# ArgoCD Self-Management Cutover — 2026-07-14

## Context

Migrating ArgoCD's Git source from external Gitea (CT108, LXC, `10.0.30.105:3000`)
to K8s-internal Gitea (Helm chart in `gitea` namespace, reachable via
Traefik VIP `10.0.30.203`). The chicken-and-egg problem: ArgoCD deploys
Gitea, but ArgoCD also pulls from Gitea.

## Sequence

### 1. CoreDNS Internal DNS Override

Added `hosts` plugin to CoreDNS via `HelmChartConfig` so `git.schoen.codes`
resolves to `10.0.30.203` (Traefik VIP) inside K8s — no public DNS needed.

**File:** `clusters/main/operators/coredns-config.yaml`

**Key pitfall:** Initial attempt used `valuesContent: corefile: |` —
silently ignored. The RKE2 CoreDNS chart uses `servers[].plugins[]`
structure. Fixed by using the correct chart values structure.

**Key pitfall:** HelmChartConfig was synched by ArgoCD but ConfigMap
didn't update until we directly patched it + waited 30s for CoreDNS
`reload` plugin to pick up the change.

### 2. ArgoCD Repository Secret

Created `argocd-repo-k8s-gitea` secret in `argocd` namespace with
URL, username, password, type=git.

**Critical pitfall:** Secret existed but ArgoCD showed
`authentication required: Unauthorized` because the secret was NOT
labeled with `argocd.argoproj.io/secret-type=repository`. Without this
label, ArgoCD does not recognize the secret as a repository credential.

### 3. ArgoCD Application URL Patching

Patched all 7 Applications (root + 6 children) from
`http://10.0.30.105:3000/dominik/iac-homelab.git` to
`http://git.schoen.codes/dominik/iac-homelab.git` using
`kubectl patch --type json`.

### 4. Verification

- Root app: `Synced/Healthy` ✅
- Revision: commit hash from new Gitea ✅
- All child apps converging ✅

## Result

ArgoCD now pulls from K8s Gitea via:
```
ArgoCD → git.schoen.codes → CoreDNS → 10.0.30.203 (Cilium VIP)
    → Traefik DaemonSet → Gitea pod
```

The entire GitOps loop is self-contained in K8s. CT108 kept as fallback.

## Files Changed

- `clusters/main/operators/coredns-config.yaml` — CoreDNS HelmChartConfig
- `clusters/main/proxy/traefik-lb-service.yaml` — Traefik LoadBalancer VIP
- `clusters/main/proxy/namespace.yaml` — proxy namespace
- `clusters/main/apps/proxy.yaml` — ArgoCD app for proxy namespace
- `docs/plans/2026-07-14-traefik-ct99999-k8s-migration.md` — migration plan