From 60e0f2b4ab075dc89337001c3726e589893cdeef Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Tue, 30 Jul 2024 13:03:29 +0200
Subject: [PATCH 01/50] test

---
 charts/argocd-apps/Chart.yaml                 |  6 +++++
 charts/argocd-apps/templates/wbaas-ui.yaml    | 27 +++++++++++++++++++
 charts/argocd-apps/values.yaml                |  3 +++
 charts/argocd-config/.helmignore              | 23 ++++++++++++++++
 charts/argocd-config/Chart.yaml               |  6 +++++
 .../argocd-config/templates/applications.yaml | 22 +++++++++++++++
 charts/argocd-config/templates/projects.yaml  | 12 +++++++++
 .../argocd-config/templates/repositories.yaml | 12 +++++++++
 charts/argocd-config/values.yaml              |  3 +++
 k8s/helmfile/helmfile.yaml                    | 10 +++++++
 10 files changed, 124 insertions(+)
 create mode 100644 charts/argocd-apps/Chart.yaml
 create mode 100644 charts/argocd-apps/templates/wbaas-ui.yaml
 create mode 100644 charts/argocd-apps/values.yaml
 create mode 100644 charts/argocd-config/.helmignore
 create mode 100644 charts/argocd-config/Chart.yaml
 create mode 100644 charts/argocd-config/templates/applications.yaml
 create mode 100644 charts/argocd-config/templates/projects.yaml
 create mode 100644 charts/argocd-config/templates/repositories.yaml
 create mode 100644 charts/argocd-config/values.yaml

diff --git a/charts/argocd-apps/Chart.yaml b/charts/argocd-apps/Chart.yaml
new file mode 100644
index 000000000..f44ab6518
--- /dev/null
+++ b/charts/argocd-apps/Chart.yaml
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: argocd-apps
+description: Chart to deploy WBaaS apps in an "app-of-apps" pattern via ArgoCD
+type: application
+version: 0.1.0
+appVersion: "1.0"
diff --git a/charts/argocd-apps/templates/wbaas-ui.yaml b/charts/argocd-apps/templates/wbaas-ui.yaml
new file mode 100644
index 000000000..ea50e06d1
--- /dev/null
+++ b/charts/argocd-apps/templates/wbaas-ui.yaml
@@ -0,0 +1,27 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ui
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    namespace: default
+    server: {{ .Values.clusterUrl }}
+  project: default
+  source:
+    path: charts/ui
+    repoURL: {{ .Values.repoUrls.charts }}
+    targetRevision: test/value-files
+    helm:
+      parameters:
+        - name: helm.debug
+          value: "true"
+      valueFiles:
+        - "values.local.yaml"
+
+  syncPolicy:
+    automated:
+      selfHeal: false
+      prune: true
\ No newline at end of file
diff --git a/charts/argocd-apps/values.yaml b/charts/argocd-apps/values.yaml
new file mode 100644
index 000000000..329feefc0
--- /dev/null
+++ b/charts/argocd-apps/values.yaml
@@ -0,0 +1,3 @@
+clusterUrl: https://kubernetes.default.svc
+
+environment: production
diff --git a/charts/argocd-config/.helmignore b/charts/argocd-config/.helmignore
new file mode 100644
index 000000000..691fa13d6
--- /dev/null
+++ b/charts/argocd-config/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
\ No newline at end of file
diff --git a/charts/argocd-config/Chart.yaml b/charts/argocd-config/Chart.yaml
new file mode 100644
index 000000000..31aa52408
--- /dev/null
+++ b/charts/argocd-config/Chart.yaml
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: argocd-apps
+description: The argo-cd apps configuration for wikibase.cloud
+type: application
+version: 0.1.0
+appVersion: "0.0.1"
diff --git a/charts/argocd-config/templates/applications.yaml b/charts/argocd-config/templates/applications.yaml
new file mode 100644
index 000000000..46e1de028
--- /dev/null
+++ b/charts/argocd-config/templates/applications.yaml
@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: app-of-apps
+spec:
+  destination:
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    path: charts/argocd-apps
+    repoURL: {{ .Values.repoUrls.main }}
+    targetRevision: de/argo-ui-simple # debug! needs to be set to HEAD
+    helm:
+      parameters:
+        - name: helm.debug
+          value: "true"
+      values: |
+{{ toYaml .Values | indent 8 }}
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: false
\ No newline at end of file
diff --git a/charts/argocd-config/templates/projects.yaml b/charts/argocd-config/templates/projects.yaml
new file mode 100644
index 000000000..7d96ef114
--- /dev/null
+++ b/charts/argocd-config/templates/projects.yaml
@@ -0,0 +1,12 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: local
+spec:
+  description: The local deployment of wikibase.cloud
+  destinations:
+  - name: in-cluster
+    server: https://kubernetes.default.svc
+  sourceRepos:
+  - {{ .Values.repoUrls.main }}
+  - {{ .Values.repoUrls.charts }}
\ No newline at end of file
diff --git a/charts/argocd-config/templates/repositories.yaml b/charts/argocd-config/templates/repositories.yaml
new file mode 100644
index 000000000..0409db802
--- /dev/null
+++ b/charts/argocd-config/templates/repositories.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    argocd.argoproj.io/secret-type: repository
+  name: repo-charts
+  namespace: argocd
+type: Opaque
+data:
+  project: {{ "local" | b64enc }}
+  type: {{ "git" | b64enc }}
+  url: {{ .Values.repoUrls.main | b64enc }}
diff --git a/charts/argocd-config/values.yaml b/charts/argocd-config/values.yaml
new file mode 100644
index 000000000..80d12ba1f
--- /dev/null
+++ b/charts/argocd-config/values.yaml
@@ -0,0 +1,3 @@
+repoUrls:
+  main: https://github.com/wmde/wbaas-deploy
+  charts: https://github.com/wbstack/charts.git
diff --git a/k8s/helmfile/helmfile.yaml b/k8s/helmfile/helmfile.yaml
index 71d2e7e4d..c1e9d3591 100644
--- a/k8s/helmfile/helmfile.yaml
+++ b/k8s/helmfile/helmfile.yaml
@@ -104,6 +104,16 @@ releases:
   ################################
   # ALL ENVIRONMENTS
   ################################
+  - name: argocd-config
+    namespace: argocd
+    chart: ../../charts/argocd-config
+    values:
+      - env/{{`{{ .Environment.Name }}`}}/base.yaml
+      - env/{{`{{ .Environment.Name }}`}}/private.yaml
+      - env/production/{{`{{ .Release.Name }}`}}.values.yaml.gotmpl
+      - env/{{`{{ .Environment.Name }}`}}/{{`{{ .Release.Name }}`}}.values.yaml.gotmpl
+    installed: {{ eq .Environment.Name "local" | toYaml }}
+
   - name: redirects
     namespace: default
     chart: ./../../charts/redirects

From a52e209c48afbacb3016505a4f75cc4fd6dcc7c4 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Tue, 30 Jul 2024 13:10:31 +0200
Subject: [PATCH 02/50] add env config

---
 k8s/helmfile/env/local/argocd-config.values.yaml.gotmpl      | 2 ++
 k8s/helmfile/env/production/argocd-config.values.yaml.gotmpl | 2 ++
 k8s/helmfile/env/staging/argocd-config.values.yaml.gotmpl    | 2 ++
 3 files changed, 6 insertions(+)
 create mode 100644 k8s/helmfile/env/local/argocd-config.values.yaml.gotmpl
 create mode 100644 k8s/helmfile/env/production/argocd-config.values.yaml.gotmpl
 create mode 100644 k8s/helmfile/env/staging/argocd-config.values.yaml.gotmpl

diff --git a/k8s/helmfile/env/local/argocd-config.values.yaml.gotmpl b/k8s/helmfile/env/local/argocd-config.values.yaml.gotmpl
new file mode 100644
index 000000000..77513ccac
--- /dev/null
+++ b/k8s/helmfile/env/local/argocd-config.values.yaml.gotmpl
@@ -0,0 +1,2 @@
+environment: local
+
diff --git a/k8s/helmfile/env/production/argocd-config.values.yaml.gotmpl b/k8s/helmfile/env/production/argocd-config.values.yaml.gotmpl
new file mode 100644
index 000000000..d3e915908
--- /dev/null
+++ b/k8s/helmfile/env/production/argocd-config.values.yaml.gotmpl
@@ -0,0 +1,2 @@
+environment: production
+
diff --git a/k8s/helmfile/env/staging/argocd-config.values.yaml.gotmpl b/k8s/helmfile/env/staging/argocd-config.values.yaml.gotmpl
new file mode 100644
index 000000000..21e54ef69
--- /dev/null
+++ b/k8s/helmfile/env/staging/argocd-config.values.yaml.gotmpl
@@ -0,0 +1,2 @@
+environment: staging
+

From 0be0109563ba06b51e954269eaf63b64503a6dff Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 15:34:47 +0200
Subject: [PATCH 03/50] read values form deploy repo

---
 charts/argocd-apps/templates/wbaas-ui.yaml    | 23 +++++++------
 .../argocd-config/templates/applications.yaml |  2 +-
 charts/argocd-config/templates/projects.yaml  |  2 +-
 .../argocd-config/templates/repositories.yaml |  2 +-
 charts/argocd-config/values.yaml              |  2 +-
 k8s/argocd/local/ui.values.yaml               | 33 +++++++++++++++++++
 6 files changed, 50 insertions(+), 14 deletions(-)
 create mode 100644 k8s/argocd/local/ui.values.yaml

diff --git a/charts/argocd-apps/templates/wbaas-ui.yaml b/charts/argocd-apps/templates/wbaas-ui.yaml
index ea50e06d1..4cbbd69d4 100644
--- a/charts/argocd-apps/templates/wbaas-ui.yaml
+++ b/charts/argocd-apps/templates/wbaas-ui.yaml
@@ -10,16 +10,19 @@ spec:
     namespace: default
     server: {{ .Values.clusterUrl }}
   project: default
-  source:
-    path: charts/ui
-    repoURL: {{ .Values.repoUrls.charts }}
-    targetRevision: test/value-files
-    helm:
-      parameters:
-        - name: helm.debug
-          value: "true"
-      valueFiles:
-        - "values.local.yaml"
+  sources:
+    - repoURL: {{ .Values.repoUrls.charts }}
+      path: charts/ui
+      targetRevision: HEAD
+      helm:
+        parameters:
+          - name: helm.debug
+            value: "true"
+        valueFiles:
+          - $values/k8s/argocd/local/ui.values.yaml
+    - repoURL: {{ .Values.repoUrls.deploy }}
+      targetRevision: HEAD
+      ref: values
 
   syncPolicy:
     automated:
diff --git a/charts/argocd-config/templates/applications.yaml b/charts/argocd-config/templates/applications.yaml
index 46e1de028..13e9c045a 100644
--- a/charts/argocd-config/templates/applications.yaml
+++ b/charts/argocd-config/templates/applications.yaml
@@ -8,7 +8,7 @@ spec:
   project: default
   source:
     path: charts/argocd-apps
-    repoURL: {{ .Values.repoUrls.main }}
+    repoURL: {{ .Values.repoUrls.deploy }}
     targetRevision: de/argo-ui-simple # debug! needs to be set to HEAD
     helm:
       parameters:
diff --git a/charts/argocd-config/templates/projects.yaml b/charts/argocd-config/templates/projects.yaml
index 7d96ef114..1386e32a6 100644
--- a/charts/argocd-config/templates/projects.yaml
+++ b/charts/argocd-config/templates/projects.yaml
@@ -8,5 +8,5 @@ spec:
   - name: in-cluster
     server: https://kubernetes.default.svc
   sourceRepos:
-  - {{ .Values.repoUrls.main }}
+  - {{ .Values.repoUrls.deploy }}
   - {{ .Values.repoUrls.charts }}
\ No newline at end of file
diff --git a/charts/argocd-config/templates/repositories.yaml b/charts/argocd-config/templates/repositories.yaml
index 0409db802..c6e65cb20 100644
--- a/charts/argocd-config/templates/repositories.yaml
+++ b/charts/argocd-config/templates/repositories.yaml
@@ -9,4 +9,4 @@ type: Opaque
 data:
   project: {{ "local" | b64enc }}
   type: {{ "git" | b64enc }}
-  url: {{ .Values.repoUrls.main | b64enc }}
+  url: {{ .Values.repoUrls.deploy | b64enc }}
diff --git a/charts/argocd-config/values.yaml b/charts/argocd-config/values.yaml
index 80d12ba1f..58412cca1 100644
--- a/charts/argocd-config/values.yaml
+++ b/charts/argocd-config/values.yaml
@@ -1,3 +1,3 @@
 repoUrls:
-  main: https://github.com/wmde/wbaas-deploy
+  deploy: https://github.com/wmde/wbaas-deploy
   charts: https://github.com/wbstack/charts.git
diff --git a/k8s/argocd/local/ui.values.yaml b/k8s/argocd/local/ui.values.yaml
new file mode 100644
index 000000000..3346b58d7
--- /dev/null
+++ b/k8s/argocd/local/ui.values.yaml
@@ -0,0 +1,33 @@
+image:
+  tag: sha-52d3977
+
+resources:
+  requests:
+    cpu: 1m
+    memory: 6Mi
+  limits:
+    cpu: 10m
+    memory: 20Mi
+
+ingress:
+  enabled: true
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    nginx.ingress.kubernetes.io/use-regex: "true"
+    nginx.ingress.kubernetes.io/from-to-www-redirect: "true"
+  hosts:
+  - host: www.wbaas.localhost
+    paths:
+    - /*
+  tls: null
+
+ui:
+  apiUrl: api.wbaas.localhost
+  subdomainSuffix: ".wbaas.localhost"
+  cnameConfigMapKey: cname_record
+  configMapName: wbaas-ui-config
+  recaptchaSitekeySecretName: recaptcha-v3-secrets
+  recaptchaSitekeySecretKey: site_key
+
+podLabels:
+  sidecar.istio.io/inject: "true"

From 6ff19626a2cf4587887f3f841de97211dd35e6cf Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 15:54:46 +0200
Subject: [PATCH 04/50] test with PR branch

---
 charts/argocd-apps/templates/wbaas-ui.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/argocd-apps/templates/wbaas-ui.yaml b/charts/argocd-apps/templates/wbaas-ui.yaml
index 4cbbd69d4..2571bdf15 100644
--- a/charts/argocd-apps/templates/wbaas-ui.yaml
+++ b/charts/argocd-apps/templates/wbaas-ui.yaml
@@ -21,7 +21,7 @@ spec:
         valueFiles:
           - $values/k8s/argocd/local/ui.values.yaml
     - repoURL: {{ .Values.repoUrls.deploy }}
-      targetRevision: HEAD
+      targetRevision: de/argo-ui-simple
       ref: values
 
   syncPolicy:

From d9a4a534933c46de408a54fc76ac2b6d2c97aafe Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 15:58:57 +0200
Subject: [PATCH 05/50] cleanup

---
 k8s/helmfile/helmfile.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/k8s/helmfile/helmfile.yaml b/k8s/helmfile/helmfile.yaml
index c1e9d3591..bcab06c16 100644
--- a/k8s/helmfile/helmfile.yaml
+++ b/k8s/helmfile/helmfile.yaml
@@ -137,6 +137,7 @@ releases:
   - name: elasticsearch-2
     namespace: default
     chart: bitnami/elasticsearch
+    installed: false
     version: 19.10.2
     <<: *default_release
 
@@ -239,6 +240,7 @@ releases:
   - name: prometheus-elasticsearch-exporter-2
     namespace: monitoring
     chart: prometheus-community/prometheus-elasticsearch-exporter
+    installed: false
     version: 5.2.0
     <<: *default_release
 
@@ -248,6 +250,7 @@ releases:
     <<: *default_release
 
   - name: superset
+    installed: false
     namespace: default
     chart: ./../../charts/superset
     <<: *default_release

From 34a7948288496ad54073df93e446a81f5442bbc3 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 16:06:08 +0200
Subject: [PATCH 06/50] restore helmfile

---
 k8s/helmfile/helmfile.yaml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/k8s/helmfile/helmfile.yaml b/k8s/helmfile/helmfile.yaml
index bcab06c16..c1e9d3591 100644
--- a/k8s/helmfile/helmfile.yaml
+++ b/k8s/helmfile/helmfile.yaml
@@ -137,7 +137,6 @@ releases:
   - name: elasticsearch-2
     namespace: default
     chart: bitnami/elasticsearch
-    installed: false
     version: 19.10.2
     <<: *default_release
 
@@ -240,7 +239,6 @@ releases:
   - name: prometheus-elasticsearch-exporter-2
     namespace: monitoring
     chart: prometheus-community/prometheus-elasticsearch-exporter
-    installed: false
     version: 5.2.0
     <<: *default_release
 
@@ -250,7 +248,6 @@ releases:
     <<: *default_release
 
   - name: superset
-    installed: false
     namespace: default
     chart: ./../../charts/superset
     <<: *default_release

From fa8f57662df761598315e9e3b79cac2a3124ccda Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 16:06:36 +0200
Subject: [PATCH 07/50] configure local cluster project

---
 charts/argocd-apps/templates/wbaas-ui.yaml    |  2 --
 .../argocd-config/templates/applications.yaml |  2 +-
 charts/argocd-config/templates/projects.yaml  |  4 ++--
 .../argocd-config/templates/repositories.yaml | 24 +++++++++----------
 charts/argocd-config/values.yaml              |  2 ++
 5 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/charts/argocd-apps/templates/wbaas-ui.yaml b/charts/argocd-apps/templates/wbaas-ui.yaml
index 2571bdf15..e8134e5fa 100644
--- a/charts/argocd-apps/templates/wbaas-ui.yaml
+++ b/charts/argocd-apps/templates/wbaas-ui.yaml
@@ -16,8 +16,6 @@ spec:
       targetRevision: HEAD
       helm:
         parameters:
-          - name: helm.debug
-            value: "true"
         valueFiles:
           - $values/k8s/argocd/local/ui.values.yaml
     - repoURL: {{ .Values.repoUrls.deploy }}
diff --git a/charts/argocd-config/templates/applications.yaml b/charts/argocd-config/templates/applications.yaml
index 13e9c045a..9e4605799 100644
--- a/charts/argocd-config/templates/applications.yaml
+++ b/charts/argocd-config/templates/applications.yaml
@@ -5,7 +5,7 @@ metadata:
 spec:
   destination:
     server: https://kubernetes.default.svc
-  project: default
+  project: {{ .Values.environment }}
   source:
     path: charts/argocd-apps
     repoURL: {{ .Values.repoUrls.deploy }}
diff --git a/charts/argocd-config/templates/projects.yaml b/charts/argocd-config/templates/projects.yaml
index 1386e32a6..de046b6d7 100644
--- a/charts/argocd-config/templates/projects.yaml
+++ b/charts/argocd-config/templates/projects.yaml
@@ -1,9 +1,9 @@
 apiVersion: argoproj.io/v1alpha1
 kind: AppProject
 metadata:
-  name: local
+  name: {{ .Values.environment }}
 spec:
-  description: The local deployment of wikibase.cloud
+  description: The {{ .Values.environment }} deployment of wikibase.cloud
   destinations:
   - name: in-cluster
     server: https://kubernetes.default.svc
diff --git a/charts/argocd-config/templates/repositories.yaml b/charts/argocd-config/templates/repositories.yaml
index c6e65cb20..7ad200bfe 100644
--- a/charts/argocd-config/templates/repositories.yaml
+++ b/charts/argocd-config/templates/repositories.yaml
@@ -1,12 +1,12 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  labels:
-    argocd.argoproj.io/secret-type: repository
-  name: repo-charts
-  namespace: argocd
-type: Opaque
-data:
-  project: {{ "local" | b64enc }}
-  type: {{ "git" | b64enc }}
-  url: {{ .Values.repoUrls.deploy | b64enc }}
+# apiVersion: v1
+# kind: Secret
+# metadata:
+#   labels:
+#     argocd.argoproj.io/secret-type: repository
+#   name: repo-charts
+#   namespace: argocd
+# type: Opaque
+# data:
+#   project: {{ "local" | b64enc }}
+#   type: {{ "git" | b64enc }}
+#   url: {{ .Values.repoUrls.deploy | b64enc }}
diff --git a/charts/argocd-config/values.yaml b/charts/argocd-config/values.yaml
index 58412cca1..828a00c62 100644
--- a/charts/argocd-config/values.yaml
+++ b/charts/argocd-config/values.yaml
@@ -1,3 +1,5 @@
+environment: production
+
 repoUrls:
   deploy: https://github.com/wmde/wbaas-deploy
   charts: https://github.com/wbstack/charts.git

From 8b2bcaca848e544a5e861e154494da47e340b01c Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 16:10:19 +0200
Subject: [PATCH 08/50] add project to application

---
 charts/argocd-apps/templates/wbaas-ui.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/argocd-apps/templates/wbaas-ui.yaml b/charts/argocd-apps/templates/wbaas-ui.yaml
index e8134e5fa..2c9710c01 100644
--- a/charts/argocd-apps/templates/wbaas-ui.yaml
+++ b/charts/argocd-apps/templates/wbaas-ui.yaml
@@ -9,7 +9,7 @@ spec:
   destination:
     namespace: default
     server: {{ .Values.clusterUrl }}
-  project: default
+  project: {{ .Values.environment }}
   sources:
     - repoURL: {{ .Values.repoUrls.charts }}
       path: charts/ui

From 727d025a1d53170740eecd38700e6b53710e93b7 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 16:22:31 +0200
Subject: [PATCH 09/50] try namespace

---
 charts/argocd-config/templates/projects.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/charts/argocd-config/templates/projects.yaml b/charts/argocd-config/templates/projects.yaml
index de046b6d7..d7e62906b 100644
--- a/charts/argocd-config/templates/projects.yaml
+++ b/charts/argocd-config/templates/projects.yaml
@@ -6,6 +6,7 @@ spec:
   description: The {{ .Values.environment }} deployment of wikibase.cloud
   destinations:
   - name: in-cluster
+    namespace: argocd
     server: https://kubernetes.default.svc
   sourceRepos:
   - {{ .Values.repoUrls.deploy }}

From b13d539a9f5efb6ac11356a28005b41f05c022e6 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 16:25:38 +0200
Subject: [PATCH 10/50] add namespac

---
 charts/argocd-config/templates/applications.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/charts/argocd-config/templates/applications.yaml b/charts/argocd-config/templates/applications.yaml
index 9e4605799..9758e242a 100644
--- a/charts/argocd-config/templates/applications.yaml
+++ b/charts/argocd-config/templates/applications.yaml
@@ -5,6 +5,7 @@ metadata:
 spec:
   destination:
     server: https://kubernetes.default.svc
+    namespace: default
   project: {{ .Values.environment }}
   source:
     path: charts/argocd-apps

From 564855f536f1a3a265f9a7a9146fe8d3574ad9f6 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 16:27:44 +0200
Subject: [PATCH 11/50] adjust namepsace

---
 charts/argocd-config/templates/projects.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/argocd-config/templates/projects.yaml b/charts/argocd-config/templates/projects.yaml
index d7e62906b..282553a5f 100644
--- a/charts/argocd-config/templates/projects.yaml
+++ b/charts/argocd-config/templates/projects.yaml
@@ -6,7 +6,7 @@ spec:
   description: The {{ .Values.environment }} deployment of wikibase.cloud
   destinations:
   - name: in-cluster
-    namespace: argocd
+    namespace: default
     server: https://kubernetes.default.svc
   sourceRepos:
   - {{ .Values.repoUrls.deploy }}

From 65487f20077fafce4afede16e34ec36aa2a49455 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 16:30:32 +0200
Subject: [PATCH 12/50] add namespaces

---
 charts/argocd-config/templates/projects.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/charts/argocd-config/templates/projects.yaml b/charts/argocd-config/templates/projects.yaml
index 282553a5f..4e28e7e44 100644
--- a/charts/argocd-config/templates/projects.yaml
+++ b/charts/argocd-config/templates/projects.yaml
@@ -6,7 +6,9 @@ spec:
   description: The {{ .Values.environment }} deployment of wikibase.cloud
   destinations:
   - name: in-cluster
-    namespace: default
+    namespaces:
+      - argocd
+      - default
     server: https://kubernetes.default.svc
   sourceRepos:
   - {{ .Values.repoUrls.deploy }}

From ebede9089254f75c5d761db6583b53278c1a1211 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 16:45:41 +0200
Subject: [PATCH 13/50] test 2 destinations

---
 charts/argocd-config/templates/applications.yaml | 2 +-
 charts/argocd-config/templates/projects.yaml     | 9 ++++++---
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/charts/argocd-config/templates/applications.yaml b/charts/argocd-config/templates/applications.yaml
index 9758e242a..a0efabe06 100644
--- a/charts/argocd-config/templates/applications.yaml
+++ b/charts/argocd-config/templates/applications.yaml
@@ -5,7 +5,7 @@ metadata:
 spec:
   destination:
     server: https://kubernetes.default.svc
-    namespace: default
+    namespace: argocd
   project: {{ .Values.environment }}
   source:
     path: charts/argocd-apps
diff --git a/charts/argocd-config/templates/projects.yaml b/charts/argocd-config/templates/projects.yaml
index 4e28e7e44..75efe2953 100644
--- a/charts/argocd-config/templates/projects.yaml
+++ b/charts/argocd-config/templates/projects.yaml
@@ -5,11 +5,14 @@ metadata:
 spec:
   description: The {{ .Values.environment }} deployment of wikibase.cloud
   destinations:
-  - name: in-cluster
-    namespaces:
-      - argocd
+  - name: in-cluster-default
+    namespace:
       - default
     server: https://kubernetes.default.svc
+  - name: in-cluster-argocd
+    namespace:
+      - argocd
+    server: https://kubernetes.default.svc
   sourceRepos:
   - {{ .Values.repoUrls.deploy }}
   - {{ .Values.repoUrls.charts }}
\ No newline at end of file

From 189ee98b77d8b4dadeb7aa41b9ff4791c8e5abd2 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 16:47:09 +0200
Subject: [PATCH 14/50] no array for namespace

---
 charts/argocd-config/templates/projects.yaml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/charts/argocd-config/templates/projects.yaml b/charts/argocd-config/templates/projects.yaml
index 75efe2953..c383dc950 100644
--- a/charts/argocd-config/templates/projects.yaml
+++ b/charts/argocd-config/templates/projects.yaml
@@ -6,12 +6,10 @@ spec:
   description: The {{ .Values.environment }} deployment of wikibase.cloud
   destinations:
   - name: in-cluster-default
-    namespace:
-      - default
+    namespace: default
     server: https://kubernetes.default.svc
   - name: in-cluster-argocd
-    namespace:
-      - argocd
+    namespace: argocd
     server: https://kubernetes.default.svc
   sourceRepos:
   - {{ .Values.repoUrls.deploy }}

From 12e8f45cb87aed53587aae795157df0f5c83d1aa Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 16:52:25 +0200
Subject: [PATCH 15/50] try repostiory restriciton

---
 charts/argocd-config/templates/projects.yaml     |  3 +--
 charts/argocd-config/templates/repositories.yaml | 12 ------------
 2 files changed, 1 insertion(+), 14 deletions(-)
 delete mode 100644 charts/argocd-config/templates/repositories.yaml

diff --git a/charts/argocd-config/templates/projects.yaml b/charts/argocd-config/templates/projects.yaml
index c383dc950..6e6496ae5 100644
--- a/charts/argocd-config/templates/projects.yaml
+++ b/charts/argocd-config/templates/projects.yaml
@@ -12,5 +12,4 @@ spec:
     namespace: argocd
     server: https://kubernetes.default.svc
   sourceRepos:
-  - {{ .Values.repoUrls.deploy }}
-  - {{ .Values.repoUrls.charts }}
\ No newline at end of file
+  - 
\ No newline at end of file
diff --git a/charts/argocd-config/templates/repositories.yaml b/charts/argocd-config/templates/repositories.yaml
deleted file mode 100644
index 7ad200bfe..000000000
--- a/charts/argocd-config/templates/repositories.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-# apiVersion: v1
-# kind: Secret
-# metadata:
-#   labels:
-#     argocd.argoproj.io/secret-type: repository
-#   name: repo-charts
-#   namespace: argocd
-# type: Opaque
-# data:
-#   project: {{ "local" | b64enc }}
-#   type: {{ "git" | b64enc }}
-#   url: {{ .Values.repoUrls.deploy | b64enc }}

From 18c8602942686baba29a5ea2b58550aff0e93e74 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 16:58:00 +0200
Subject: [PATCH 16/50] re-add project repos

---
 charts/argocd-config/templates/projects.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/charts/argocd-config/templates/projects.yaml b/charts/argocd-config/templates/projects.yaml
index 6e6496ae5..c383dc950 100644
--- a/charts/argocd-config/templates/projects.yaml
+++ b/charts/argocd-config/templates/projects.yaml
@@ -12,4 +12,5 @@ spec:
     namespace: argocd
     server: https://kubernetes.default.svc
   sourceRepos:
-  - 
\ No newline at end of file
+  - {{ .Values.repoUrls.deploy }}
+  - {{ .Values.repoUrls.charts }}
\ No newline at end of file

From e534518f4fcd5e24542efa8f94505b5c51336ad3 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 17:38:27 +0200
Subject: [PATCH 17/50] add generate-values script

---
 bin/generate-values | 48 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100755 bin/generate-values

diff --git a/bin/generate-values b/bin/generate-values
new file mode 100755
index 000000000..5e63d25c9
--- /dev/null
+++ b/bin/generate-values
@@ -0,0 +1,48 @@
+#!/bin/bash
+
+function usage() {
+    echo
+    echo "usage: $(basename $0) <environment> <release-name> [output-file-template] [/path/to/helmfile.yaml]"
+    echo
+}
+
+ENVIRONMENT="$1"
+RELEASE="$2"
+
+OUTPUT="../argocd/${ENVIRONMENT}/${RELEASE}.values.yaml" # filepath relative to helmfile.yaml
+HELMFILE="./k8s/helmfile/helmfile.yaml"
+
+if [[ -n "$3" ]]; then
+    OUTPUT="$3"
+fi
+
+if [[ -n "$4" ]]; then
+    HELMFILE="$4"
+fi
+
+if [[ ! -e "${HELMFILE}" ]]; then
+    echo "error: helmfile not found: '${HELMFILE}'"
+    usage
+    exit 1 
+fi
+
+if [[ -z "${ENVIRONMENT}" ]]; then
+    echo "error: missing environment"
+    usage
+    exit 2
+fi
+
+if [[ -z "${RELEASE}" ]]; then
+    echo "error: missing release name"
+    usage
+    exit 3
+fi
+
+helmfile \
+    --file "${HELMFILE}" \
+    --environment "${ENVIRONMENT}" \
+    --selector name="${RELEASE}" \
+    --output-file-template "${OUTPUT}" \
+    --skip-deps \
+    write-values
+

From 7cb73c1515466ef4869e54c94276acd880d0045f Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 17:38:36 +0200
Subject: [PATCH 18/50] add staging & production values files

---
 k8s/argocd/local/ui.values.yaml      | 34 ++++++++++++----------------
 k8s/argocd/production/ui.values.yaml | 32 ++++++++++++++++++++++++++
 k8s/argocd/staging/ui.values.yaml    | 32 ++++++++++++++++++++++++++
 k8s/helmfile/helmfile.yaml           |  3 +++
 4 files changed, 82 insertions(+), 19 deletions(-)
 create mode 100644 k8s/argocd/production/ui.values.yaml
 create mode 100644 k8s/argocd/staging/ui.values.yaml

diff --git a/k8s/argocd/local/ui.values.yaml b/k8s/argocd/local/ui.values.yaml
index 3346b58d7..cfbbe75d9 100644
--- a/k8s/argocd/local/ui.values.yaml
+++ b/k8s/argocd/local/ui.values.yaml
@@ -1,33 +1,29 @@
 image:
-  tag: sha-52d3977
-
-resources:
-  requests:
-    cpu: 1m
-    memory: 6Mi
-  limits:
-    cpu: 10m
-    memory: 20Mi
-
+  tag: sha-78b8580
 ingress:
-  enabled: true
   annotations:
     kubernetes.io/ingress.class: nginx
-    nginx.ingress.kubernetes.io/use-regex: "true"
     nginx.ingress.kubernetes.io/from-to-www-redirect: "true"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+  enabled: true
   hosts:
   - host: www.wbaas.localhost
     paths:
     - /*
   tls: null
-
+podLabels:
+  sidecar.istio.io/inject: "true"
+resources:
+  limits:
+    cpu: 10m
+    memory: 20Mi
+  requests:
+    cpu: 1m
+    memory: 6Mi
 ui:
-  apiUrl: api.wbaas.localhost
-  subdomainSuffix: ".wbaas.localhost"
+  apiUrl: http://api.wbaas.localhost
   cnameConfigMapKey: cname_record
   configMapName: wbaas-ui-config
-  recaptchaSitekeySecretName: recaptcha-v3-secrets
   recaptchaSitekeySecretKey: site_key
-
-podLabels:
-  sidecar.istio.io/inject: "true"
+  recaptchaSitekeySecretName: recaptcha-v3-secrets
+  subdomainSuffix: .wbaas.localhost
diff --git a/k8s/argocd/production/ui.values.yaml b/k8s/argocd/production/ui.values.yaml
new file mode 100644
index 000000000..58a6375aa
--- /dev/null
+++ b/k8s/argocd/production/ui.values.yaml
@@ -0,0 +1,32 @@
+image:
+  tag: sha-52d3977
+ingress:
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    nginx.ingress.kubernetes.io/from-to-www-redirect: "true"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+  enabled: true
+  hosts:
+  - host: www.wikibase.cloud
+    paths:
+    - /*
+  tls:
+  - hosts:
+    - www.wikibase.cloud
+    secretName: wikibase-production-tls
+podLabels:
+  sidecar.istio.io/inject: "true"
+resources:
+  limits:
+    cpu: 10m
+    memory: 20Mi
+  requests:
+    cpu: 1m
+    memory: 6Mi
+ui:
+  apiUrl: https://api.wikibase.cloud
+  cnameConfigMapKey: cname_record
+  configMapName: wbaas-ui-config
+  recaptchaSitekeySecretKey: site_key
+  recaptchaSitekeySecretName: recaptcha-v3-secrets
+  subdomainSuffix: .wikibase.cloud
diff --git a/k8s/argocd/staging/ui.values.yaml b/k8s/argocd/staging/ui.values.yaml
new file mode 100644
index 000000000..03323b4d1
--- /dev/null
+++ b/k8s/argocd/staging/ui.values.yaml
@@ -0,0 +1,32 @@
+image:
+  tag: sha-78b8580
+ingress:
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    nginx.ingress.kubernetes.io/from-to-www-redirect: "true"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+  enabled: true
+  hosts:
+  - host: www.wikibase.dev
+    paths:
+    - /*
+  tls:
+  - hosts:
+    - www.wikibase.dev
+    secretName: wikibase-dev-tls
+podLabels:
+  sidecar.istio.io/inject: "true"
+resources:
+  limits:
+    cpu: 10m
+    memory: 20Mi
+  requests:
+    cpu: 1m
+    memory: 6Mi
+ui:
+  apiUrl: https://api.wikibase.dev
+  cnameConfigMapKey: cname_record
+  configMapName: wbaas-ui-config
+  recaptchaSitekeySecretKey: site_key
+  recaptchaSitekeySecretName: recaptcha-v3-secrets
+  subdomainSuffix: .wikibase.dev
diff --git a/k8s/helmfile/helmfile.yaml b/k8s/helmfile/helmfile.yaml
index c1e9d3591..e47ae8559 100644
--- a/k8s/helmfile/helmfile.yaml
+++ b/k8s/helmfile/helmfile.yaml
@@ -137,6 +137,7 @@ releases:
   - name: elasticsearch-2
     namespace: default
     chart: bitnami/elasticsearch
+    installed: false
     version: 19.10.2
     <<: *default_release
 
@@ -238,6 +239,7 @@ releases:
 
   - name: prometheus-elasticsearch-exporter-2
     namespace: monitoring
+    installed: false
     chart: prometheus-community/prometheus-elasticsearch-exporter
     version: 5.2.0
     <<: *default_release
@@ -248,6 +250,7 @@ releases:
     <<: *default_release
 
   - name: superset
+    installed: false
     namespace: default
     chart: ./../../charts/superset
     <<: *default_release

From 159d5a1c2ef697d9119e7c23f5238cf86cdfd7ae Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 17:38:50 +0200
Subject: [PATCH 19/50] add github workflow check

---
 .github/workflows/diff-values.yml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 .github/workflows/diff-values.yml

diff --git a/.github/workflows/diff-values.yml b/.github/workflows/diff-values.yml
new file mode 100644
index 000000000..d6d0b03b8
--- /dev/null
+++ b/.github/workflows/diff-values.yml
@@ -0,0 +1,24 @@
+on:
+  push:
+    paths:
+      - 'k8s/argocd/*'
+      - 'k8s/helmfile/env/*'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+      - name: Diff generated value files
+        run: >
+          for env_dir in k8s/argocd/*; do
+            env=$(basename $env_dir)
+            for release_file in $env_dir/*.values.yaml; do
+              release=$(basename $release_file .values.yaml)
+              tmp_values_file=/tmp/$env.$release.yml
+              echo checking $k - [$env] [$release]
+              ./bin/generate-values "$env" "$release" $tmp_values_file
+              diff tmp_values_file $release_file
+            done
+          done

From 46fec8fc4ccde8e380ac74052fb33147f36668a2 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 17:57:41 +0200
Subject: [PATCH 20/50] add indentation fix

---
 bin/generate-values             | 2 ++
 k8s/argocd/local/ui.values.yaml | 6 +++---
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/bin/generate-values b/bin/generate-values
index 5e63d25c9..7c0b5b7a8 100755
--- a/bin/generate-values
+++ b/bin/generate-values
@@ -46,3 +46,5 @@ helmfile \
     --skip-deps \
     write-values
 
+# fix indentation for yamllint action
+yq -I 2 -i "${OUTPUT}"
diff --git a/k8s/argocd/local/ui.values.yaml b/k8s/argocd/local/ui.values.yaml
index cfbbe75d9..2f1d42011 100644
--- a/k8s/argocd/local/ui.values.yaml
+++ b/k8s/argocd/local/ui.values.yaml
@@ -7,9 +7,9 @@ ingress:
     nginx.ingress.kubernetes.io/use-regex: "true"
   enabled: true
   hosts:
-  - host: www.wbaas.localhost
-    paths:
-    - /*
+    - host: www.wbaas.localhost
+      paths:
+        - /*
   tls: null
 podLabels:
   sidecar.istio.io/inject: "true"

From 2c24b240b296f426473e8b3abd206ab44366f0c9 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 17:58:20 +0200
Subject: [PATCH 21/50] restore helmfile

---
 k8s/helmfile/helmfile.yaml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/k8s/helmfile/helmfile.yaml b/k8s/helmfile/helmfile.yaml
index e47ae8559..c1e9d3591 100644
--- a/k8s/helmfile/helmfile.yaml
+++ b/k8s/helmfile/helmfile.yaml
@@ -137,7 +137,6 @@ releases:
   - name: elasticsearch-2
     namespace: default
     chart: bitnami/elasticsearch
-    installed: false
     version: 19.10.2
     <<: *default_release
 
@@ -239,7 +238,6 @@ releases:
 
   - name: prometheus-elasticsearch-exporter-2
     namespace: monitoring
-    installed: false
     chart: prometheus-community/prometheus-elasticsearch-exporter
     version: 5.2.0
     <<: *default_release
@@ -250,7 +248,6 @@ releases:
     <<: *default_release
 
   - name: superset
-    installed: false
     namespace: default
     chart: ./../../charts/superset
     <<: *default_release

From 2e088f9a4ea2c19533e33e9a745d25183e2a5100 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 18:12:41 +0200
Subject: [PATCH 22/50] add indentation fix

---
 bin/generate-values | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/bin/generate-values b/bin/generate-values
index 7c0b5b7a8..4968e056c 100755
--- a/bin/generate-values
+++ b/bin/generate-values
@@ -2,24 +2,22 @@
 
 function usage() {
     echo
-    echo "usage: $(basename $0) <environment> <release-name> [output-file-template] [/path/to/helmfile.yaml]"
+    echo "usage: $(basename $0) <environment> <release-name> [output-file-template]"
     echo
 }
 
+ROOT=$(realpath $(dirname $(realpath $BASH_SOURCE))/..)
+
 ENVIRONMENT="$1"
 RELEASE="$2"
 
-OUTPUT="../argocd/${ENVIRONMENT}/${RELEASE}.values.yaml" # filepath relative to helmfile.yaml
-HELMFILE="./k8s/helmfile/helmfile.yaml"
+OUTPUT="${ROOT}/k8s/argocd/${ENVIRONMENT}/${RELEASE}.values.yaml"
+HELMFILE="${ROOT}/k8s/helmfile/helmfile.yaml"
 
 if [[ -n "$3" ]]; then
     OUTPUT="$3"
 fi
 
-if [[ -n "$4" ]]; then
-    HELMFILE="$4"
-fi
-
 if [[ ! -e "${HELMFILE}" ]]; then
     echo "error: helmfile not found: '${HELMFILE}'"
     usage

From d35e8236332e1560b9458d3efbce0ee15c21257a Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 18:12:50 +0200
Subject: [PATCH 23/50] add fixed generated values files

---
 k8s/argocd/production/ui.values.yaml | 12 ++++++------
 k8s/argocd/staging/ui.values.yaml    | 12 ++++++------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/k8s/argocd/production/ui.values.yaml b/k8s/argocd/production/ui.values.yaml
index 58a6375aa..8b2d9c81c 100644
--- a/k8s/argocd/production/ui.values.yaml
+++ b/k8s/argocd/production/ui.values.yaml
@@ -7,13 +7,13 @@ ingress:
     nginx.ingress.kubernetes.io/use-regex: "true"
   enabled: true
   hosts:
-  - host: www.wikibase.cloud
-    paths:
-    - /*
+    - host: www.wikibase.cloud
+      paths:
+        - /*
   tls:
-  - hosts:
-    - www.wikibase.cloud
-    secretName: wikibase-production-tls
+    - hosts:
+        - www.wikibase.cloud
+      secretName: wikibase-production-tls
 podLabels:
   sidecar.istio.io/inject: "true"
 resources:
diff --git a/k8s/argocd/staging/ui.values.yaml b/k8s/argocd/staging/ui.values.yaml
index 03323b4d1..a775f8df6 100644
--- a/k8s/argocd/staging/ui.values.yaml
+++ b/k8s/argocd/staging/ui.values.yaml
@@ -7,13 +7,13 @@ ingress:
     nginx.ingress.kubernetes.io/use-regex: "true"
   enabled: true
   hosts:
-  - host: www.wikibase.dev
-    paths:
-    - /*
+    - host: www.wikibase.dev
+      paths:
+        - /*
   tls:
-  - hosts:
-    - www.wikibase.dev
-    secretName: wikibase-dev-tls
+    - hosts:
+        - www.wikibase.dev
+      secretName: wikibase-dev-tls
 podLabels:
   sidecar.istio.io/inject: "true"
 resources:

From b96d6f1ebab8e9d8e9de42f6ed3f52e1b955de6d Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 18:18:50 +0200
Subject: [PATCH 24/50] cleanup

---
 charts/argocd-config/Chart.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/charts/argocd-config/Chart.yaml b/charts/argocd-config/Chart.yaml
index 31aa52408..0fd62e963 100644
--- a/charts/argocd-config/Chart.yaml
+++ b/charts/argocd-config/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
 name: argocd-apps
-description: The argo-cd apps configuration for wikibase.cloud
+description: Chart to deploy ArgoCD configuration (including the argocd-apps chart)
 type: application
 version: 0.1.0
-appVersion: "0.0.1"
+appVersion: "1.0"

From 5e27cf73234a468b6c6a892ca7b1da1a2d8a5881 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 18:19:20 +0200
Subject: [PATCH 25/50] test workflow

---
 .github/workflows/diff-values.yml | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/.github/workflows/diff-values.yml b/.github/workflows/diff-values.yml
index d6d0b03b8..36bdb94e0 100644
--- a/.github/workflows/diff-values.yml
+++ b/.github/workflows/diff-values.yml
@@ -1,8 +1,4 @@
-on:
-  push:
-    paths:
-      - 'k8s/argocd/*'
-      - 'k8s/helmfile/env/*'
+on: push
 
 jobs:
   build:

From ab6f50ec0bce671907b21c665fbde7ea5074c223 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 18:26:45 +0200
Subject: [PATCH 26/50] try docker for helmfile and yq

---
 .github/workflows/diff-values.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/diff-values.yml b/.github/workflows/diff-values.yml
index 36bdb94e0..0722b36d3 100644
--- a/.github/workflows/diff-values.yml
+++ b/.github/workflows/diff-values.yml
@@ -1,11 +1,19 @@
 on: push
-
+name: Check values files
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
+      - name: Create helmfile docker shim
+        run: >
+          echo 'docker run --rm -v "${PWD}:/wd" ghcr.io/helmfile/helmfile:latest helmfile' > /usr/bin/helmfile
+          chmod a+x /usr/bin/helmfile
+      - name: Create yq docker shim
+        run: >
+          echo 'docker run --rm -v "${PWD}:/wd" --entrypoint yq ghcr.io/linuxserver/yq:latest' > /usr/bin/yq
+          chmod a+x /usr/bin/yq
       - name: Diff generated value files
         run: >
           for env_dir in k8s/argocd/*; do

From a78274aa56a2963575724431c6c7f5659b0d694a Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 18:27:54 +0200
Subject: [PATCH 27/50] shorten lines

---
 .github/workflows/diff-values.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/diff-values.yml b/.github/workflows/diff-values.yml
index 0722b36d3..9d06ee40a 100644
--- a/.github/workflows/diff-values.yml
+++ b/.github/workflows/diff-values.yml
@@ -8,11 +8,13 @@ jobs:
         uses: actions/checkout@v4
       - name: Create helmfile docker shim
         run: >
-          echo 'docker run --rm -v "${PWD}:/wd" ghcr.io/helmfile/helmfile:latest helmfile' > /usr/bin/helmfile
+          echo 'docker run --rm -v "${PWD}:/wd" ghcr.io/helmfile/helmfile:latest helmfile' \
+            > /usr/bin/helmfile
           chmod a+x /usr/bin/helmfile
       - name: Create yq docker shim
         run: >
-          echo 'docker run --rm -v "${PWD}:/wd" --entrypoint yq ghcr.io/linuxserver/yq:latest' > /usr/bin/yq
+          echo 'docker run --rm -v "${PWD}:/wd" --entrypoint yq ghcr.io/linuxserver/yq:latest' \
+            > /usr/bin/yq
           chmod a+x /usr/bin/yq
       - name: Diff generated value files
         run: >

From bb068735e234c7574332df7f425d2adffc19a2e4 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 18:33:19 +0200
Subject: [PATCH 28/50] debug tighub

---
 .github/workflows/diff-values.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/diff-values.yml b/.github/workflows/diff-values.yml
index 9d06ee40a..32597cda0 100644
--- a/.github/workflows/diff-values.yml
+++ b/.github/workflows/diff-values.yml
@@ -6,14 +6,16 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
+      - name: debug
+        run: echo $PATH
       - name: Create helmfile docker shim
         run: >
-          echo 'docker run --rm -v "${PWD}:/wd" ghcr.io/helmfile/helmfile:latest helmfile' \
+          echo 'docker run --rm -v "${PWD}:/wd" ghcr.io/helmfile/helmfile:latest helmfile $*' \
             > /usr/bin/helmfile
           chmod a+x /usr/bin/helmfile
       - name: Create yq docker shim
         run: >
-          echo 'docker run --rm -v "${PWD}:/wd" --entrypoint yq ghcr.io/linuxserver/yq:latest' \
+          echo 'docker run --rm -v "${PWD}:/wd" --entrypoint yq ghcr.io/linuxserver/yq:latest $*' \
             > /usr/bin/yq
           chmod a+x /usr/bin/yq
       - name: Diff generated value files

From 9f5e2a02cc0ec14018d122c56ec9bc9e7090d175 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 18:37:22 +0200
Subject: [PATCH 29/50] test more github

---
 .github/workflows/check-generated-values.yml | 58 ++++++++++++++++++++
 .github/workflows/diff-values.yml            | 32 -----------
 bin/generate-values                          |  2 +-
 k8s/argocd/local/ui.values.yaml              |  2 +-
 k8s/argocd/production/ui.values.yaml         |  2 +-
 k8s/argocd/staging/ui.values.yaml            |  2 +-
 6 files changed, 62 insertions(+), 36 deletions(-)
 create mode 100644 .github/workflows/check-generated-values.yml
 delete mode 100644 .github/workflows/diff-values.yml

diff --git a/.github/workflows/check-generated-values.yml b/.github/workflows/check-generated-values.yml
new file mode 100644
index 000000000..46f6718e9
--- /dev/null
+++ b/.github/workflows/check-generated-values.yml
@@ -0,0 +1,58 @@
+on: push
+name: Check values files
+jobs:
+  diff:
+    runs-on: ubuntu-latest
+    env:
+      TMP_DIR: "/tmp/shared"
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+      - name: Create directories
+        run: |
+          mkdir -p ~/.local/bin
+          mkdir -p "${TMP_DIR}"
+          chmod 777 "${TMP_DIR}"
+      - name: Create helmfile docker shim
+        run: |
+          docker pull ghcr.io/helmfile/helmfile:latest
+
+          echo 'docker run \
+            --rm \
+            --volume "${TMP_DIR}:${TMP_DIR}" \
+            --volume "${PWD}:/workdir" \
+            --workdir /workdir \
+            --user $(id -u):$(id -g) \
+            ghcr.io/helmfile/helmfile:latest helmfile $*' \
+            | tee ~/.local/bin/helmfile
+
+          chmod +x ~/.local/bin/helmfile
+      - name: Create yq docker shim
+        run: |
+          docker pull mikefarah/yq:latest
+
+          echo 'docker run \
+            --rm \
+            --volume "${TMP_DIR}:${TMP_DIR}" \
+            --volume "${PWD}:/workdir" \
+            --workdir /workdir \
+            --user $(id -u):$(id -g) \
+            mikefarah/yq:latest $*' \
+            | tee ~/.local/bin/yq
+
+          chmod +x ~/.local/bin/yq
+      - name: Diff generated value files
+        run: >
+          for ENV_DIR in k8s/argocd/*; do
+            ENV=$(basename "${ENV_DIR}")
+
+            for RELEASE_FILE in "${ENV_DIR}"/*.values.yaml; do
+              RELEASE=$(basename "${RELEASE_FILE}" .values.yaml)
+              TMP_VALUES="${TMP_DIR}"/tmp_"${ENV}.${RELEASE}".yml
+
+              echo "checking $RELEASE_FILE - [$ENV] [$RELEASE]"
+
+              ./bin/generate-values "${ENV}" "${RELEASE}" "${TMP_VALUES}"
+              diff "${TMP_VALUES}" "${RELEASE_FILE}"
+            done
+          done
diff --git a/.github/workflows/diff-values.yml b/.github/workflows/diff-values.yml
deleted file mode 100644
index 32597cda0..000000000
--- a/.github/workflows/diff-values.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-on: push
-name: Check values files
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
-      - name: debug
-        run: echo $PATH
-      - name: Create helmfile docker shim
-        run: >
-          echo 'docker run --rm -v "${PWD}:/wd" ghcr.io/helmfile/helmfile:latest helmfile $*' \
-            > /usr/bin/helmfile
-          chmod a+x /usr/bin/helmfile
-      - name: Create yq docker shim
-        run: >
-          echo 'docker run --rm -v "${PWD}:/wd" --entrypoint yq ghcr.io/linuxserver/yq:latest $*' \
-            > /usr/bin/yq
-          chmod a+x /usr/bin/yq
-      - name: Diff generated value files
-        run: >
-          for env_dir in k8s/argocd/*; do
-            env=$(basename $env_dir)
-            for release_file in $env_dir/*.values.yaml; do
-              release=$(basename $release_file .values.yaml)
-              tmp_values_file=/tmp/$env.$release.yml
-              echo checking $k - [$env] [$release]
-              ./bin/generate-values "$env" "$release" $tmp_values_file
-              diff tmp_values_file $release_file
-            done
-          done
diff --git a/bin/generate-values b/bin/generate-values
index 4968e056c..4b14cd71d 100755
--- a/bin/generate-values
+++ b/bin/generate-values
@@ -12,7 +12,7 @@ ENVIRONMENT="$1"
 RELEASE="$2"
 
 OUTPUT="${ROOT}/k8s/argocd/${ENVIRONMENT}/${RELEASE}.values.yaml"
-HELMFILE="${ROOT}/k8s/helmfile/helmfile.yaml"
+HELMFILE="k8s/helmfile/helmfile.yaml"
 
 if [[ -n "$3" ]]; then
     OUTPUT="$3"
diff --git a/k8s/argocd/local/ui.values.yaml b/k8s/argocd/local/ui.values.yaml
index 2f1d42011..153f20ae7 100644
--- a/k8s/argocd/local/ui.values.yaml
+++ b/k8s/argocd/local/ui.values.yaml
@@ -1,5 +1,5 @@
 image:
-  tag: sha-78b8580
+  tag: sha-a678a06
 ingress:
   annotations:
     kubernetes.io/ingress.class: nginx
diff --git a/k8s/argocd/production/ui.values.yaml b/k8s/argocd/production/ui.values.yaml
index 8b2d9c81c..8df4cca97 100644
--- a/k8s/argocd/production/ui.values.yaml
+++ b/k8s/argocd/production/ui.values.yaml
@@ -1,5 +1,5 @@
 image:
-  tag: sha-52d3977
+  tag: sha-a678a06
 ingress:
   annotations:
     kubernetes.io/ingress.class: nginx
diff --git a/k8s/argocd/staging/ui.values.yaml b/k8s/argocd/staging/ui.values.yaml
index a775f8df6..f87b2cdd5 100644
--- a/k8s/argocd/staging/ui.values.yaml
+++ b/k8s/argocd/staging/ui.values.yaml
@@ -1,5 +1,5 @@
 image:
-  tag: sha-78b8580
+  tag: sha-a678a06
 ingress:
   annotations:
     kubernetes.io/ingress.class: nginx

From b4df9867769f0b8710260ff593b3a9ffb162a6bf Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 20:24:24 +0200
Subject: [PATCH 30/50] add path restriction to workflow

---
 .github/workflows/check-generated-values.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/check-generated-values.yml b/.github/workflows/check-generated-values.yml
index 46f6718e9..6ebd44760 100644
--- a/.github/workflows/check-generated-values.yml
+++ b/.github/workflows/check-generated-values.yml
@@ -1,4 +1,8 @@
-on: push
+on:
+  push:
+    paths:
+      - 'k8s/helmfile/env/**'
+      - 'k8s/argocd/**'
 name: Check values files
 jobs:
   diff:

From 27a9f9e4af119bfa139ad26d1647f565d5ab8e9f Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 20:26:41 +0200
Subject: [PATCH 31/50] remove path restrictions again, seems unreliable

---
 .github/workflows/check-generated-values.yml | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/.github/workflows/check-generated-values.yml b/.github/workflows/check-generated-values.yml
index 6ebd44760..46f6718e9 100644
--- a/.github/workflows/check-generated-values.yml
+++ b/.github/workflows/check-generated-values.yml
@@ -1,8 +1,4 @@
-on:
-  push:
-    paths:
-      - 'k8s/helmfile/env/**'
-      - 'k8s/argocd/**'
+on: push
 name: Check values files
 jobs:
   diff:

From 38f623bc7c15c2300cb1596eabcf254640613add Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Wed, 31 Jul 2024 20:27:55 +0200
Subject: [PATCH 32/50] more descriptive GH action step name

---
 .github/workflows/check-generated-values.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/check-generated-values.yml b/.github/workflows/check-generated-values.yml
index 46f6718e9..3656a07bd 100644
--- a/.github/workflows/check-generated-values.yml
+++ b/.github/workflows/check-generated-values.yml
@@ -41,7 +41,7 @@ jobs:
             | tee ~/.local/bin/yq
 
           chmod +x ~/.local/bin/yq
-      - name: Diff generated value files
+      - name: Diff current values files against generated ones
         run: >
           for ENV_DIR in k8s/argocd/*; do
             ENV=$(basename "${ENV_DIR}")

From 0a270e2077b3804090eb99f464a5c06fd1ce5bca Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Thu, 1 Aug 2024 10:45:47 +0200
Subject: [PATCH 33/50] reduce argocd-config helmfile release

---
 k8s/helmfile/helmfile.yaml | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/k8s/helmfile/helmfile.yaml b/k8s/helmfile/helmfile.yaml
index c1e9d3591..bea239ab0 100644
--- a/k8s/helmfile/helmfile.yaml
+++ b/k8s/helmfile/helmfile.yaml
@@ -81,7 +81,7 @@ releases:
     installed: {{ ne .Environment.Name "local" | toYaml }}
     namespace: cert-manager
     # TODO use something more generic or from wbstack/charts repo
-    chart: ./../../charts/wikibase-cloud-clusterissuers
+    chart: ./../../charts/wikibase-cloud-clusterissuers 
     values:
       - email: {{ .Values.external.letsencrypt.email }}
       - gceProject: {{ .Values.gceProject }}
@@ -107,12 +107,8 @@ releases:
   - name: argocd-config
     namespace: argocd
     chart: ../../charts/argocd-config
-    values:
-      - env/{{`{{ .Environment.Name }}`}}/base.yaml
-      - env/{{`{{ .Environment.Name }}`}}/private.yaml
-      - env/production/{{`{{ .Release.Name }}`}}.values.yaml.gotmpl
-      - env/{{`{{ .Environment.Name }}`}}/{{`{{ .Release.Name }}`}}.values.yaml.gotmpl
     installed: {{ eq .Environment.Name "local" | toYaml }}
+    <<: *default_release
 
   - name: redirects
     namespace: default

From d9b7d58ea32efa7ffedc2000986ff87034b85887 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Thu, 1 Aug 2024 11:07:06 +0200
Subject: [PATCH 34/50] remove ui release from helmfile

---
 k8s/helmfile/helmfile.yaml | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/k8s/helmfile/helmfile.yaml b/k8s/helmfile/helmfile.yaml
index bea239ab0..f57d56d81 100644
--- a/k8s/helmfile/helmfile.yaml
+++ b/k8s/helmfile/helmfile.yaml
@@ -164,12 +164,6 @@ releases:
     namespace: default
     <<: *default_release
 
-  - name: ui
-    namespace: default
-    chart: wbstack/ui
-    version: 0.3.1
-    <<: *default_release
-
   - name: mediawiki-139
     namespace: default
     chart: wbstack/mediawiki

From 2bfa6ff6acbf1fbb3107615f04fbe5178977249d Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Thu, 1 Aug 2024 11:14:39 +0200
Subject: [PATCH 35/50] cleanup

---
 charts/argocd-apps/templates/wbaas-ui.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/charts/argocd-apps/templates/wbaas-ui.yaml b/charts/argocd-apps/templates/wbaas-ui.yaml
index 2c9710c01..4c4375828 100644
--- a/charts/argocd-apps/templates/wbaas-ui.yaml
+++ b/charts/argocd-apps/templates/wbaas-ui.yaml
@@ -15,7 +15,6 @@ spec:
       path: charts/ui
       targetRevision: HEAD
       helm:
-        parameters:
         valueFiles:
           - $values/k8s/argocd/local/ui.values.yaml
     - repoURL: {{ .Values.repoUrls.deploy }}
@@ -25,4 +24,4 @@ spec:
   syncPolicy:
     automated:
       selfHeal: false
-      prune: true
\ No newline at end of file
+      prune: true

From abea9735538188082745f2faa420fb47d5c41b6a Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Thu, 1 Aug 2024 11:23:32 +0200
Subject: [PATCH 36/50] cleanup

---
 .../templates/{applications.yaml => app-of-apps.yaml}        | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)
 rename charts/argocd-config/templates/{applications.yaml => app-of-apps.yaml} (83%)

diff --git a/charts/argocd-config/templates/applications.yaml b/charts/argocd-config/templates/app-of-apps.yaml
similarity index 83%
rename from charts/argocd-config/templates/applications.yaml
rename to charts/argocd-config/templates/app-of-apps.yaml
index a0efabe06..461539b9a 100644
--- a/charts/argocd-config/templates/applications.yaml
+++ b/charts/argocd-config/templates/app-of-apps.yaml
@@ -12,12 +12,9 @@ spec:
     repoURL: {{ .Values.repoUrls.deploy }}
     targetRevision: de/argo-ui-simple # debug! needs to be set to HEAD
     helm:
-      parameters:
-        - name: helm.debug
-          value: "true"
       values: |
 {{ toYaml .Values | indent 8 }}
   syncPolicy:
     automated:
       prune: true
-      selfHeal: false
\ No newline at end of file
+      selfHeal: false

From 11e28011c3e9ba418d1b607f8c0aa9208ad445ca Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Thu, 1 Aug 2024 12:45:32 +0200
Subject: [PATCH 37/50] re add ui release to helmfile (we still need it)

---
 k8s/helmfile/helmfile.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/k8s/helmfile/helmfile.yaml b/k8s/helmfile/helmfile.yaml
index f57d56d81..bea239ab0 100644
--- a/k8s/helmfile/helmfile.yaml
+++ b/k8s/helmfile/helmfile.yaml
@@ -164,6 +164,12 @@ releases:
     namespace: default
     <<: *default_release
 
+  - name: ui
+    namespace: default
+    chart: wbstack/ui
+    version: 0.3.1
+    <<: *default_release
+
   - name: mediawiki-139
     namespace: default
     chart: wbstack/mediawiki

From c29a485e2d5d7b36ea33e16c5bbd66243bcea700 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Thu, 1 Aug 2024 12:48:40 +0200
Subject: [PATCH 38/50] make linter happy

---
 k8s/helmfile/helmfile.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/k8s/helmfile/helmfile.yaml b/k8s/helmfile/helmfile.yaml
index bea239ab0..bd50a75da 100644
--- a/k8s/helmfile/helmfile.yaml
+++ b/k8s/helmfile/helmfile.yaml
@@ -81,7 +81,7 @@ releases:
     installed: {{ ne .Environment.Name "local" | toYaml }}
     namespace: cert-manager
     # TODO use something more generic or from wbstack/charts repo
-    chart: ./../../charts/wikibase-cloud-clusterissuers 
+    chart: ./../../charts/wikibase-cloud-clusterissuers
     values:
       - email: {{ .Values.external.letsencrypt.email }}
       - gceProject: {{ .Values.gceProject }}

From 15eca6ed81129afcb8cc2a4c2b8b4ce620311f28 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Thu, 1 Aug 2024 17:11:44 +0200
Subject: [PATCH 39/50] load values file from right environment

---
 charts/argocd-apps/templates/wbaas-ui.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/argocd-apps/templates/wbaas-ui.yaml b/charts/argocd-apps/templates/wbaas-ui.yaml
index 4c4375828..ea02edd0c 100644
--- a/charts/argocd-apps/templates/wbaas-ui.yaml
+++ b/charts/argocd-apps/templates/wbaas-ui.yaml
@@ -16,7 +16,7 @@ spec:
       targetRevision: HEAD
       helm:
         valueFiles:
-          - $values/k8s/argocd/local/ui.values.yaml
+          - $values/k8s/argocd/{{ .Values.environment }}/ui.values.yaml
     - repoURL: {{ .Values.repoUrls.deploy }}
       targetRevision: de/argo-ui-simple
       ref: values

From aee87f239c0d6368a151fc57cd97da90dd976d50 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Thu, 1 Aug 2024 17:13:22 +0200
Subject: [PATCH 40/50] added comment to explain values flow

---
 charts/argocd-apps/values.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/argocd-apps/values.yaml b/charts/argocd-apps/values.yaml
index 329feefc0..84078a595 100644
--- a/charts/argocd-apps/values.yaml
+++ b/charts/argocd-apps/values.yaml
@@ -1,3 +1,3 @@
 clusterUrl: https://kubernetes.default.svc
 
-environment: production
+# "inherits" values from argocd-config chart
\ No newline at end of file

From 2d30ed379655baa2960336328c0b3257f813557f Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Thu, 1 Aug 2024 17:14:10 +0200
Subject: [PATCH 41/50] add newline for linter

---
 charts/argocd-apps/values.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/argocd-apps/values.yaml b/charts/argocd-apps/values.yaml
index 84078a595..be08010a1 100644
--- a/charts/argocd-apps/values.yaml
+++ b/charts/argocd-apps/values.yaml
@@ -1,3 +1,3 @@
 clusterUrl: https://kubernetes.default.svc
 
-# "inherits" values from argocd-config chart
\ No newline at end of file
+# "inherits" values from argocd-config chart

From 04dd8074ef0a93cdc4d9b892404567fabc9262e6 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Fri, 2 Aug 2024 11:31:51 +0200
Subject: [PATCH 42/50] enable self-heal

---
 charts/argocd-apps/templates/wbaas-ui.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/argocd-apps/templates/wbaas-ui.yaml b/charts/argocd-apps/templates/wbaas-ui.yaml
index ea02edd0c..c2ff16dbd 100644
--- a/charts/argocd-apps/templates/wbaas-ui.yaml
+++ b/charts/argocd-apps/templates/wbaas-ui.yaml
@@ -23,5 +23,5 @@ spec:
 
   syncPolicy:
     automated:
-      selfHeal: false
+      selfHeal: true
       prune: true

From 51348b40cc44cdf183e180972d49fa222d562afe Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Fri, 2 Aug 2024 11:39:54 +0200
Subject: [PATCH 43/50] enable self heal for app of apps

---
 charts/argocd-config/templates/app-of-apps.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/argocd-config/templates/app-of-apps.yaml b/charts/argocd-config/templates/app-of-apps.yaml
index 461539b9a..b5633afeb 100644
--- a/charts/argocd-config/templates/app-of-apps.yaml
+++ b/charts/argocd-config/templates/app-of-apps.yaml
@@ -17,4 +17,4 @@ spec:
   syncPolicy:
     automated:
       prune: true
-      selfHeal: false
+      selfHeal: true

From 67fd73c5a16a7549a39d03f481ddf58991608eff Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Fri, 2 Aug 2024 11:40:03 +0200
Subject: [PATCH 44/50] uninstall local ui release in helmfile

---
 k8s/helmfile/helmfile.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/k8s/helmfile/helmfile.yaml b/k8s/helmfile/helmfile.yaml
index bd50a75da..866d62b53 100644
--- a/k8s/helmfile/helmfile.yaml
+++ b/k8s/helmfile/helmfile.yaml
@@ -165,6 +165,7 @@ releases:
     <<: *default_release
 
   - name: ui
+    installed: {{ ne .Environment.Name "local" | toYaml }}
     namespace: default
     chart: wbstack/ui
     version: 0.3.1

From d02b084d2b32c620e82c289c8ee57d79fa01dfa7 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Fri, 2 Aug 2024 11:59:10 +0200
Subject: [PATCH 45/50] add debug flag for workflow

---
 .github/workflows/check-generated-values.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/check-generated-values.yml b/.github/workflows/check-generated-values.yml
index 3656a07bd..d260b3b0f 100644
--- a/.github/workflows/check-generated-values.yml
+++ b/.github/workflows/check-generated-values.yml
@@ -43,6 +43,7 @@ jobs:
           chmod +x ~/.local/bin/yq
       - name: Diff current values files against generated ones
         run: >
+          set -x;
           for ENV_DIR in k8s/argocd/*; do
             ENV=$(basename "${ENV_DIR}")
 

From 0c31a12d1d1ccd942be21e5114677166e0e79906 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <91744937+deer-wmde@users.noreply.github.com>
Date: Fri, 2 Aug 2024 12:02:58 +0200
Subject: [PATCH 46/50] Update bin/generate-values

---
 bin/generate-values | 1 +
 1 file changed, 1 insertion(+)

diff --git a/bin/generate-values b/bin/generate-values
index 4b14cd71d..c17b08160 100755
--- a/bin/generate-values
+++ b/bin/generate-values
@@ -6,6 +6,7 @@ function usage() {
     echo
 }
 
+# absolute path of the wbaas-deploy repository
 ROOT=$(realpath $(dirname $(realpath $BASH_SOURCE))/..)
 
 ENVIRONMENT="$1"

From 556b186d6dc920344566454e502e08b1df3b8fd3 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Fri, 2 Aug 2024 12:04:55 +0200
Subject: [PATCH 47/50] add debug output for generate values script

---
 bin/generate-values | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/bin/generate-values b/bin/generate-values
index c17b08160..92b9bd247 100755
--- a/bin/generate-values
+++ b/bin/generate-values
@@ -1,5 +1,7 @@
 #!/bin/bash
 
+set -x
+
 function usage() {
     echo
     echo "usage: $(basename $0) <environment> <release-name> [output-file-template]"

From 61814595617f152df004028881392342575459f2 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Fri, 2 Aug 2024 12:57:13 +0200
Subject: [PATCH 48/50] generate-values: add fix for uninstalled helmfile
 releases

---
 bin/generate-values | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/bin/generate-values b/bin/generate-values
index 92b9bd247..3683b4f33 100755
--- a/bin/generate-values
+++ b/bin/generate-values
@@ -1,24 +1,22 @@
 #!/bin/bash
 
-set -x
-
 function usage() {
     echo
     echo "usage: $(basename $0) <environment> <release-name> [output-file-template]"
     echo
 }
 
-# absolute path of the wbaas-deploy repository
-ROOT=$(realpath $(dirname $(realpath $BASH_SOURCE))/..)
-
 ENVIRONMENT="$1"
 RELEASE="$2"
 
-OUTPUT="${ROOT}/k8s/argocd/${ENVIRONMENT}/${RELEASE}.values.yaml"
+# absolute path of the wbaas-deploy repository
+ROOT=$(realpath $(dirname $(realpath $BASH_SOURCE))/..)
+OUTPUT_TEMPLATE="${ROOT}/k8s/argocd/${ENVIRONMENT}/${RELEASE}.values.yaml"
 HELMFILE="k8s/helmfile/helmfile.yaml"
+TMP_HELMFILE="$(dirname ${HELMFILE})/.tmp_helmfile.$(mktemp -u XXXXXX).yaml"
 
 if [[ -n "$3" ]]; then
-    OUTPUT="$3"
+    OUTPUT_TEMPLATE="$3"
 fi
 
 if [[ ! -e "${HELMFILE}" ]]; then
@@ -39,13 +37,22 @@ if [[ -z "${RELEASE}" ]]; then
     exit 3
 fi
 
+echo "environment: ${ENVIRONMENT}"
+echo "release: ${RELEASE}"
+
+# modify tmp helmfile by setting each release as "installed", so it always gets processed
+cp "${HELMFILE}" "${TMP_HELMFILE}"
+sed -i 's/installed: .*$/installed: true/g' "${TMP_HELMFILE}"
+
 helmfile \
-    --file "${HELMFILE}" \
+    --file "${TMP_HELMFILE}" \
     --environment "${ENVIRONMENT}" \
     --selector name="${RELEASE}" \
-    --output-file-template "${OUTPUT}" \
+    --output-file-template "${OUTPUT_TEMPLATE}" \
     --skip-deps \
     write-values
 
-# fix indentation for yamllint action
-yq -I 2 -i "${OUTPUT}"
+rm "${TMP_HELMFILE}"
+
+# fix indentation in output file for yamllint action
+yq -I 2 -i "${OUTPUT_TEMPLATE}"

From 22a821269ba1d473b494d70b8355337cc4bcc8ef Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Fri, 2 Aug 2024 13:30:04 +0200
Subject: [PATCH 49/50] staging: uninstall ui release

---
 k8s/helmfile/helmfile.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/k8s/helmfile/helmfile.yaml b/k8s/helmfile/helmfile.yaml
index 866d62b53..77c8044d5 100644
--- a/k8s/helmfile/helmfile.yaml
+++ b/k8s/helmfile/helmfile.yaml
@@ -165,7 +165,7 @@ releases:
     <<: *default_release
 
   - name: ui
-    installed: {{ ne .Environment.Name "local" | toYaml }}
+    installed: {{ eq .Environment.Name "production" | toYaml }}
     namespace: default
     chart: wbstack/ui
     version: 0.3.1

From 1d6538641df1c5e6196b84740f92a0dee5cd8045 Mon Sep 17 00:00:00 2001
From: Deniz Erdogan <deniz.erdogan@wikimedia.de>
Date: Fri, 2 Aug 2024 13:30:23 +0200
Subject: [PATCH 50/50] staging: install argo app-of-apps

---
 k8s/helmfile/helmfile.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/k8s/helmfile/helmfile.yaml b/k8s/helmfile/helmfile.yaml
index 77c8044d5..cd9a330de 100644
--- a/k8s/helmfile/helmfile.yaml
+++ b/k8s/helmfile/helmfile.yaml
@@ -107,7 +107,7 @@ releases:
   - name: argocd-config
     namespace: argocd
     chart: ../../charts/argocd-config
-    installed: {{ eq .Environment.Name "local" | toYaml }}
+    installed: {{ ne .Environment.Name "production" | toYaml }}
     <<: *default_release
 
   - name: redirects