeport-patch.yaml
+    path: argocd-server-clusterip-patch.yaml
   - target:
       kind: ConfigMap
       name: argocd-cm
     path: argocd-cm-application-health-patch.yaml
+  - target:
+      kind: ConfigMap
+      name: argocd-cm
+    path: argocd-cm-url-patch.yaml
   - target:
       kind: ConfigMap
       name: argocd-cmd-params-cm
     path: argocd-cmd-params-cm-server-side-diff-patch.yaml
+  - target:
+      kind: ConfigMap
+      name: argocd-cmd-params-cm
+    path: argocd-cmd-params-cm-server-insecure-patch.yaml

infra/argocd-dashboard/anubis-key-sealedsecret.yaml

@@ -0,0 +1,12 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: anubis-key
+  namespace: argocd
+spec:
+  encryptedData:
+    ED25519_PRIVATE_KEY_HEX: AgCR+UcOTNv+hAcK3jE3fb0AE5lQBuxl0Y7Yqt3Lg/Bhh89aPH2dRs0o2n/1MuCXNGOtBAXdyKtW6W3VtenD1uKsoz8da2UjO3+qvknLmrZzUqjcilmiJCS7POoECHhciCMJu1RrLkSQChjg+Kl6fZUbDSTK5GTh75yy7o1uRtXqbgXFtdVDYA8fwXLoAG4nWlSgRgGTUnTKTKooyx+ADEJOQWrFCP0zFkZJKUcGc60d6+5PyYGODDNjh1qed30O7xWyZcCVVUzeSkH5QCpBvALRzKLGBRjNTHAS4IGVelemPqsN5ti4w6fYGtkqi4OPuAuaC47kdEnLUvZeDB+Qxnwx6Qe7MEI4u8H2N6mP8jMH9MjQv4gzCTtPy90Vqikf7hJ0KFsI5CGXONbQkkyM1B3MNbyqkgmtZJchVbmeN9MZhZOS7JYUuexYosdiqRvyIOAWr1/rSN9LzwesXNAPojq8IZPDjIPcbFCBv1ROjsS/kXKawlLBMX+XEsQZUWUfTh9Cfn3N9muo4Sz+nQ11smXthSkVRaniJLIsd+MPXg/lHayP6MYWncPhj8ZZQHKwBNxsCHljh1cFsjfm/IrIDmre6eaREnsBrxh7QKtsoiWWclqgF4ziA4BVWHwkfpb1LjIQNDIkD+i66ijOmwpQoiCD8tWRKrvcGWy6bTDPMO0ErA5QVzDx8YMFmSC5Ii0iSWIR2ci+qlKgUHFedVnp2kOw4FyOxWsDnfJDBmwyPvXrfrbDcvSfKMTLn6VohWC4Zais5bIuhD0uAmCdfJzyRe+H
+  template:
+    metadata:
+      name: anubis-key
+      namespace: argocd

infra/argocd-dashboard/anubis-proxy.yaml

@@ -0,0 +1,44 @@
+apiVersion: anubis.techaro.dev/v1alpha1
+kind: AnubisProxy
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: anubis
+  namespace: argocd
+spec:
+  anubis:
+    envExtra:
+      - name: DIFFICULTY
+        value: "5"
+      - name: SERVE_ROBOTS_TXT
+        value: "true"
+      - name: COOKIE_DOMAIN
+        value: argo.whyredfire.dev
+      - name: REDIRECT_DOMAINS
+        value: argo.whyredfire.dev
+      - name: COOKIE_PARTITIONED
+        value: "true"
+      - name: COOKIE_HTTP_ONLY
+        value: "true"
+      - name: COOKIE_SAME_SITE
+        value: Lax
+      - name: DIFFICULTY_IN_JWT
+        value: "true"
+    image:
+      tag: v1.26.2
+    keys:
+      existingSecret: anubis-key
+    metrics:
+      enabled: false
+    persistence:
+      enabled: false
+    resources:
+      limits:
+        memory: 128Mi
+      requests:
+        cpu: 50m
+        memory: 64Mi
+  target:
+    service:
+      name: argocd-server
+      port: 80

infra/argocd-dashboard/httproute.yaml

@@ -0,0 +1,23 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: argocd-dashboard
+  namespace: argocd
+spec:
+  hostnames:
+    - argo.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: anubis
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

infra/argocd-dashboard/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - anubis-key-sealedsecret.yaml
+  - anubis-proxy.yaml
+  - httproute.yaml