GitOps & CI

What runs

• Argo CD deploys the cluster from git, as an app of apps in four groups:

  Group	Holds
  platform	Namespaces, kube-vip, Sealed Secrets, storage, the Postgres operator, cert-manager, backups
  obiwalker	The core: Postgres, Zitadel, Gitea
  tools	MinIO, pgAdmin, Tekton
  mcp	The MCP gateways

• Tekton runs CI. A push to Gitea starts a pipeline that clones the commit, builds its Dockerfile with Buildah, and pushes the image to Gitea's registry, tagged with the commit.

• Gitea is the git server and the container and Helm chart registry.

Why this choice

Git is the source of truth. Sync is automated with self-heal, so a manual change in the cluster is put back. Pruning is off, so removing something from git doesn't delete it from the cluster by accident.

Conventions are checked, not remembered. Every chart follows the same rules:

• Upstream versions are pinned.

• Shared namespaces belong to one foundation chart.

• Secrets are sealed.

• Every public app uses the same ingress and certificate resolver.

A small Go tool checks every chart against the rules, and starter charts give a new app the right shape from the beginning.

TODO: why Gitea and Tekton over GitHub and GitHub Actions.

Trade-offs and known limits

• Argo CD depends on what it deploys. It reaches git through Gitea, which needs storage and Postgres. A bad commit to one of those can cut Argo CD off from git, so the runbook has a recovery path.

• Argo CD itself is installed with Helm, not by Argo CD.

Next

• Reloader, so workloads restart when their config or secrets change.