feat(foundry): add public Ingress for argocd.gauchoracing.com#120
Conversation
Adds argocd-server-public Ingress in the argocd namespace routing argocd.gauchoracing.com to the foundry ArgoCD server. Foundry argocd-server already serves HTTP on Service port 80 (targetPort 8080), so no Helm value change is needed. external-dns writes the CNAME to the gr-foundry tunnel target (via --default-targets); no terraform change.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 60fd0cd2df
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| service: | ||
| name: argocd-server | ||
| port: | ||
| number: 80 |
There was a problem hiding this comment.
When this foundry ingress is used behind the Cloudflare Tunnel, infra/environments/prod/foundry.tf:88 sends plain HTTP to Traefik and this backend forwards that plain HTTP to argocd-server port 80. The Argo CD ingress docs describe port 80 as HTTP that redirects to HTTPS unless the API server is run with TLS disabled; the EKS install explicitly sets server.insecure in infra/modules/argocd/main.tf:71, but this foundry app says the upstream install is left unchanged, so after DNS cutover the public UI will redirect back to the same HTTPS URL instead of loading. Add a managed argocd-cmd-params-cm/Deployment patch to set server.insecure (or proxy to the HTTPS backend) along with this ingress.
Useful? React with 👍 / 👎.
1 participant
Adds the public argocd Ingress on the foundry cluster so
argocd.gauchoracing.comcan flip off EKS and onto foundry. Follow-up to #119.What's here
manifests-foundry/argocd-server-ingress/ingress.yaml— Traefik Ingress onargocd.gauchoracing.com→argocd-server:80.external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"so external-dns writes the record orange-cloud through the tunnel.apps-foundry/argocd-server-ingress.yaml— ArgoCD Application referencing the above.Foundry's argocd-server already exposes Service port 80 → targetPort 8080; no Helm/configmap patch needed.
Cutover after merge
kubectl -n argocd get ingress argocd-server-public.kubectl -n external-dns logs deploy/external-dns | grep argocd.gauchoracing.com. Should show it can't create because the record still exists (owned by EKS external-dns).kubectl --context eks -n external-dns scale deploy external-dns --replicas=0first.argocd.gauchoracing.comCNAME via CF dashboard.Test plan
kubectl -n argocd get ingress argocd-server-publicreturns the Ingress with Traefik class + node IPs.kubectl port-forward -n argocd svc/argocd-server 8080:80+curl -H 'Host: argocd.gauchoracing.com' http://localhost:8080/returns the ArgoCD UI HTML before DNS flip.https://argocd.gauchoracing.comloads the foundry ArgoCD UI, shows the foundry Applications (cloudflared, external-dns, sentinel, argocd-server-ingress, root-foundry).