feat(argocd): enable argocd cli

Also change Argo CD to use a proper certificate

Signed-off-by: Vegard Hagen <[email protected]>

k8s/infra/controllers/argocd/http-route.yaml

@@ -17,3 +17,10 @@ spec:
       backendRefs:
         - name: argocd-server
           port: 80
+#    - matches:
+#        - headers:
+#            - name: Content-Type
+#              value: application/grpc
+#      backendRefs:
+#        - name: argocd-server
+#          port: 80

k8s/infra/controllers/argocd/kustomization.yaml

@@ -3,7 +3,8 @@ kind: Kustomization
 
 resources:
   - ns.yaml
-  - http-route.yaml
+#  - http-route.yaml
+  - tls-route.yaml
   - oidc.yaml
 
 helmCharts:

k8s/infra/controllers/argocd/tls-route.yaml

@@ -0,0 +1,15 @@
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TLSRoute
+metadata:
+  name: argocd
+  namespace: argocd
+spec:
+  parentRefs:
+    - name: internal
+      namespace: gateway
+  hostnames:
+    - "argocd.stonegarden.dev"
+  rules:
+    - backendRefs:
+        - name: argocd-server
+          port: 443

k8s/infra/controllers/argocd/values.yaml

@@ -32,7 +32,7 @@ configs:
           args: [ kustomize build --enable-helm ]
   params:
     controller.diff.server.side: true
-    server.insecure: true
+    server.insecure: false
   rbac:
     scopes: '[ argocd_claim ]'
     policy.csv: |
@@ -76,6 +76,18 @@ server:
       memory: 64Mi
     limits:
       memory: 1Gi
+  certificate:
+    enabled: true
+    domain: argocd.stonegarden.dev
+    issuer:
+      group: cert-manager.io
+      kind: ClusterIssuer
+      name: cloudflare-cluster-issuer
+    privateKey:
+      algorithm: ECDSA
+      size: 256
+  service:
+    servicePortHttpsAppProtocol: kubernetes.io/h2c
 
 repoServer:
   containerSecurityContext:

k8s/infra/network/cilium/values.yaml

@@ -70,6 +70,8 @@ loadBalancer:
 
 gatewayAPI:
   enabled: true
+  enableAlpn: true
+  enableAppProtocol: true
 envoy:
   securityContext:
     capabilities:

k8s/infra/network/gateway/gw-internal.yaml

@@ -9,6 +9,15 @@ spec:
     - type: IPAddress
       value: 192.168.1.220
   listeners:
+    - protocol: TLS
+      port: 443
+      name: tls-passthrough
+      hostname: "*.stonegarden.dev"
+      tls:
+        mode: Passthrough
+      allowedRoutes:
+        namespaces:
+          from: All
     - protocol: HTTPS
       port: 443
       name: https-gateway