gitops-delivery (ArgoCD)

Purpose: deliver the platform via GitOps — ArgoCD syncs the con-prod overlay, self-heals drift, and gives a one-action rollback.

Deploys (manifests/argo/): an AppProject (talos) + an Application (talos) in the argocd namespace, house-style after cluster-infra/argo. - Application source: this repo, targetRevision: main, path: manifests/overlays/con-prod. - syncPolicy.automated with prune + selfHeal; finalizer; revisionHistoryLimit: 5. - AppProject scopes it: only this repo as source, only namespace con-ci.

Key facts: - ArgoCD syncs everything except secrets: namespace, runner, egress, isolation. The forgejo-runner-conn Secret is delivered out-of-band (SOPS) and intentionally NOT in the overlay (ArgoCD has no KSOPS yet). - runner-build (fuse) and runner-oci are not in the overlay yet — adding them before their prerequisites (fuse plugin / rootless runtime proven) would break the sync. - ArgoCD must be able to pull the repo (repo creds; reuses the Conduction Codeberg credential like cluster-infra).

Operate: - Status: kubectl -n argocd get application talos (want Synced/Healthy). - Rollback: delete the Application → prune removes managed resources → con-ci drains. - Bootstrap steps in onboarding.md.

Deferred: KSOPS on the ArgoCD repo-server so the SOPS secret can be synced too (needs the age key in the argocd ns + a repo-server plugin) — a separate, careful change.