From c6032cc3548a3a53f507d942508e12ba396d7371 Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Wed, 2 Sep 2026 20:31:09 -0700
Subject: [PATCH] argocd: add Image Updater for auto-deploy on image push

- Install argocd-image-updater via Helm (wave 1)
- Configure Forgejo registry (anonymous pulls)
- Annotate apps for auto-update: api-gw, portfolio, management-service, queue-crd
- Uses newest-build strategy for commit SHA tags
---
 k8s/argocd/apps/01-image-updater.yaml      | 33 ++++++++++++++++++++
 k8s/argocd/apps/50-messaging.yaml          |  8 +++++
 k8s/argocd/apps/55-api-gateway.yaml        |  4 +++
 k8s/argocd/apps/60-applications.yaml       |  4 +++
 k8s/infra/argocd-image-updater/values.yaml | 35 ++++++++++++++++++++++
 5 files changed, 84 insertions(+)
 create mode 100644 k8s/argocd/apps/01-image-updater.yaml
 create mode 100644 k8s/infra/argocd-image-updater/values.yaml

diff --git a/k8s/argocd/apps/01-image-updater.yaml b/k8s/argocd/apps/01-image-updater.yaml
new file mode 100644
index 0000000..7af6cce
--- /dev/null
+++ b/k8s/argocd/apps/01-image-updater.yaml
@@ -0,0 +1,33 @@
+# ArgoCD Image Updater - auto-updates Application images from registry
+# Watches forgejo.riotpiao.com for new image tags and updates Applications
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: argocd-image-updater
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: homelab
+  revisionHistoryLimit: 3
+  sources:
+    - repoURL: https://argoproj.github.io/argo-helm
+      chart: argocd-image-updater
+      targetRevision: "0.11.2"
+      helm:
+        valueFiles:
+          - $values/k8s/infra/argocd-image-updater/values.yaml
+    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=false
diff --git a/k8s/argocd/apps/50-messaging.yaml b/k8s/argocd/apps/50-messaging.yaml
index a0fb3e2..49d8811 100644
--- a/k8s/argocd/apps/50-messaging.yaml
+++ b/k8s/argocd/apps/50-messaging.yaml
@@ -86,6 +86,10 @@ metadata:
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "6"
+    # ArgoCD Image Updater - auto-update on new image push
+    argocd-image-updater.argoproj.io/image-list: op=forgejo.riotpiao.com/rock/kmsvc-manage
+    argocd-image-updater.argoproj.io/op.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/write-back-method: argocd
 spec:
   project: homelab
   source:
@@ -107,6 +111,10 @@ metadata:
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "7"
+    # ArgoCD Image Updater - auto-update on new image push
+    argocd-image-updater.argoproj.io/image-list: svc=forgejo.riotpiao.com/rock/kmsvc-manage
+    argocd-image-updater.argoproj.io/svc.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/write-back-method: argocd
 spec:
   project: homelab
   source:
diff --git a/k8s/argocd/apps/55-api-gateway.yaml b/k8s/argocd/apps/55-api-gateway.yaml
index ff3f028..791ac58 100644
--- a/k8s/argocd/apps/55-api-gateway.yaml
+++ b/k8s/argocd/apps/55-api-gateway.yaml
@@ -36,6 +36,10 @@ metadata:
     app.kubernetes.io/component: gateway
   annotations:
     argocd.argoproj.io/sync-wave: "7"
+    # ArgoCD Image Updater - auto-update on new image push
+    argocd-image-updater.argoproj.io/image-list: gw=forgejo.riotpiao.com/rock/api-gateway
+    argocd-image-updater.argoproj.io/gw.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/write-back-method: argocd
 spec:
   project: homelab
   revisionHistoryLimit: 3
diff --git a/k8s/argocd/apps/60-applications.yaml b/k8s/argocd/apps/60-applications.yaml
index fa80286..b24bc3d 100644
--- a/k8s/argocd/apps/60-applications.yaml
+++ b/k8s/argocd/apps/60-applications.yaml
@@ -246,6 +246,10 @@ metadata:
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "8"
+    # ArgoCD Image Updater - auto-update on new image push
+    argocd-image-updater.argoproj.io/image-list: app=forgejo.riotpiao.com/rock/portfolio
+    argocd-image-updater.argoproj.io/app.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/write-back-method: argocd
 spec:
   project: homelab
   source:
diff --git a/k8s/infra/argocd-image-updater/values.yaml b/k8s/infra/argocd-image-updater/values.yaml
new file mode 100644
index 0000000..361cfab
--- /dev/null
+++ b/k8s/infra/argocd-image-updater/values.yaml
@@ -0,0 +1,35 @@
+# ArgoCD Image Updater configuration
+# Watches Forgejo registry and updates ArgoCD Applications with new image tags
+
+config:
+  # Registry configuration - Forgejo allows anonymous pulls
+  registries:
+    - name: forgejo
+      api_url: https://forgejo.riotpiao.com
+      prefix: forgejo.riotpiao.com
+      default: true
+      insecure: false
+
+  # Log level
+  logLevel: debug
+
+  # ArgoCD API server
+  argocd:
+    grpcWeb: true
+    serverAddress: argocd-server.argocd.svc.cluster.local
+    insecure: true
+    plaintext: true
+
+# Extra environment variables
+extraEnv:
+  - name: ARGOCD_GRPC_WEB
+    value: "true"
+
+# Resources
+resources:
+  requests:
+    cpu: 50m
+    memory: 64Mi
+  limits:
+    cpu: 200m
+    memory: 128Mi