apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: argo-workflows
  namespace: argo
spec:
  interval: 15m
  releaseName: argo-workflows
  targetNamespace: argo
  chart:
    spec:
      chart: argo-workflows
      version: 2.0.14
      sourceRef:
        kind: HelmRepository
        name: argo
        namespace: flux-system
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  values:
    images:
      tag: v4.1.6
      pullPolicy: IfNotPresent

    crds:
      install: true
      keep: true
      full: true
      upgradeJob:
        image:
          registry: quay.io
          repository: argoproj/argo-workflows-crdinstaller
          tag: v4.1.6@sha256:b9be70ef3f4a0709d771e9c098a99fd2d97be1b095c1b160c668a2fde61dc237
        resources:
          requests:
            cpu: 50m
            memory: 128Mi
          limits:
            memory: 256Mi

    singleNamespace: false

    workflow:
      serviceAccount:
        create: true
        name: argo-workflow
      rbac:
        create: true
        rules:
          - apiGroups: [""]
            resources: [secrets]
            resourceNames:
              - argo-artifacts
              - argo-internal-ca
            verbs: [get]

    controller:
      image:
        registry: quay.io
        repository: argoproj/workflow-controller
        tag: v4.1.6@sha256:a012a639ead374a4a9306093d6b29dfdc7e6c4c1a85c684582cb961a6cc8bcf3
      extraEnv:
        - name: WORKFLOW_USER_OVERRIDE_ALLOWLIST
          value: synchronization
      replicas: 2
      pdb:
        enabled: true
        minAvailable: 1
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app.kubernetes.io/name: argo-workflows-workflow-controller
                  app.kubernetes.io/instance: argo-workflows
              topologyKey: kubernetes.io/hostname
      workflowNamespaces:
        - argo
        - argo-opnsense-certificate
      workflowRestrictions:
        templateReferencing: Secure
      resources:
        requests:
          cpu: 100m
          memory: 256Mi
        limits:
          memory: 1Gi
      securityContext:
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        allowPrivilegeEscalation: false
        capabilities:
          drop:
            - ALL
      persistence:
        archive: true
        archiveTTL: 30d
        nodeStatusOffLoad: true
        connectionPool:
          maxIdleConns: 100
          maxOpenConns: 0
        postgresql:
          host: main-rw.postgres.svc.cluster.local
          port: 5432
          database: argo
          tableName: argo_workflows
          userNameSecret:
            name: argo-db
            key: username
          passwordSecret:
            name: argo-db
            key: password
          ssl: true
          sslMode: require
      workflowDefaults:
        metadata:
          labels:
            app.kubernetes.io/part-of: argo-workflows
        spec:
          serviceAccountName: argo-workflow
          podMetadata:
            labels:
              app.kubernetes.io/name: argo-workflow
              app.kubernetes.io/instance: argo-workflows
          ttlStrategy:
            secondsAfterSuccess: 86400
            secondsAfterFailure: 259200
            secondsAfterCompletion: 604800
          securityContext:
            runAsNonRoot: true
            runAsUser: 1000
            seccompProfile:
              type: RuntimeDefault

    executor:
      image:
        registry: quay.io
        repository: argoproj/argoexec
        tag: v4.1.6@sha256:28432d912a716167709429b28e2755f49416eb4754c35ca3013863fb72717a00
      resources:
        requests:
          cpu: 10m
          memory: 64Mi
        limits:
          memory: 256Mi
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        runAsUser: 8737
        capabilities:
          drop:
            - ALL

    mainContainer:
      resources:
        requests:
          cpu: 50m
          memory: 64Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
            - ALL

    server:
      enabled: true
      image:
        registry: quay.io
        repository: argoproj/argocli
        tag: v4.1.6@sha256:acb4c1de9a9c5fa109fb3094eebbc3eac42d2dd328181b0a395488cc97de75e5
      replicas: 2
      pdb:
        enabled: true
        minAvailable: 1
      authModes:
        - server
      secure: false
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app.kubernetes.io/name: argo-workflows-server
                  app.kubernetes.io/instance: argo-workflows
              topologyKey: kubernetes.io/hostname
      resources:
        requests:
          cpu: 50m
          memory: 128Mi
        limits:
          memory: 512Mi
      securityContext:
        readOnlyRootFilesystem: false
        runAsNonRoot: true
        allowPrivilegeEscalation: false
        capabilities:
          drop:
            - ALL

    useStaticCredentials: true
    artifactRepository:
      archiveLogs: false
      s3:
        bucket: argo-workflows
        endpoint: s3.quorate.internal
        region: us-east-1
        insecure: false
        accessKeySecret:
          name: argo-artifacts
          key: accesskey
        secretKeySecret:
          name: argo-artifacts
          key: secretkey
        caSecret:
          name: argo-internal-ca
          key: internal-ca.crt
        keyFormat: "artifacts/{{workflow.namespace}}/{{workflow.name}}/{{pod.name}}"