# Argo CD Core on railiance01 — declared state

Owner: `railiance-enablement` (S4). ArgoCD is an S4 concern per
railiance-infra (RAIL-HO-WP-0004 service inventory). Settled as
ArchitectureBlueprint §5.6 option 1, **adopt properly** (founder,
`GOVERN @ estate`, 2026-09-21).

| Item | Value |
|---|---|
| Distribution | upstream Argo CD **Core** (headless: no API server, UI or Dex) |
| Version | `v3.5.3` |
| Manifest | `core-install.yaml` at tag `v3.5.3` (URL in `PIN`) |
| sha256 | `1a87025d8eb2eae621653fd312fb9ca51df1b4b3b6992a030e3a9ef38e45c448` |
| Images | `quay.io/argoproj/argocd:v3.5.3`, `public.ecr.aws/docker/library/redis:8.2.3-alpine` |
| Namespace | `argocd` (created 2026-09-21T13:55:29Z) |
| Objects | 34, server-side applied, field manager `kubectl` |
| Applications / AppProjects | none (nothing adopted) |
| Listeners | no LoadBalancer or NodePort Service (ADR-0008) |

The live install was a direct `ADMINISTER @ realm:kubernetes/railiance01`,
`activation=APPROVED` by the founder, performed by the custodian session on
2026-09-21 (record: `the-custodian/docs/kubernetes-change-gate-decision.md`).
This directory is its declared state. Evidence: `target-audited` for the
install itself; this repository adds `external-audited` evidence from here on.

## Files

- `PIN` — pinned manifest URL, version, sha256 (included by the Makefile).
- `kustomization.yaml` — pinned upstream plus `resources.yaml`.
- `resources.yaml` — requests and limits for the four workloads.
  **Declared, not yet applied** (RAIL-EN-WP-0002-T02).
- `upstream/` — fetched manifest, gitignored; `make argocd-fetch` verifies it.

## Read-only commands

```bash
make argocd-fetch    # download + sha256 check
make argocd-render   # render declared state locally
make argocd-diff     # server-side diff against railiance01 (read-only)
```

## Install (as performed 2026-09-21, pinned upstream, no resources patch)

```bash
make argocd-fetch
ssh railiance01 'kubectl create namespace argocd'
ssh railiance01 'kubectl apply --server-side --dry-run=server -n argocd -f -' \
  < deploy/argocd/railiance01/upstream/core-install.yaml
ssh railiance01 'kubectl apply --server-side -n argocd -f -' \
  < deploy/argocd/railiance01/upstream/core-install.yaml
```

## Apply the declared state (includes resources) — needs founder go-ahead

```bash
make argocd-diff     # expect: only resources on the 4 workloads
kubectl kustomize deploy/argocd/railiance01 \
  | ssh railiance01 'kubectl apply --server-side -n argocd -f -'
ssh railiance01 'kubectl -n argocd rollout status sts/argocd-application-controller deploy/argocd-repo-server deploy/argocd-applicationset-controller deploy/argocd-redis'
```

## Rollback

Resources only (return to upstream BestEffort):

```bash
ssh railiance01 'kubectl apply --server-side -n argocd -f -' \
  < deploy/argocd/railiance01/upstream/core-install.yaml
```

Whole install (nothing else depends on it while there are 0 Applications):

```bash
ssh railiance01 'kubectl delete namespace argocd'
ssh railiance01 'kubectl delete crd applications.argoproj.io applicationsets.argoproj.io appprojects.argoproj.io'
```

The upstream core manifest also creates one ClusterRole and one
ClusterRoleBinding (`argocd-application-controller`). For a clean cluster,
delete everything it declares first:
`ssh railiance01 'kubectl delete -n argocd -f -' < deploy/argocd/railiance01/upstream/core-install.yaml`,
then the namespace.