From 5c14ae16825f2868af9f1cf0b7d68fe7efb73e77 Mon Sep 17 00:00:00 2001
From: Vegard Hagen <vegard@stonegarden.dev>
Date: Sat, 25 Oct 2025 15:41:40 +0200
Subject: [PATCH] fix(argocd): use http-route and grpc-route instead of a
 single tls-route

Also stop serving certificate from Argo CD

This fixes issues with GatewayAPI/Cilium/ALPN not playing together

Signed-off-by: Vegard Hagen <vegard@stonegarden.dev>
---
 k8s/infra/controllers/argocd/grpc-route.yaml  | 13 ++++++++++
 .../controllers/argocd/grpc-service.yaml      | 16 ++++++++++++
 k8s/infra/controllers/argocd/http-route.yaml  | 13 ++++++++++
 .../controllers/argocd/kustomization.yaml     |  4 ++-
 k8s/infra/controllers/argocd/tls-route.yaml   | 11 --------
 k8s/infra/controllers/argocd/values.yaml      | 26 +++++++++----------
 k8s/infra/network/cilium/values.yaml          |  2 +-
 7 files changed, 59 insertions(+), 26 deletions(-)
 create mode 100644 k8s/infra/controllers/argocd/grpc-route.yaml
 create mode 100644 k8s/infra/controllers/argocd/grpc-service.yaml
 create mode 100644 k8s/infra/controllers/argocd/http-route.yaml
 delete mode 100644 k8s/infra/controllers/argocd/tls-route.yaml

diff --git a/k8s/infra/controllers/argocd/grpc-route.yaml b/k8s/infra/controllers/argocd/grpc-route.yaml
new file mode 100644
index 0000000..ee332af
--- /dev/null
+++ b/k8s/infra/controllers/argocd/grpc-route.yaml
@@ -0,0 +1,13 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: GRPCRoute
+metadata:
+  name: argocd-server
+  namespace: argocd
+spec:
+  parentRefs:
+    - { name: internal, namespace: gateway }
+  hostnames: [ "argocd.stonegarden.dev" ]
+  rules:
+    - backendRefs: [ { name: argocd-server-grpc, port: 80 } ]
+      matches:
+        - headers: [ { name: Content-Type, value: application/grpc } ]
diff --git a/k8s/infra/controllers/argocd/grpc-service.yaml b/k8s/infra/controllers/argocd/grpc-service.yaml
new file mode 100644
index 0000000..7d63640
--- /dev/null
+++ b/k8s/infra/controllers/argocd/grpc-service.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: argocd-server-grpc
+  namespace: argocd
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/instance: argocd
+    app.kubernetes.io/name: argocd-server
+  ports:
+    - name: grpc
+      port: 80
+      protocol: TCP
+      appProtocol: kubernetes.io/h2c
+      targetPort: 8080
\ No newline at end of file
diff --git a/k8s/infra/controllers/argocd/http-route.yaml b/k8s/infra/controllers/argocd/http-route.yaml
new file mode 100644
index 0000000..ddc1fdc
--- /dev/null
+++ b/k8s/infra/controllers/argocd/http-route.yaml
@@ -0,0 +1,13 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: argocd-server
+  namespace: argocd
+spec:
+  parentRefs:
+    - { name: internal, namespace: gateway }
+  hostnames: [ "argocd.stonegarden.dev" ]
+  rules:
+    - backendRefs: [ { name: argocd-server, port: 80 } ]
+      matches:
+        - path: { type: PathPrefix, value: / }
diff --git a/k8s/infra/controllers/argocd/kustomization.yaml b/k8s/infra/controllers/argocd/kustomization.yaml
index 5667d7c..00ad981 100644
--- a/k8s/infra/controllers/argocd/kustomization.yaml
+++ b/k8s/infra/controllers/argocd/kustomization.yaml
@@ -8,7 +8,9 @@ kind: Kustomization
 
 resources:
   - ns.yaml
-  - tls-route.yaml
+  - http-route.yaml
+  - grpc-service.yaml
+  - grpc-route.yaml
   - oidc.yaml
   - service-monitors/argocd-application-controller.yaml
   - service-monitors/argocd-applicationset-controller.yaml
diff --git a/k8s/infra/controllers/argocd/tls-route.yaml b/k8s/infra/controllers/argocd/tls-route.yaml
deleted file mode 100644
index c533d7e..0000000
--- a/k8s/infra/controllers/argocd/tls-route.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1alpha2
-kind: TLSRoute
-metadata:
-  name: argocd
-  namespace: argocd
-spec:
-  parentRefs:
-    - { name: internal, namespace: gateway }
-  hostnames: [ argocd.stonegarden.dev ]
-  rules:
-    - backendRefs: [ { name: argocd-server, port: 443 } ]
diff --git a/k8s/infra/controllers/argocd/values.yaml b/k8s/infra/controllers/argocd/values.yaml
index 01d6140..93fe989 100644
--- a/k8s/infra/controllers/argocd/values.yaml
+++ b/k8s/infra/controllers/argocd/values.yaml
@@ -32,7 +32,7 @@ configs:
           args: [ kustomize build --enable-helm ]
   params:
     controller.diff.server.side: true
-    server.insecure: false
+    server.insecure: true
   rbac:
     scopes: '[ argocd_claim ]'
     policy.csv: |
@@ -92,18 +92,18 @@ server:
       memory: 64Mi
     limits:
       memory: 1Gi
-  certificate:
-    enabled: true
-    domain: argocd.stonegarden.dev
-    issuer:
-      group: cert-manager.io
-      kind: ClusterIssuer
-      name: cloudflare-cluster-issuer
-    privateKey:
-      algorithm: ECDSA
-      size: 256
-  service:
-    servicePortHttpsAppProtocol: kubernetes.io/h2c
+  #certificate:
+  #  enabled: false
+  #  domain: argocd.stonegarden.dev
+  #  issuer:
+  #    group: cert-manager.io
+  #    kind: ClusterIssuer
+  #    name: cloudflare-cluster-issuer
+  #  privateKey:
+  #    algorithm: ECDSA
+  #    size: 256
+  #service:
+  #  servicePortHttpsAppProtocol: kubernetes.io/h2c
 
 repoServer:
   metrics:
diff --git a/k8s/infra/network/cilium/values.yaml b/k8s/infra/network/cilium/values.yaml
index 196c69a..a60d468 100644
--- a/k8s/infra/network/cilium/values.yaml
+++ b/k8s/infra/network/cilium/values.yaml
@@ -77,7 +77,7 @@ loadBalancer:
 gatewayAPI:
   enabled: true
   enableAlpn: true
-  enableAppProtocol: true
+  # enableAppProtocol: true
 
 envoy:
   prometheus: