fix(bootstrap): correct cluster config + complete Phase4 ArgoCD bootstrap permanent fixes

k8s/bootstrap/phase4-argocd/argocd-values.yaml

@@ -1,4 +1,4 @@
-# ArgoCD Helm Values — Single Source of Truth
+# ArgoCD Helm Values — Bootstrap Mode (SOPS plugin added post-bootstrap)
 # Chart: https://github.com/argoproj/argo-helm
 
 global:
@@ -32,6 +32,12 @@ server:
       cpu: 500m
       memory: 1Gi
 
+  # Tolerations for control-plane
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+
 # Repo server configuration
 repoServer:
   resources:
@@ -42,21 +48,11 @@ repoServer:
       cpu: 500m
       memory: 1Gi
 
-  # SOPS plugin for encrypted secrets
-  volumes:
-    - name: sops-age
-      secret:
-        secretName: sops-age
-        optional: true
-  volumeMounts:
-    - name: sops-age
-      mountPath: /home/argocd/.config/sops/age
-      readOnly: true
-
-  # Environment for SOPS
-  env:
-    - name: SOPS_AGE_KEY_FILE
-      value: /home/argocd/.config/sops/age/keys.txt
+  # Tolerations for control-plane
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
 
 # Controller configuration
 controller:
@@ -68,6 +64,12 @@ controller:
       cpu: 1000m
       memory: 2Gi
 
+  # Tolerations for control-plane
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+
 # Application controller configuration
 applicationSet:
   enabled: true
@@ -87,26 +89,7 @@ redis:
       cpu: 200m
       memory: 256Mi
 
-# Tolerations for control-plane
-server:
-  tolerations:
-    - key: node-role.kubernetes.io/control-plane
-      operator: Exists
-      effect: NoSchedule
-
-repoServer:
-  tolerations:
-    - key: node-role.kubernetes.io/control-plane
-      operator: Exists
-      effect: NoSchedule
-
-controller:
-  tolerations:
-    - key: node-role.kubernetes.io/control-plane
-      operator: Exists
-      effect: NoSchedule
-
-# ArgoCD projects
+# ArgoCD configuration
 configs:
   # Default project allows all repos
   cm:
@@ -116,8 +99,7 @@ configs:
   params:
     server.insecure: true
 
-# RBAC (allow admin full access)
-configs:
+  # RBAC (allow admin full access)
   rbac:
     policy.default: role:readonly
     policy.csv: |