argocd: serve plain HTTP behind the ingress and the Gateway

With server.insecure, TLS ends at nginx or Envoy and argocd-server serves plain HTTP, which is how Argo CD documents the Gateway API setup. The nginx Ingress now talks HTTP to the http port; the ssl-passthrough annotation did nothing without the controller flag. argocd-folder diffs server-side for the new HTTPRoute.

apps/templates/argocd-folder.yaml

@@ -2,6 +2,9 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: argocd-folder
+  annotations:
+    # Let the API server fill in Gateway API defaults before diffing.
+    argocd.argoproj.io/compare-options: ServerSideDiff=true
 spec:
   project: default
   source:

argocd/httproute.yaml

@@ -0,0 +1,34 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: argocd
+spec:
+  parentRefs:
+  - name: homelab
+    namespace: envoy-gateway-system
+    sectionName: https-argocd
+  hostnames:
+  - argocd.rubenhensen.nl
+  rules:
+  - backendRefs:
+    - name: argocd-server
+      port: 80
+    # No limit on the whole request, as with nginx. Envoy's default of 15s
+    # cuts off uploads and long-lived connections.
+    timeouts:
+      request: 0s
+---
+# Lets the Gateway serve the certificate cert-manager keeps in this namespace.
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: gateway-tls
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: envoy-gateway-system
+  to:
+  - group: ""
+    kind: Secret
+    name: letsencrypt-prod

argocd/ingress.yaml

@@ -3,13 +3,9 @@ kind: Ingress
 metadata:
   name: argocd-server-ingress
   annotations:
-    # nginx.ingress.kubernetes.io/rewrite-target: /
     cert-manager.io/cluster-issuer: prod-cluster-issuer
-    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-    # If you encounter a redirect loop or are getting a 307 response code
-    # then you need to force the nginx ingress to connect to the backend using HTTPS.
-    #
-    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+    # argocd-server runs with server.insecure, see overlays/
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
   namespace: argocd
 spec:
   ingressClassName: nginx
@@ -23,9 +19,8 @@ spec:
           service:
             name: argocd-server
             port:
-              name: https
+              name: http
   tls:
     - secretName:  letsencrypt-prod
       hosts:
         - argocd.rubenhensen.nl
-

argocd/kustomization.yaml

@@ -8,6 +8,7 @@ namespace: argocd
 resources:
 - https://raw.githubusercontent.com/argoproj/argo-cd/refs/tags/v3.4.12/manifests/install.yaml
 - ingress.yaml
+- httproute.yaml
 - oidc-secret.yaml
 
 patches:
@@ -19,4 +20,5 @@ patches:
     path: overlays/argocd-notifications-controller-patch.yaml
   - path: overlays/argocd-cm.patch.yaml
   - path: overlays/argocd-rbac-cm.patch.yaml
+  - path: overlays/argocd-cmd-params-cm.patch.yaml
   - path: overlays/patched-ca-bundle.patch.yaml

argocd/overlays/argocd-cmd-params-cm.patch.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cmd-params-cm
+  labels:
+    app.kubernetes.io/name: argocd-cmd-params-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  # TLS ends at the ingress, so argocd-server serves plain HTTP. Needed for
+  # the Gateway API, which has no simple way to trust its self-signed cert.
+  server.insecure: "true"

gateway/gateway.yaml

@@ -198,3 +198,17 @@ spec:
         selector:
           matchLabels:
             kubernetes.io/metadata.name: vault
+  - name: https-argocd
+    protocol: HTTPS
+    port: 443
+    hostname: argocd.rubenhensen.nl
+    tls:
+      certificateRefs:
+      - name: letsencrypt-prod
+        namespace: argocd
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: argocd