argocd

Argo CD is the GitOps reconciliation engine for the whole cluster ([CT-004 GitOps single source of truth ]). It watches this Git repository and applies the desired state automatically (prune + selfHeal), so that the live cluster always converges back to what is committed here.

Applications inside the argocd building block.
Figure 1. Applications inside the argocd building block.
Application Chart / Source Namespace Purpose

argocd

argo-cd 10.3.3 (argoproj.github.io/argo-helm)

argocd

Argo CD server, repo-server, application-controller and Dex/OIDC configuration (oidc.config against Keycloak realm k8s, see Single Sign-On).

argocd-resources

raw manifests (pandur/argocd/resources)

argocd

AppProject`s (`kaiserpfalz-edv, paladins-inn, torg-codex), the auto-applications.yml ApplicationSet that onboards sibling GitOps repositories, managed Namespace`s, Helm repository credentials, and the `cluster-gitops self-management Application.

hccm

hcloud-cloud-controller-manager 1.35.0 (charts.hetzner.cloud)

kube-system

Hetzner Cloud Controller Manager. Sets each node’s providerID/podCIDR, manages LoadBalancer-type Service`s (e.g. Traefik’s), and reconciles Hetzner Cloud routes. Installed once via `helm upgrade --install during bootstrap (before Argo CD exists, since nodes need it to become Ready) and adopted into GitOps as this Application immediately afterwards — see 7. Deployment View.
Multi-tenancy

Argo CD AppProject`s scope RBAC per organization (`kaiserpfalz-edv, paladins-inn, torg-codex); each project’s Argo CD policy (policy.<project>.csv) maps Keycloak groups to Argo CD roles with view/edit permissions restricted to that project’s applications.