fix(argocd): use http-route and grpc-route instead of a single tls-route

Also stop serving certificate from Argo CD

This fixes issues with GatewayAPI/Cilium/ALPN not playing together

Signed-off-by: Vegard Hagen <[email protected]>

k8s/infra/controllers/argocd/grpc-route.yaml

@@ -0,0 +1,13 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: GRPCRoute
+metadata:
+  name: argocd-server
+  namespace: argocd
+spec:
+  parentRefs:
+    - { name: internal, namespace: gateway }
+  hostnames: [ "argocd.stonegarden.dev" ]
+  rules:
+    - backendRefs: [ { name: argocd-server-grpc, port: 80 } ]
+      matches:
+        - headers: [ { name: Content-Type, value: application/grpc } ]

k8s/infra/controllers/argocd/grpc-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: argocd-server-grpc
+  namespace: argocd
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/instance: argocd
+    app.kubernetes.io/name: argocd-server
+  ports:
+    - name: grpc
+      port: 80
+      protocol: TCP
+      appProtocol: kubernetes.io/h2c
+      targetPort: 8080

k8s/infra/controllers/argocd/http-route.yaml

@@ -0,0 +1,13 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: argocd-server
+  namespace: argocd
+spec:
+  parentRefs:
+    - { name: internal, namespace: gateway }
+  hostnames: [ "argocd.stonegarden.dev" ]
+  rules:
+    - backendRefs: [ { name: argocd-server, port: 80 } ]
+      matches:
+        - path: { type: PathPrefix, value: / }

k8s/infra/controllers/argocd/kustomization.yaml

@@ -8,7 +8,9 @@ kind: Kustomization
 
 resources:
   - ns.yaml
-  - tls-route.yaml
+  - http-route.yaml
+  - grpc-service.yaml
+  - grpc-route.yaml
   - oidc.yaml
   - service-monitors/argocd-application-controller.yaml
   - service-monitors/argocd-applicationset-controller.yaml

k8s/infra/controllers/argocd/tls-route.yaml

@@ -1,11 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1alpha2
-kind: TLSRoute
-metadata:
-  name: argocd
-  namespace: argocd
-spec:
-  parentRefs:
-    - { name: internal, namespace: gateway }
-  hostnames: [ argocd.stonegarden.dev ]
-  rules:
-    - backendRefs: [ { name: argocd-server, port: 443 } ]

k8s/infra/controllers/argocd/values.yaml

@@ -32,7 +32,7 @@ configs:
           args: [ kustomize build --enable-helm ]
   params:
     controller.diff.server.side: true
-    server.insecure: false
+    server.insecure: true
   rbac:
     scopes: '[ argocd_claim ]'
     policy.csv: |
@@ -92,18 +92,18 @@ server:
       memory: 64Mi
     limits:
       memory: 1Gi
-  certificate:
+  #certificate:
-    enabled: true
+  #  enabled: false
-    domain: argocd.stonegarden.dev
+  #  domain: argocd.stonegarden.dev
-    issuer:
+  #  issuer:
-      group: cert-manager.io
+  #    group: cert-manager.io
-      kind: ClusterIssuer
+  #    kind: ClusterIssuer
-      name: cloudflare-cluster-issuer
+  #    name: cloudflare-cluster-issuer
-    privateKey:
+  #  privateKey:
-      algorithm: ECDSA
+  #    algorithm: ECDSA
-      size: 256
+  #    size: 256
-  service:
+  #service:
-    servicePortHttpsAppProtocol: kubernetes.io/h2c
+  #  servicePortHttpsAppProtocol: kubernetes.io/h2c
 
 repoServer:
   metrics:

k8s/infra/network/cilium/values.yaml

@@ -77,7 +77,7 @@ loadBalancer:
 gatewayAPI:
   enabled: true
   enableAlpn: true
-  enableAppProtocol: true
+  # enableAppProtocol: true
 
 envoy:
   prometheus: