Argo CD — noble (bootstrap)
Prerequisites: cluster Ready, Traefik + cert-manager; DNS argo.apps.noble.lab.pcenicni.dev → Traefik 192.168.50.211 (see values.yaml).
1. Install
helm repo add argo https://argoproj.github.io/argo-helm
helm repo update
helm upgrade --install argocd argo/argo-cd \
--namespace argocd \
--create-namespace \
--version 9.4.17 \
-f clusters/noble/bootstrap/argocd/values.yaml \
--wait
RBAC: values.yaml sets policy.default: role:readonly and g, admin, role:admin so the local admin user keeps full access while future OIDC users default to read-only until you add policy.csv mappings.
2. UI / CLI address
HTTPS: https://argo.apps.noble.lab.pcenicni.dev (Ingress via Traefik; cert from values.yaml).
kubectl get ingress -n argocd
Log in as admin; initial password:
kubectl -n argocd get secret argocd-initial-admin-secret \
-o jsonpath='{.data.password}' | base64 -d
echo
Change the password in the UI or via argocd account update-password.
3. Register this repo (if private)
Use Settings → Repositories in the UI, or argocd repo add / a Secret of type repository.
4. App-of-apps (optional GitOps only)
Bootstrap platform workloads (CNI, ingress, cert-manager, Kyverno, observability, Vault, etc.) are installed by
ansible/playbooks/noble.yml — not by Argo. apps/kustomization.yaml is empty by default.
-
Edit
root-application.yaml: setrepoURLandtargetRevisionto this repository. Theresources-finalizer.argocd.argoproj.io/backgroundfinalizer uses Argo’s path-qualified form sokubectl applydoes not warn about finalizer names. -
When you want Argo to manage specific apps, add
Applicationmanifests underapps/(seeapps/README.md). -
Apply the root:
kubectl apply -f clusters/noble/bootstrap/argocd/root-application.yaml
If you migrated from GitOps-managed noble-platform / noble-kyverno, delete stale Application objects on
the cluster (see apps/README.md) then re-apply the root.
Versions
Pinned in values.yaml comments (chart 9.4.17 / Argo CD v3.3.6 at time of writing). Bump --version when upgrading.