fix(bootstrap): correct cluster config + complete Phase4 ArgoCD bootstrap permanent fixes

k8s/bootstrap/phase4-argocd/argocd-cmp-cm.yaml

@@ -0,0 +1,34 @@
+# ArgoCD CMP plugin for SOPS secret decryption
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cmp-cm
+  namespace: argocd
+data:
+  sops-secrets-v1.0.yaml: |
+    apiVersion: argoproj.io/v1alpha1
+    kind: ConfigManagementPlugin
+    metadata:
+      name: sops-secrets-v1.0
+    spec:
+      version: v1.0
+      init:
+        command: [sh, -c]
+        args:
+          - |
+            # Install sops if not present
+            if ! command -v sops &> /dev/null; then
+              wget -qO- https://github.com/getsops/sops/releases/download/v3.9.3/sops-v3.9.3.linux.amd64 > /usr/local/bin/sops
+              chmod +x /usr/local/bin/sops
+            fi
+      generate:
+        command: [sh, -c]
+        args:
+          - |
+            # Find all .enc.yaml files and decrypt them
+            find . -name '*.enc.yaml' -type f | while read -r file; do
+              sops -d "$file"
+            done
+      discover:
+        find:
+          glob: "**/*.enc.yaml"

k8s/bootstrap/phase4-argocd/argocd-values.yaml

@@ -1,4 +1,4 @@
-# ArgoCD Helm Values — Single Source of Truth
+# ArgoCD Helm Values — Bootstrap Mode (SOPS plugin added post-bootstrap)
 # Chart: https://github.com/argoproj/argo-helm
 
 global:
@@ -32,6 +32,12 @@ server:
       cpu: 500m
       memory: 1Gi
 
+  # Tolerations for control-plane
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+
 # Repo server configuration
 repoServer:
   resources:
@@ -42,21 +48,11 @@ repoServer:
       cpu: 500m
       memory: 1Gi
 
-  # SOPS plugin for encrypted secrets
-  volumes:
-    - name: sops-age
-      secret:
-        secretName: sops-age
-        optional: true
-  volumeMounts:
-    - name: sops-age
-      mountPath: /home/argocd/.config/sops/age
-      readOnly: true
-
-  # Environment for SOPS
-  env:
-    - name: SOPS_AGE_KEY_FILE
-      value: /home/argocd/.config/sops/age/keys.txt
+  # Tolerations for control-plane
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
 
 # Controller configuration
 controller:
@@ -68,6 +64,12 @@ controller:
       cpu: 1000m
       memory: 2Gi
 
+  # Tolerations for control-plane
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+
 # Application controller configuration
 applicationSet:
   enabled: true
@@ -87,26 +89,7 @@ redis:
       cpu: 200m
       memory: 256Mi
 
-# Tolerations for control-plane
-server:
-  tolerations:
-    - key: node-role.kubernetes.io/control-plane
-      operator: Exists
-      effect: NoSchedule
-
-repoServer:
-  tolerations:
-    - key: node-role.kubernetes.io/control-plane
-      operator: Exists
-      effect: NoSchedule
-
-controller:
-  tolerations:
-    - key: node-role.kubernetes.io/control-plane
-      operator: Exists
-      effect: NoSchedule
-
-# ArgoCD projects
+# ArgoCD configuration
 configs:
   # Default project allows all repos
   cm:
@@ -116,8 +99,7 @@ configs:
   params:
     server.insecure: true
 
-# RBAC (allow admin full access)
-configs:
+  # RBAC (allow admin full access)
   rbac:
     policy.default: role:readonly
     policy.csv: |