From 134774509da15d70193b86dd0398d465b3b5f434 Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Fri, 23 Oct 2026 17:44:08 +0200
Subject: [PATCH] argocd: serve plain HTTP behind the ingress and the Gateway

With server.insecure, TLS ends at nginx or Envoy and argocd-server serves plain HTTP, which is how Argo CD documents the Gateway API setup. The nginx Ingress now talks HTTP to the http port; the ssl-passthrough annotation did nothing without the controller flag. argocd-folder diffs server-side for the new HTTPRoute.
---
 apps/templates/argocd-folder.yaml             |  3 ++
 argocd/httproute.yaml                         | 34 +++++++++++++++++++
 argocd/ingress.yaml                           | 11 ++----
 argocd/kustomization.yaml                     |  2 ++
 .../overlays/argocd-cmd-params-cm.patch.yaml  | 11 ++++++
 gateway/gateway.yaml                          | 14 ++++++++
 6 files changed, 67 insertions(+), 8 deletions(-)
 create mode 100644 argocd/httproute.yaml
 create mode 100644 argocd/overlays/argocd-cmd-params-cm.patch.yaml

diff --git a/apps/templates/argocd-folder.yaml b/apps/templates/argocd-folder.yaml
index 1b260bc..aa51844 100644
--- a/apps/templates/argocd-folder.yaml
+++ b/apps/templates/argocd-folder.yaml
@@ -2,6 +2,9 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: argocd-folder
+  annotations:
+    # Let the API server fill in Gateway API defaults before diffing.
+    argocd.argoproj.io/compare-options: ServerSideDiff=true
 spec:
   project: default
   source:
diff --git a/argocd/httproute.yaml b/argocd/httproute.yaml
new file mode 100644
index 0000000..f46233b
--- /dev/null
+++ b/argocd/httproute.yaml
@@ -0,0 +1,34 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: argocd
+spec:
+  parentRefs:
+  - name: homelab
+    namespace: envoy-gateway-system
+    sectionName: https-argocd
+  hostnames:
+  - argocd.rubenhensen.nl
+  rules:
+  - backendRefs:
+    - name: argocd-server
+      port: 80
+    # No limit on the whole request, as with nginx. Envoy's default of 15s
+    # cuts off uploads and long-lived connections.
+    timeouts:
+      request: 0s
+---
+# Lets the Gateway serve the certificate cert-manager keeps in this namespace.
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: gateway-tls
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: envoy-gateway-system
+  to:
+  - group: ""
+    kind: Secret
+    name: letsencrypt-prod
diff --git a/argocd/ingress.yaml b/argocd/ingress.yaml
index 0ad1250..f8d5921 100644
--- a/argocd/ingress.yaml
+++ b/argocd/ingress.yaml
@@ -3,13 +3,9 @@ kind: Ingress
 metadata:
   name: argocd-server-ingress
   annotations:
-    # nginx.ingress.kubernetes.io/rewrite-target: /
     cert-manager.io/cluster-issuer: prod-cluster-issuer
-    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-    # If you encounter a redirect loop or are getting a 307 response code
-    # then you need to force the nginx ingress to connect to the backend using HTTPS.
-    #
-    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+    # argocd-server runs with server.insecure, see overlays/
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
   namespace: argocd
 spec:
   ingressClassName: nginx
@@ -23,9 +19,8 @@ spec:
           service:
             name: argocd-server
             port:
-              name: https
+              name: http
   tls:
     - secretName:  letsencrypt-prod
       hosts:
         - argocd.rubenhensen.nl
-
diff --git a/argocd/kustomization.yaml b/argocd/kustomization.yaml
index a6af125..1a9df9c 100644
--- a/argocd/kustomization.yaml
+++ b/argocd/kustomization.yaml
@@ -8,6 +8,7 @@ namespace: argocd
 resources:
 - https://raw.githubusercontent.com/argoproj/argo-cd/refs/tags/v3.4.12/manifests/install.yaml
 - ingress.yaml
+- httproute.yaml
 - oidc-secret.yaml
 
 patches:
@@ -19,4 +20,5 @@ patches:
     path: overlays/argocd-notifications-controller-patch.yaml
   - path: overlays/argocd-cm.patch.yaml
   - path: overlays/argocd-rbac-cm.patch.yaml
+  - path: overlays/argocd-cmd-params-cm.patch.yaml
   - path: overlays/patched-ca-bundle.patch.yaml
\ No newline at end of file
diff --git a/argocd/overlays/argocd-cmd-params-cm.patch.yaml b/argocd/overlays/argocd-cmd-params-cm.patch.yaml
new file mode 100644
index 0000000..01ce99e
--- /dev/null
+++ b/argocd/overlays/argocd-cmd-params-cm.patch.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cmd-params-cm
+  labels:
+    app.kubernetes.io/name: argocd-cmd-params-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  # TLS ends at the ingress, so argocd-server serves plain HTTP. Needed for
+  # the Gateway API, which has no simple way to trust its self-signed cert.
+  server.insecure: "true"
diff --git a/gateway/gateway.yaml b/gateway/gateway.yaml
index 06ee4e2..49085b7 100644
--- a/gateway/gateway.yaml
+++ b/gateway/gateway.yaml
@@ -198,3 +198,17 @@ spec:
         selector:
           matchLabels:
             kubernetes.io/metadata.name: vault
+  - name: https-argocd
+    protocol: HTTPS
+    port: 443
+    hostname: argocd.rubenhensen.nl
+    tls:
+      certificateRefs:
+      - name: letsencrypt-prod
+        namespace: argocd
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: argocd