Bootstrap

Two scripts live in argocd/:

argocd-init.sh

One-shot install — creates the argocd namespace and installs the official argo/argo-cd Helm chart (pinned version in the script) with overrides from values-argocd.yaml:

./argocd/argocd-init.sh

What it does:

1. Creates the argocd namespace if missing.
2. Adds https://argoproj.github.io/argo-helm and runs helm upgrade --install --version <pinned>.
3. Waits for the argo-cd-argocd-server Deployment to be available.

Re-running it is idempotent and safe (uses helm upgrade --install).

After the install, apply the bootstrap secrets that ArgoCD does not manage itself:

kubectl apply -f argocd/meta/gitlab-repo-creds.yaml
kubectl apply -f argocd/meta/gitlab-oci-repo-creds.yaml
kubectl apply -f argocd/meta/kargo-gitlab-creds.yaml
kubectl apply -f k8s/cluster/cluster.app.yaml

cluster.app.yaml is the only Application ever applied by hand. It syncs k8s/cluster/, which contains cluster-apps.app.yaml; that Application in turn applies everything under k8s/app/ (system Applications and project definitions) from main. From here on, pushing is deploying.

sync-apps.sh

Bootstrap fallback only. It applies every top-level definition found in the repo with kubectl, which is what cluster-apps does continuously once ArgoCD is up:

./argocd/sync-apps.sh

Use it when ArgoCD itself is down or being rebuilt and you need the system Applications back before it can reconcile them. Day to day, nobody runs it: adding a project, adding an environment or bumping a chartVersion is a push to main.

Removing a project

cluster-apps does not prune, so deleting k8s/app/platform/<slug>/ from the repo does not remove anything from the cluster. Follow the teardown order in component-database for the MySQL user, then:

kubectl delete xplatformapp <slug>

The composition removes the generated Applications, Kargo project and namespaces. Delete the repo directory in the same change so the two stay consistent.