# values/argocd.values.yaml

global:
  domain: argocd.kube.huskypup.net

configs:
  cm:
    url: https://argocd.kube.huskypup.net
    resource.customizations.ignoreDifferences.all: |
      managedFieldsManagers:
        - external-secrets
        - istio-system
      jqPathExpressions:
        - .metadata.finalizers
    resource.customizations.ignoreDifferences.external-secrets.io_ExternalSecret: |
      jqPathExpressions:
        - .metadata.annotations."force-sync"
        - .metadata.annotations."reconcile.external-secrets.io/force-sync"
        - .metadata.finalizers
        - .spec.data[].remoteRef.conversionStrategy
        - .spec.data[].remoteRef.decodingStrategy
        - .spec.data[].remoteRef.metadataPolicy
    resource.customizations.ignoreDifferences.gateway.networking.k8s.io_HTTPRoute: |
      jqPathExpressions:
        - .metadata.annotations
        - .spec.parentRefs[].port
    resource.customizations.ignoreDifferences.monitoring.coreos.com_ServiceMonitor: |
      jqPathExpressions:
        - .spec.endpoints[].relabelings[].action
        - .spec.endpoints[].metricRelabelings[].action
    resource.customizations.ignoreDifferences.monitoring.coreos.com_PodMonitor: |
      jqPathExpressions:
        - .spec.podMetricsEndpoints[].relabelings[].action
        - .spec.podMetricsEndpoints[].metricRelabelings[].action
    resource.customizations.ignoreDifferences.apps_StatefulSet: |
      jqPathExpressions:
        - .spec.volumeClaimTemplates[].apiVersion
        - .spec.volumeClaimTemplates[].kind
    oidc.config: |
      name: Authentik
      issuer: https://auth.kube.huskypup.net/application/o/argocd/
      clientID: $oidc.authentik.clientId
      clientSecret: $oidc.authentik.clientSecret
      requestedScopes:
        - openid
        - profile
        - email
        - groups
  
  rbac:
    policy.default: role:readonly
    scopes: '[groups, preferred_username]'
    policy.csv: |
      g, Authentik Admins, role:admin
      g, ArgoCD Admins, role:admin
      g, Scooby, role:admin

server:
  replicas: 2
  extraArgs:
    - --insecure  # TLS is terminated at Istio gateway

  hostAliases:
    - ip: "172.28.101.244"
      hostnames:
        - auth.kube.huskypup.net
        - gitlab.kube.huskypup.net

  ingress:
    enabled: false

  env:
    - name: oidc.authentik.clientId
      valueFrom:
        secretKeyRef:
          name: argocd-oauth-secret
          key: client-id
    - name: oidc.authentik.clientSecret
      valueFrom:
        secretKeyRef:
          name: argocd-oauth-secret
          key: client-secret

dex:
  enabled: false  # using Authentik instead of built-in Dex

# Enable Prometheus metrics
metrics:
  enabled: true
  serviceMonitor:
    enabled: true
    additionalLabels:
      release: prometheus

controller:
  metrics:
    enabled: true
    serviceMonitor:
      enabled: true
      additionalLabels:
        release: prometheus

repoServer:
  replicas: 2
  hostAliases:
    - ip: "172.28.101.244"
      hostnames:
        - gitlab.kube.huskypup.net
        - auth.kube.huskypup.net
  metrics:
    enabled: true
    serviceMonitor:
      enabled: true
      additionalLabels:
        release: prometheus

applicationSet:
  hostAliases:
    - ip: "172.28.101.244"
      hostnames:
        - gitlab.kube.huskypup.net
        - auth.kube.huskypup.net
  metrics:
    enabled: true
    serviceMonitor:
      enabled: true
      additionalLabels:
        release: prometheus