a2d0682168
The built-in k3s Traefik Helm chart creates its own traefik-dashboard IngressRoute. Our ArgoCD-managed copy blocked Helm install because Helm requires ownership labels (app.kubernetes.io/managed-by=Helm). Removing our copy lets the built-in chart manage the dashboard route.
deploy-app-kargo-private
Private ArgoCD ApplicationSet repository with SOPS-encrypted secrets.
Structure
infra/— Infrastructure apps (cert-manager, gitea, kargo, etc.)ci/— CI apps (gitea-runner, etc.)kargo/— Kargo pipeline definitions + encrypted credentials.sops.yaml— SOPS encryption rules (3 age keys: admin, dev, prod)
Encryption
Secrets in *.enc.yaml files are encrypted with SOPS + age:
*.dev.enc.yaml— decryptable by admin + dev keys*.prod.enc.yaml— decryptable by admin + prod keys*.shared.enc.yaml— decryptable by all three keys
Branches
main— source of truthinfra/stage/dev— dev cluster (Kargo promotion)infra/stage/test— test stage (Kargo verification)infra/stage/prod— prod cluster (Kargo promotion via PR)