# Argo CD examples

This directory is excluded from the packaged Helm chart. Its files are examples
for managing the chart from Argo CD.

## Application

[`application.yaml`](application.yaml) deploys:

- three Redis shards;
- one replica per shard;
- authenticated Redis with a chart-generated initial password;
- persistent volumes using the cluster's default StorageClass;
- internal-only Redis Services;
- RedisInsight connected automatically to the balanced bootstrap endpoint.

Apply it once:

```sh
kubectl apply -f argocd/application.yaml
```

Edit the destination namespace, target revision, and inline `valuesObject` as
needed. Because this file is not a Helm template, changing it in the Redis
Application's own repository does not change the live Application spec during a
normal sync. Reapply it, or manage it from an app-of-apps/ApplicationSet.

## Password Secret

For production GitOps, use an externally managed Secret and set:

```yaml
auth:
  enabled: true
  existingSecret: redis-auth
  existingSecretKey: redis-password
```

[`redis-auth-secret.example.yaml`](redis-auth-secret.example.yaml) documents the
required Secret shape. Do not commit an actual cleartext password.

If the chart generates the password, retain
`RespectIgnoreDifferences=true` and the Secret ignore rule from
`application.yaml`; Argo's Helm renderer cannot use `lookup` to read the live
Secret while comparing desired state.

## Enabling external access

Add this to `valuesObject`:

```yaml
externalAccess:
  enabled: true
  loadBalancerClass: ""
  loadBalancerSourceRanges:
    - 203.0.113.0/24
```

This creates one balanced bootstrap LoadBalancer and one LoadBalancer per Redis
member. Every advertised member address must be routable from external clients.

## Exposing RedisInsight with Istio

Add:

```yaml
redisInsight:
  enabled: true
  ingress:
    enabled: true
    host: redisinsight.example.com
    tls:
      enabled: true
      credentialName: redisinsight-tls
      certificate:
        create: true
        issuerName: letsencrypt-production
        issuerKind: ClusterIssuer
        secretNamespace: istio-system
```

Replace the hostname, issuer, gateway selector, and Secret namespace with values
from your environment. RedisInsight has no built-in ingress authentication; add
an identity-aware proxy or Istio authorization policy before exposing it.