# ArgoCD Application Consolidation Plan

## Executive Summary

**Current:** 39 Applications  
**Proposed:** 32 Applications (Conservative: 35)  
**Benefits:** Easier management, fewer Application resources, cleaner structure

## Phase 1: Safe & Easy Merges (Conservative - Start Here)

These are Applications that already share the same directory and have clear parent-child relationships.

### 1.1 Merge: wildcard-cert + homelab-ingress → "ingress-config"

**Current State:**
```
wildcard-cert      (wave 1) → k8s/bootstrap/ingress/riotpiao-com-cert.yaml
homelab-ingress    (wave 2) → k8s/bootstrap/ingress/ingress.yaml
```

**New State:**
```
ingress-config     (wave 1) → k8s/bootstrap/ingress/ (kustomization)
```

**Rationale:** Both in same directory, ingress depends on cert existing

**Implementation:**
- Update `k8s/bootstrap/ingress/kustomization.yaml` to include both
- Create single Application pointing to k8s/bootstrap/ingress/
- Delete wildcard-cert and homelab-ingress Applications
- Result: 2 → 1 Applications

### 1.2 Merge: homarr + homarr-patches → "homarr"

**Current State:**
```
homarr             (wave 8) → Helm chart (homarr-labs.github.io)
homarr-patches     (wave 9) → k8s/applications/homarr/fix-probes-job.yaml
```

**New State:**
```
homarr (multi-source):
  - Source 1: Helm chart
  - Source 2: k8s/applications/homarr/ (patches as PostSync hook)
```

**Rationale:** homarr-patches is literally a patch for homarr

**Implementation:**
- Modify homarr Application to use multi-source
- Convert fix-probes-job.yaml to PostSync hook
- Delete homarr-patches Application
- Result: 2 → 1 Applications

### 1.3 Merge: temporal-db-secret-sync → temporal (as PreSync hook)

**Current State:**
```
temporal-db-secret-sync  (wave 7) → k8s/applications/temporal/db-secret-sync/
temporal                 (wave 8) → Helm chart
```

**New State:**
```
temporal (multi-source):
  - Source 1: k8s/applications/temporal/db-secret-sync/ (PreSync hook)
  - Source 2: Helm chart
  - Source 3: k8s/applications/temporal/ (values)
```

**Rationale:** db-secret-sync is a bootstrap job for temporal

**Implementation:**
- Modify temporal Application to use multi-source
- Ensure db-secret-sync Job has PreSync hook annotation
- Delete temporal-db-secret-sync Application
- Result: 2 → 1 Applications

### 1.4 Merge: cert-manager-issuers → cert-manager (as multi-source)

**Current State:**
```
cert-manager         (wave 0) → Helm chart
cert-manager-issuers (wave 1) → k8s/bootstrap/cert-manager/ (issuers)
```

**New State:**
```
cert-manager (multi-source):
  - Source 1: Helm chart
  - Source 2: k8s/bootstrap/cert-manager/ (values + issuers)
```

**Rationale:** Issuers are part of cert-manager configuration

**Implementation:**
- Modify cert-manager Application to use multi-source
- Keep as wave 0 (issuers can wait for CRDs to be ready)
- Delete cert-manager-issuers Application
- Result: 2 → 1 Applications

**Phase 1 Result: 39 → 35 Applications (-4)**

---

## Phase 2: Logical Consolidations (Moderate Risk)

### 2.1 Merge: SQS Applications → "sqs-platform"

**Current State:**
```
strimzi-operator    (wave 5) → Helm chart (operator)
kmsvc-redis         (wave 5) → Helm chart (Redis)
kafka-cluster       (wave 6) → k8s/applications/sqs/charts/kafka-cluster/
queue-crd           (wave 6) → k8s/applications/sqs/charts/queue-crd/
management-service  (wave 7) → k8s/applications/sqs/charts/management-service/
```

**New State:**
```
strimzi-operator    (wave 5) → Keep separate (operator)
sqs-platform        (wave 6) → k8s/applications/sqs/ (all services + CRDs)
```

**Rationale:** These 4 apps work together as the SQS platform

**Implementation:**
- Create kustomization.yaml in k8s/applications/sqs/
- Create single multi-source Application
- Keep strimzi-operator separate (it's infrastructure)
- Result: 5 → 2 Applications

### 2.2 Merge: authentik + iam-jobs → "authentik"

**Current State:**
```
authentik   (wave 3) → Helm chart
iam-jobs    (wave 3) → k8s/security/iam/ (authentik helper jobs)
```

**New State:**
```
authentik (multi-source):
  - Source 1: Helm chart
  - Source 2: k8s/security/iam/ (helper jobs)
```

**Rationale:** iam-jobs appears to be authentik-specific

**Implementation:**
- Verify iam-jobs are authentik-specific
- Merge into single multi-source Application
- Result: 2 → 1 Applications

### 2.3 Remove Duplicate: ingress-nginx Application

**Current State:**
```
ingress-nginx-bootstrap (wave 0, bootstrap) → Helm chart
ingress-nginx           (wave 0, ArgoCD)    → Helm chart (DUPLICATE!)
```

**New State:**
```
ingress-nginx-bootstrap (wave 0, bootstrap) → Keep only this one
```

**Rationale:** These are the same thing, bootstrap one is already working

**Implementation:**
- Delete ingress-nginx Application (redundant)
- Result: 2 → 1 Applications

**Phase 2 Result: 35 → 31 Applications (-4)**

---

## Phase 3: Advanced Consolidations (Consider Carefully)

### 3.1 Consider: Monitoring Stack

**Current State:**
```
prometheus-crds     (wave 0) → k8s/platform/monitoring/crds/
prometheus          (wave 1) → Helm chart
blackbox-exporter   (wave 1) → Helm chart
```

**Option A:** Keep separate (CRDs must be wave 0)  
**Option B:** Create "monitoring-stack" with prometheus + blackbox-exporter only

**Recommendation:** Keep separate for now (CRDs are special)

### 3.2 Consider: Logging Stack

**Current State:**
```
loki     (wave 2) → Helm chart
promtail (wave 2) → Helm chart
grafana  (wave 2) → Helm chart
```

**Option A:** Create "logging-stack" with all three  
**Option B:** Keep separate (grafana used by multiple systems)

**Recommendation:** Keep separate for now (grafana has multiple consumers)

---

## Implementation Order

### Sprint 1: Phase 1 (Low Risk)
1. ✅ ingress-config (wildcard-cert + homelab-ingress)
2. ✅ homarr (merge homarr-patches)
3. ✅ temporal (merge db-secret-sync)
4. ✅ cert-manager (merge issuers)

### Sprint 2: Phase 2 (Moderate Risk)
5. ✅ Remove duplicate ingress-nginx
6. ✅ sqs-platform consolidation
7. ✅ authentik + iam-jobs

### Sprint 3: Phase 3 (Optional)
8. ⚠️ Evaluate monitoring stack consolidation
9. ⚠️ Evaluate logging stack consolidation

---

## File Changes Required

### For each consolidation:

1. **Update Application YAML** in `k8s/argocd/apps/*.yaml`
   - Convert single-source to multi-source
   - Update sync waves appropriately
   - Add hook annotations where needed

2. **Update kustomization.yaml** in target directories
   - Ensure all resources are listed
   - Verify namespace declarations

3. **Test locally:**
   ```bash
   kubectl kustomize k8s/bootstrap/ingress/
   helm template <chart> -f values.yaml
   ```

4. **Delete old Applications:**
   ```bash
   kubectl delete application <old-app> -n argocd
   ```

---

## Rollback Plan

Each consolidation is independent. If issues arise:

1. **Revert git commit** with the Application change
2. **Restore old Applications** from git history
3. **Force ArgoCD refresh:**
   ```bash
   kubectl delete application <new-merged-app> -n argocd
   kubectl apply -f k8s/argocd/apps/<old-wave-file>.yaml
   ```

---

## Success Metrics

**Before:** 39 Applications  
**After (Conservative):** 35 Applications  
**After (Full):** 31-32 Applications

**Benefits:**
- ✅ Easier to understand (related apps grouped)
- ✅ Fewer Application CRs to manage
- ✅ Cleaner ArgoCD UI
- ✅ Logical grouping by function
- ✅ Reduced sync complexity

**Risks:**
- ⚠️ Multi-source Applications are slightly more complex
- ⚠️ Sync wave ordering must be preserved
- ⚠️ Hook timing must be correct (PreSync/PostSync)

---

## Decision: Which Phase?

**Recommendation:** Start with **Phase 1 (Conservative)** → 35 Applications

This gives us:
- 4 fewer Applications to manage
- Low risk (same directories)
- Easy to understand merges
- Can evaluate Phase 2 later based on results

**Do you want to proceed with Phase 1 implementation?**