homelab-v/k8s/infra/controllers/argocd/values.yaml

# https://github.com/argoproj/argo-helm/blob/main/charts/argo-cd/values.yaml
configs:
  cm:
    create: true
    application.resourceTrackingMethod: annotation+label
    admin.enabled: false
    url: https://argocd.stonegarden.dev
    # https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#sensitive-data-and-sso-client-secrets
    # https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#retrieving-group-claims-when-not-in-the-token
    oidc.config: |
      name: 'Authelia'
      issuer: 'https://authelia.stonegarden.dev'
      clientID: 'argocd'
      clientSecret: $oidc:authelia.clientSecret
      cliClientID: 'argocd-cli'
      requestedScopes: [ 'openid', 'offline_access' ]
      enableUserInfoGroups: true
      requestedIDTokenClaims:
        argocd_claim: { essential: true }
        name: { essential: false }
        email: { essential: false }
        preferred_username: { essential: false }
      userInfoPath: /api/oidc/userinfo
      userInfoCacheExpiration: '5m'

  cmp:
    create: true
    plugins:
      kustomize-build-with-helm:
        generate:
          command: [ sh, -c ]
          args: [ kustomize build --enable-helm ]
  params:
    controller.diff.server.side: true
    server.insecure: false
  rbac:
    scopes: '[ argocd_claim ]'
    policy.csv: |
      g, admin, role:admin
      g, readonly, role:readonly

crds:
  install: true
  # -- Keep CRDs on chart uninstall
  keep: false

controller:
  resources:
    requests:
      cpu: 100m
      memory: 700Mi
    limits:
      memory: 4Gi

dex:
  enabled: false
  resources:
    requests:
      cpu: 10m
      memory: 32Mi
    limits:
      memory: 128Mi

redis:
  resources:
    requests:
      cpu: 100m
      memory: 64Mi
    limits:
      memory: 1Gi

server:
  resources:
    requests:
      cpu: 50m
      memory: 64Mi
    limits:
      memory: 1Gi
  certificate:
    enabled: true
    domain: argocd.stonegarden.dev
    issuer:
      group: cert-manager.io
      kind: ClusterIssuer
      name: cloudflare-cluster-issuer
    privateKey:
      algorithm: ECDSA
      size: 256
  service:
    servicePortHttpsAppProtocol: kubernetes.io/h2c

repoServer:
  containerSecurityContext:
    readOnlyRootFilesystem: true
  volumes:
    - name: cmp-kustomize-build-with-helm
      configMap:
        name: argocd-cmp-cm
    - name: cmp-tmp
      emptyDir: { }
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      memory: 2Gi
  extraContainers:
    - name: kustomize-build-with-helm
      command:
        - argocd-cmp-server
      image: '{{ default .Values.global.image.repository .Values.repoServer.image.repository }}:{{ default (include "argo-cd.defaultTag" .) .Values.repoServer.image.tag }}'
      securityContext:
        runAsNonRoot: true
        runAsUser: 999
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        seccompProfile:
          type: RuntimeDefault
        capabilities:
          drop: [ ALL ]
      volumeMounts:
        - name: plugins
          mountPath: /home/argocd/cmp-server/plugins
        - name: cmp-kustomize-build-with-helm
          mountPath: /home/argocd/cmp-server/config/plugin.yaml
          subPath: kustomize-build-with-helm.yaml
        - mountPath: /tmp
          name: cmp-tmp

applicationSet:
  resources:
    requests:
      cpu: 50m
      memory: 64Mi
    limits:
      memory: 1Gi

notifications:
  enabled: false
  resources:
    requests:
      cpu: 100m
      memory: 64Mi
    limits:
      cpu: 1000m
      memory: 128Mi