Update Argo CD values.yaml to configure Ingress with Traefik, enable TLS with cert-manager, and set server to insecure mode. Adjust domain settings and service type to ClusterIP for improved deployment configuration.

clusters/noble/bootstrap/argocd/values.yaml

@@ -1,7 +1,9 @@
 # Argo CD — noble lab (GitOps)
 #
 # Chart: argo/argo-cd — pin version on the helm command (e.g. 9.4.17).
-# MetalLB: Argo CD UI/API uses pool IP **192.168.50.210** (Traefik stays **192.168.50.211**).
+# UI/API: **Ingress** via **Traefik** at **argo.apps.noble.lab.pcenicni.dev** (TLS: cert-manager
+# ClusterIssuer + **`server.insecure`** so TLS terminates at Traefik).
+# DNS: **`argo.apps.noble.lab.pcenicni.dev`** → Traefik LB **192.168.50.211** (same wildcard as apps).
 #
 # helm repo add argo https://argoproj.github.io/argo-helm
 # helm upgrade --install argocd argo/argo-cd -n argocd --create-namespace \
@@ -12,14 +14,28 @@
 # Optional: kubectl apply -f clusters/noble/bootstrap/argocd/root-application.yaml
 
 global:
-  domain: ""
+  domain: argo.apps.noble.lab.pcenicni.dev
 
 configs:
   params:
-    server.insecure: false
+    # TLS terminates at Traefik / cert-manager; Argo CD serves HTTP behind the Ingress.
+    server.insecure: true
 
 server:
+  certificate:
+    enabled: true
+    domain: argo.apps.noble.lab.pcenicni.dev
+    issuer:
+      group: cert-manager.io
+      kind: ClusterIssuer
+      name: letsencrypt-staging
+
+  ingress:
+    enabled: true
+    ingressClassName: traefik
+    hostname: argo.apps.noble.lab.pcenicni.dev
+    tls: true
+    annotations: {}
+
   service:
-    type: LoadBalancer
+    type: ClusterIP
-    annotations:
-      metallb.io/loadBalancerIPs: 192.168.50.210