argo-cd: fullnameOverride: argocd global: image: repository: quay.io/argoproj/argocd tag: v3.5.5@sha256:13db7b10db23283b1b36f855046602e18539a8a8204c9f6f039e8896c8897518 networkPolicy: create: false dex: enabled: false notifications: enabled: false applicationSet: replicas: 0 redis: image: repository: docker.io/library/redis tag: 8.6.4-alpine@sha256:2cc044fc5a07c9b701f8f1255a309ae9ad7856e694ac03513bf3648c01e40763 automountServiceAccountToken: false redisSecretInit: enabled: false configs: cm: users.anonymous.enabled: 'false' exec.enabled: 'false' application.resourceTrackingMethod: annotation resource.respectRBAC: strict # KServe's source is a Kustomize wrapper over pinned Helm charts (helmCharts in its kustomization), and # this Argo CD does not accept a per-Application buildOptions. The flag only enables inflation. kustomize.buildOptions: "--enable-helm" # The condition-type suffix check uses Lua's string library. resource.customizations.useOpenLibs.argoproj.io_Application: 'true' resource.customizations.health.argoproj.io_Application: | -- Decision 0039: Synced and Healthy at the delivered source, with no queued, -- running or failed operation. Argo starts every operation. The root's wave -- waits (Progressing) while a child retries; it never runs a later wave early. -- A child that carries pharos.platform/deferred-sync is synchronised only by -- an explicit operation, so it reports Healthy unless it is being operated on. local function same(a, b) if type(a) ~= "table" or type(b) ~= "table" then return a == b end for key, value in pairs(a) do if not same(value, b[key]) then return false end end for key in pairs(b) do if a[key] == nil then return false end end return true end local hs = {status = "Progressing", message = "Waiting for Argo to reconcile the delivered source"} local s = obj.status local annotations = (obj.metadata or {}).annotations or {} local deferred = annotations["pharos.platform/deferred-sync"] == "true" if s == nil or s.sync == nil or s.health == nil or s.sync.comparedTo == nil then return hs end for _, condition in ipairs(s.conditions or {}) do if string.sub(condition.type or "", -5) == "Error" then hs.message = "Child has an Argo error condition: " .. condition.type return hs end end local revision = obj.spec.source.targetRevision local operation = s.operationState or {} local failed = (operation.phase == "Failed" or operation.phase == "Error") and operation.syncResult ~= nil and operation.syncResult.revision == revision if obj.operation ~= nil or operation.phase == "Running" or operation.phase == "Terminating" then hs.message = "Waiting for the child's Argo operation" elseif deferred then hs.status = "Healthy" hs.message = failed and "Deferred; its own operation failed and delivery does not wait for it" or "Deferred: synchronised only by an explicit operation" elseif failed then hs.message = "The child's operation failed at the delivered revision; Argo retries it" elseif s.sync.status == "Synced" and s.sync.revision == revision and s.health.status == "Healthy" and same(s.sync.comparedTo.source, obj.spec.source) then hs.status = "Healthy" hs.message = "" elseif s.sync.status == "Synced" and s.health.status == "Healthy" then hs.message = "Waiting for Argo to compare the delivered source" else hs.message = "Child is " .. tostring(s.sync.status) .. " and " .. tostring(s.health.status) end return hs resource.inclusions: "- apiGroups:\n - ''\n kinds:\n - ConfigMap\n - Secret\n - Service\n - ServiceAccount\n - Pod\n - Namespace\n clusters:\n - https://kubernetes.default.svc:443\n- apiGroups:\n - apps\n kinds:\n - Deployment\n - StatefulSet\n - ReplicaSet\n - DaemonSet\n clusters:\n - https://kubernetes.default.svc:443\n- apiGroups:\n - batch\n kinds:\n - Job\n clusters:\n - https://kubernetes.default.svc:443\n- apiGroups:\n - rbac.authorization.k8s.io\n kinds:\n - Role\n - RoleBinding\n - ClusterRole\n - ClusterRoleBinding\n clusters:\n - https://kubernetes.default.svc:443\n- apiGroups:\n - argoproj.io\n kinds:\n - Application\n clusters:\n - https://kubernetes.default.svc:443\n- apiGroups:\n - apiextensions.k8s.io\n kinds:\n - CustomResourceDefinition\n clusters:\n - https://kubernetes.default.svc:443\n- apiGroups:\n - networking.k8s.io\n kinds:\n - NetworkPolicy\n clusters:\n - https://kubernetes.default.svc:443\n- apiGroups:\n - networking.istio.io\n kinds:\n - Gateway\n - VirtualService\n - DestinationRule\n - EnvoyFilter\n clusters:\n - https://kubernetes.default.svc.cluster.local\n- apiGroups:\n - security.istio.io\n kinds:\n - AuthorizationPolicy\n clusters:\n - https://kubernetes.default.svc.cluster.local\n- apiGroups:\n - networking.k8s.io\n kinds:\n - NetworkPolicy\n clusters:\n - https://kubernetes.default.svc.cluster.local\n- apiGroups:\n - ''\n kinds:\n - ConfigMap\n - Secret\n - Service\n - ServiceAccount\n - PersistentVolumeClaim\n - Pod\n - Endpoints\n clusters:\n - https://kubernetes.default.svc.cluster.local:443\n- apiGroups:\n - apps\n kinds:\n - Deployment\n - StatefulSet\n - ReplicaSet\n clusters:\n - https://kubernetes.default.svc.cluster.local:443\n- apiGroups:\n - batch\n kinds:\n - Job\n - CronJob\n clusters:\n - https://kubernetes.default.svc.cluster.local:443\n- apiGroups:\n - policy\n kinds:\n - PodDisruptionBudget\n clusters:\n - https://kubernetes.default.svc.cluster.local:443\n- apiGroups:\n - autoscaling\n kinds:\n - HorizontalPodAutoscaler\n clusters:\n - https://kubernetes.default.svc.cluster.local:443\n- apiGroups:\n - rbac.authorization.k8s.io\n kinds:\n - Role\n - RoleBinding\n clusters:\n - https://kubernetes.default.svc.cluster.local:443\n- apiGroups:\n - networking.k8s.io\n kinds:\n - NetworkPolicy\n clusters:\n - https://kubernetes.default.svc.cluster.local:443\n- apiGroups:\n - objectbucket.io\n kinds:\n - ObjectBucketClaim\n clusters:\n - https://kubernetes.default.svc.cluster.local:443\n- apiGroups:\n - ''\n kinds:\n - ConfigMap\n - Secret\n - ServiceAccount\n - PersistentVolumeClaim\n - Service\n clusters:\n - https://kubernetes.default:443\n- apiGroups:\n - apps\n kinds:\n - Deployment\n - StatefulSet\n clusters:\n - https://kubernetes.default:443\n- apiGroups:\n - batch\n kinds:\n - Job\n - CronJob\n clusters:\n - https://kubernetes.default:443\n- apiGroups:\n - rbac.authorization.k8s.io\n kinds:\n - Role\n - RoleBinding\n - ClusterRole\n - ClusterRoleBinding\n clusters:\n - https://kubernetes.default:443\n- apiGroups:\n - networking.k8s.io\n kinds:\n - NetworkPolicy\n clusters:\n - https://kubernetes.default:443\n- apiGroups:\n - apiextensions.k8s.io\n kinds:\n - CustomResourceDefinition\n clusters:\n - https://kubernetes.default:443\n- apiGroups:\n - admissionregistration.k8s.io\n kinds:\n - ValidatingAdmissionPolicy\n - ValidatingAdmissionPolicyBinding\n - MutatingWebhookConfiguration\n - ValidatingWebhookConfiguration\n clusters:\n - https://kubernetes.default:443\n- apiGroups:\n - ''\n kinds:\n - PersistentVolumeClaim\n - Service\n clusters:\n - https://kubernetes.default:443\n- apiGroups:\n - apps\n kinds:\n - StatefulSet\n clusters:\n - https://kubernetes.default:443\n- apiGroups:\n - batch\n kinds:\n - CronJob\n clusters:\n - https://kubernetes.default:443\n- apiGroups:\n - policy\n kinds:\n - PodDisruptionBudget\n clusters:\n - https://kubernetes.default:443\n- apiGroups:\n - autoscaling\n kinds:\n - HorizontalPodAutoscaler\n clusters:\n - https://kubernetes.default:443\n- apiGroups:\n - admissionregistration.k8s.io\n kinds:\n - MutatingWebhookConfiguration\n - ValidatingWebhookConfiguration\n clusters:\n - https://kubernetes.default:443\n- apiGroups:\n - security.istio.io\n kinds:\n - AuthorizationPolicy\n - RequestAuthentication\n clusters:\n - https://kubernetes.default:443\n- apiGroups:\n - networking.istio.io\n kinds:\n - DestinationRule\n - Gateway\n - VirtualService\n clusters:\n - https://kubernetes.default:443\n- apiGroups:\n - kubeflow.org\n kinds:\n - ClusterTrainingRuntime\n - Experiment\n - Notebook\n - PodDefault\n - Profile\n - Suggestion\n - Tensorboard\n - Trainer\n - TrainingRuntime\n - Trial\n clusters:\n - https://kubernetes.default:443\n- apiGroups:\n - pipelines.kubeflow.org\n kinds:\n - Pipeline\n - PipelineVersion\n clusters:\n - https://kubernetes.default:443\n- apiGroups:\n - serving.kserve.io\n kinds:\n - InferenceService\n - ClusterServingRuntime\n - ClusterStorageContainer\n - LLMInferenceService\n - LLMInferenceServiceConfig\n clusters:\n - https://kubernetes.default:443\n- apiGroups:\n - cert-manager.io\n kinds:\n - Certificate\n - Issuer\n clusters:\n - https://kubernetes.default:443\n- apiGroups:\n - apps\n kinds:\n - DaemonSet\n clusters:\n - https://kubernetes.default.svc:443\n- apiGroups:\n - nvidia.com\n kinds:\n - ClusterPolicy\n clusters:\n - https://kubernetes.default.svc:443\n- apiGroups:\n - resource.k8s.io\n kinds:\n - DeviceClass\n clusters:\n - https://kubernetes.default.svc:443\n- apiGroups:\n - admissionregistration.k8s.io\n kinds:\n - ValidatingAdmissionPolicy\n - ValidatingAdmissionPolicyBinding\n - MutatingWebhookConfiguration\n clusters:\n - https://kubernetes.default.svc:443" cluster.inClusterEnabled: 'false' params: server.insecure: true rbac: policy.default: '' policy.csv: '' secret: createSecret: false controller: roleRules: - apiGroups: - '' resources: - configmaps - secrets - services - serviceaccounts - pods - events verbs: &id001 - get - list - watch - create - update - patch - delete - apiGroups: - apps resources: - deployments - statefulsets - replicasets verbs: *id001 - apiGroups: - batch resources: - jobs verbs: *id001 - apiGroups: - networking.k8s.io resources: - networkpolicies verbs: *id001 - apiGroups: - rbac.authorization.k8s.io resources: - roles - rolebindings verbs: *id001 - apiGroups: - argoproj.io resources: - applications - applications/status - applications/finalizers verbs: *id001 - apiGroups: - argoproj.io resources: - appprojects verbs: - get - list - watch - apiGroups: - rbac.authorization.k8s.io resources: - roles resourceNames: - argocd-application-controller - argocd-server - argocd-applicationset-controller verbs: - bind - escalate clusterRoleRules: enabled: true rules: - nonResourceURLs: - /api - /api/* - /apis - /apis/* - /version verbs: - get - apiGroups: - '' resources: - namespaces verbs: - get - list - watch - apiGroups: - apiextensions.k8s.io resources: - customresourcedefinitions verbs: - get - list - watch - apiGroups: - apiextensions.k8s.io resources: - customresourcedefinitions resourceNames: - applications.argoproj.io - applicationsets.argoproj.io - appprojects.argoproj.io verbs: - update - patch - apiGroups: - authorization.k8s.io resources: - selfsubjectaccessreviews verbs: - create - apiGroups: - rbac.authorization.k8s.io resources: - clusterroles - clusterrolebindings verbs: - get - list - watch - apiGroups: - rbac.authorization.k8s.io resources: - clusterroles resourceNames: - argocd-application-controller - argocd-server verbs: - update - patch - bind - escalate - apiGroups: - rbac.authorization.k8s.io resources: - clusterrolebindings resourceNames: - argocd-application-controller - argocd-server verbs: - update - patch server: clusterRoleRules: enabled: true rules: - apiGroups: - '' resources: - namespaces verbs: - get - list - watch repoServer: automountServiceAccountToken: false