First Commit

argocd/README.md

@@ -0,0 +1,84 @@
+# Argo CD examples
+
+This directory is excluded from the packaged Helm chart. Its files are examples
+for managing the chart from Argo CD.
+
+## Application
+
+[`application.yaml`](application.yaml) deploys:
+
+- three Redis shards;
+- one replica per shard;
+- authenticated Redis with a chart-generated initial password;
+- persistent volumes using the cluster's default StorageClass;
+- internal-only Redis Services;
+- RedisInsight connected automatically to the balanced bootstrap endpoint.
+
+Apply it once:
+
+```sh
+kubectl apply -f argocd/application.yaml
+```
+
+Edit the destination namespace, target revision, and inline `valuesObject` as
+needed. Because this file is not a Helm template, changing it in the Redis
+Application's own repository does not change the live Application spec during a
+normal sync. Reapply it, or manage it from an app-of-apps/ApplicationSet.
+
+## Password Secret
+
+For production GitOps, use an externally managed Secret and set:
+
+```yaml
+auth:
+  enabled: true
+  existingSecret: redis-auth
+  existingSecretKey: redis-password
+```
+
+[`redis-auth-secret.example.yaml`](redis-auth-secret.example.yaml) documents the
+required Secret shape. Do not commit an actual cleartext password.
+
+If the chart generates the password, retain
+`RespectIgnoreDifferences=true` and the Secret ignore rule from
+`application.yaml`; Argo's Helm renderer cannot use `lookup` to read the live
+Secret while comparing desired state.
+
+## Enabling external access
+
+Add this to `valuesObject`:
+
+```yaml
+externalAccess:
+  enabled: true
+  loadBalancerClass: ""
+  loadBalancerSourceRanges:
+    - 203.0.113.0/24
+```
+
+This creates one balanced bootstrap LoadBalancer and one LoadBalancer per Redis
+member. Every advertised member address must be routable from external clients.
+
+## Exposing RedisInsight with Istio
+
+Add:
+
+```yaml
+redisInsight:
+  enabled: true
+  ingress:
+    enabled: true
+    host: redisinsight.example.com
+    tls:
+      enabled: true
+      credentialName: redisinsight-tls
+      certificate:
+        create: true
+        issuerName: letsencrypt-production
+        issuerKind: ClusterIssuer
+        secretNamespace: istio-system
+```
+
+Replace the hostname, issuer, gateway selector, and Secret namespace with values
+from your environment. RedisInsight has no built-in ingress authentication; add
+an identity-aware proxy or Istio authorization policy before exposing it.