From 2333310c38ee45f41404fab2fc8e9acd230e9646 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Tue, 11 Aug 2026 21:03:59 -0700
Subject: [PATCH] fix(argocd): resolve 502 on argocd.riotpiao.com, dedupe
 Ingress and TLS mode mismatch

argocd-server ran --insecure (plain HTTP :8080) while its Helm-managed
Ingress set ssl-passthrough: true, which sends nginx's raw TLS handshake
straight to the pod - HTTP server can't complete a TLS handshake, nginx
logged 502 (peer closed connection in SSL handshake). Compounded by a
second, conflicting Ingress for the same host in
k8s/bootstrap/ingress/ingress.yaml - two Ingress objects on one host is
undefined nginx routing behavior. Disabled the Helm-managed Ingress
(enabled: false) so ingress.yaml's passthrough Ingress is the sole
source of truth, and set server.insecure: false so argocd-server
actually terminates TLS itself, matching passthrough's requirement.
---
 .../phase4-argocd/argocd-values.yaml          | 22 +++++--------------
 1 file changed, 5 insertions(+), 17 deletions(-)

diff --git a/k8s/bootstrap/phase4-argocd/argocd-values.yaml b/k8s/bootstrap/phase4-argocd/argocd-values.yaml
index da7cf00..13dec33 100644
--- a/k8s/bootstrap/phase4-argocd/argocd-values.yaml
+++ b/k8s/bootstrap/phase4-argocd/argocd-values.yaml
@@ -6,23 +6,11 @@ global:
 
 # Server configuration
 server:
+  # Ingress is managed declaratively in k8s/bootstrap/ingress/ingress.yaml
+  # (ssl-passthrough) instead of here — two Ingress objects for the same
+  # host caused undefined nginx routing behavior (502s). Do not re-enable.
   ingress:
-    enabled: true
-    ingressClassName: nginx
-    annotations:
-      cert-manager.io/cluster-issuer: letsencrypt-prod
-      nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-      nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
-    hosts:
-      - argocd.riotpiao.com
-    tls:
-      - secretName: argocd-server-tls
-        hosts:
-          - argocd.riotpiao.com
-
-  # Allow insecure mode (terminate TLS at ingress)
-  extraArgs:
-    - --insecure
+    enabled: false
 
   resources:
     requests:
@@ -152,7 +140,7 @@ configs:
     application.instanceLabelKey: argocd.argoproj.io/instance
     
   params:
-    server.insecure: true
+    server.insecure: false
 
   # RBAC (allow admin full access)
   rbac: