fix: force ServerSideApply on envoy-gateway Application

Gateway API CRDs (httproutes, envoyproxies) have schemas large enough that
client-side apply's last-applied-configuration annotation exceeds the
262144-byte annotation limit. SSA skips that annotation entirely.

.env.example

@@ -1,2 +0,0 @@
-# Generate with: htpasswd -nbBC 10 "" YOUR_PASSWORD | tr -d ':\n' | sed 's/$2y/$2a/'
-ARGOCD_ADMIN_PASSWORD_HASH=

README.md

@@ -46,27 +46,13 @@ helm version
 
 ---
 
-## Phase 2 — Set credentials
+## Phase 2 — Install tools
-
-Install tools (one-time):
 
 ```bash
-sudo dnf install -y httpd-tools gettext
+sudo dnf install -y httpd-tools
 ```
 
-Copy and fill in `.env`:
+`htpasswd` generates the admin password hash used in Phase 3.1.
-
-```bash
-cp .env.example .env
-```
-
-Generate bcrypt hash and set it in `.env`:
-
-```bash
-htpasswd -nbBC 10 "" YOUR_PASSWORD | tr -d ':\n' | sed 's/$2y/$2a/'
-```
-
-`.env` is gitignored — never commit it.
 
 ---
 
@@ -82,65 +68,45 @@ helm repo add argo https://argoproj.github.io/argo-helm
 helm repo update
 ```
 
-Install ArgoCD (`envsubst` fills `$ARGOCD_ADMIN_PASSWORD_HASH` from `.env` before helm reads the values):
+Install ArgoCD (`values.yaml` has no `configs.secret` block — chart auto-generates a random admin password):
 
 ```bash
-source .env
+helm install argocd argo/argo-cd -n argocd --create-namespace -f manifests/argocd/values.yaml
 ```
 
-```bash
+Wait for ready:
-envsubst < manifests/argocd/values.yaml | helm install argocd argo/argo-cd -n argocd --create-namespace -f -
-```
-
-Wait for ArgoCD to be ready:
 
 ```bash
 kubectl wait --for=condition=available deployment/argocd-server -n argocd --timeout=120s
 ```
 
-Port-forward to access UI (MetalLB + Envoy not running yet):
+(Optional) inspect manually: `kubectl port-forward svc/argocd-server -n argocd 8080:443` → `https://localhost:8080`. Not needed for bootstrap.
+
+### 3.1 Set admin password on the Secret
+
+Patched directly on `argocd-secret`, never in `values.yaml`/Git — keeps `configs.secret` absent so self-heal (wave -1) never touches it, password stays stable forever:
 
 ```bash
-kubectl port-forward svc/argocd-server -n argocd 8080:443
+read -s -p "ArgoCD admin password: " PW; echo
+HASH=$(htpasswd -nbBC 12 "" "$PW" | tr -d ':\n' | sed 's/$2y/$2a/')
+kubectl patch secret argocd-secret -n argocd --type merge -p \
+  "{\"stringData\":{\"admin.password\":\"$HASH\",\"admin.passwordMtime\":\"$(date -u +%FT%TZ)\"}}"
+unset PW HASH
 ```
 
-Open `https://localhost:8080` — login with `admin` and the password you chose.
+Rotate: repeat with new hash + new `admin.passwordMtime` (required for ArgoCD to accept the change).
-
-### 3.1 Bake the hash into values.yaml for self-management
-
-ArgoCD won't run `envsubst` when it self-manages — replace the placeholder with the real hash so future syncs work:
-
-```bash
-source .env
-sed -i "s|\$ARGOCD_ADMIN_PASSWORD_HASH|$ARGOCD_ADMIN_PASSWORD_HASH|" manifests/argocd/values.yaml
-```
-
-```bash
-git add manifests/argocd/values.yaml && git commit -m "set argocd admin password hash"
-```
-
-```bash
-git push origin main
-```
 
 ---
 
-## Phase 4 — Create bootstrap app in ArgoCD UI
+## Phase 4 — Apply the root bootstrap Application
 
-In ArgoCD UI, create a new Application:
+`bootstrap-app.yaml` (repo root) is the seed manifest, committed to Git — not created via UI/CLI. Only manifest ever applied by hand:
 
-| Field | Value |
+```bash
-|-------|-------|
+kubectl apply -f bootstrap-app.yaml
-| Application Name | `bootstrap` |
+```
-| Project | `default` |
-| Sync Policy | Automated (enable Prune + Self Heal) |
-| Repository URL | `https://gitea.fireflylab.cc/duynguyen/cluster-bootstrap.git` |
-| Revision | `main` |
-| Path | `bootstrap/apps` |
-| Cluster URL | `https://kubernetes.default.svc` |
-| Namespace | `argocd` |
 
-Click **Create**. ArgoCD syncs all child Applications in wave order automatically.
+ArgoCD syncs all child Applications in wave order automatically, including self-managing itself (`bootstrap/apps/argocd.yaml`, wave -1).
 
 Monitor progress:
 
@@ -273,6 +239,7 @@ All Applications should be `Synced` / `Healthy`.
 ```
 cluster-bootstrap/
 ├── README.md
+├── bootstrap-app.yaml                 # root seed Application — the only manifest applied by hand
 ├── bootstrap/
 │   └── apps/                         # ArgoCD Application CRDs
 │       ├── argocd.yaml               # wave -1 — self-managed ArgoCD

bootstrap-app.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: bootstrap
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-bootstrap.git
+    targetRevision: main
+    path: bootstrap/apps
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

bootstrap/apps/argocd.yaml

@@ -20,7 +20,3 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: argocd
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true

bootstrap/apps/envoy-gateway.yaml

@@ -8,7 +8,7 @@ metadata:
 spec:
   project: default
   sources:
-    - repoURL: https://charts.gateway.envoyproxy.io
+    - repoURL: docker.io/envoyproxy
       chart: gateway-helm
       targetRevision: "v1.7.1"
       helm:
@@ -26,3 +26,4 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
+      - ServerSideApply=true

bootstrap/apps/metallb.yaml

@@ -26,3 +26,9 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
+  ignoreDifferences:
+    - group: apiextensions.k8s.io
+      kind: CustomResourceDefinition
+      jsonPointers:
+        - /status
+        - /spec/conversion/webhook/clientConfig/caBundle

manifests/argocd/values.yaml

@@ -18,15 +18,12 @@ global:
 configs:
   params:
     server.insecure: true   # TLS terminated at Envoy Gateway
-  secret:
+  repositories:
-    argocdServerAdminPassword: "$ARGOCD_ADMIN_PASSWORD_HASH"
+    envoy-gateway-oci:
-    argocdServerAdminPasswordMtime: "2025-01-01T00:00:00Z"
+      url: docker.io/envoyproxy
+      name: envoy-gateway-oci
+      type: helm
+      enableOCI: "true"
 
 server:
   replicas: 1
-  httproute:
-    enabled: true
-    parentRefs:
-      - name: envoy-gateway
-        namespace: gateway-system
-        sectionName: http