From 465e336858bbbab94bfcdfec51f75a2af1654045 Mon Sep 17 00:00:00 2001
From: Linus Vogel <linus@linvogel.ch>
Date: Fri, 3 Jul 2026 13:15:55 +0200
Subject: [PATCH] autocommit

---
 apps/istio-base-crd.yaml    | 25 +++++++++++++++++++
 apps/istio.yaml             | 38 +++++-----------------------
 helm/istio-base/Chart.yaml  |  8 ------
 helm/istio-base/values.yaml | 49 -------------------------------------
 4 files changed, 31 insertions(+), 89 deletions(-)
 create mode 100644 apps/istio-base-crd.yaml
 delete mode 100644 helm/istio-base/Chart.yaml
 delete mode 100644 helm/istio-base/values.yaml

diff --git a/apps/istio-base-crd.yaml b/apps/istio-base-crd.yaml
new file mode 100644
index 0000000..d5c3ec7
--- /dev/null
+++ b/apps/istio-base-crd.yaml
@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: istio-base-crds
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: istio-system
+  source:
+    chart: base
+    repoURL: https://istio-release.storage.googleapis.com/charts
+    targetRevision: 1.30.2
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+    - group: admissionregistration.k8s.io
+      kind: ValidateingWebhookConfiguration
+      name: istiod-default-validator
+      jqPathExpressions:
+        - .webhooks[] | select(.name == "validation.istio.io") | .failurePolicy
\ No newline at end of file
diff --git a/apps/istio.yaml b/apps/istio.yaml
index 3a12404..4fe804e 100644
--- a/apps/istio.yaml
+++ b/apps/istio.yaml
@@ -1,17 +1,3 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: istio-system
-  labels:
-    istio-injection: enabled
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: istio-ingress
-  labels:
-    istio-injection: enabled
----
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -29,6 +15,9 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: istio-ingress
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
 ---
 apiVersion: argoproj.io/v1alpha1
 kind: Application
@@ -47,21 +36,6 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: istio-system
----
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: istio-base
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://gitea.linvogel.ch/linus/gitops.git
-    targetRevision: HEAD
-    path: helm/istio-base
-    helm:
-      valueFiles:
-        - values.yaml
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: istio-system
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
diff --git a/helm/istio-base/Chart.yaml b/helm/istio-base/Chart.yaml
deleted file mode 100644
index 9eb88a4..0000000
--- a/helm/istio-base/Chart.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: v2
-name: istio-base
-version: 0.1.0
-dependencies:
-  - name: base
-    version: 1.30.2
-    repository: https://istio-release.storage.googleapis.com/charts
-
diff --git a/helm/istio-base/values.yaml b/helm/istio-base/values.yaml
deleted file mode 100644
index 70e18ce..0000000
--- a/helm/istio-base/values.yaml
+++ /dev/null
@@ -1,49 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  global:
-
-    # ImagePullSecrets for control plane ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-
-    # Used to locate istiod.
-    istioNamespace: istio-system
-
-    # resourceScope controls what resources will be processed by helm.
-    # This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.
-    # It can be one of:
-    # - all: all resources are processed
-    # - cluster: only cluster-scoped resources are processed
-    # - namespace: only namespace-scoped resources are processed
-    resourceScope: all
-
-    # If true, install the istio-reader ServiceAccount and associated ClusterRole/ClusterRoleBinding.
-    # These are only needed for multicluster remote-secret workflows.
-    enableReaderRBAC: true
-  base:
-    # A list of CRDs to exclude. Requires `enableCRDTemplates` to be true.
-    # Example: `excludedCRDs: ["envoyfilters.networking.istio.io"]`.
-    # Note: when installing with `istioctl`, `enableIstioConfigCRDs=false` must also be set.
-    excludedCRDs: []
-    # Helm (as of V3) does not support upgrading CRDs, because it is not universally
-    # safe for them to support this.
-    # Istio as a project enforces certain backwards-compat guarantees that allow us
-    # to safely upgrade CRDs in spite of this, so we default to self-managing CRDs
-    # as standard K8S resources in Helm, and disable Helm's CRD management. See also:
-    # https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#method-2-separate-charts
-    enableCRDTemplates: true
-
-    # Validation webhook configuration url
-    # For example: https://$remotePilotAddress:15017/validate
-    validationURL: ""
-    # Validation webhook caBundle value. Useful when running pilot with a well known cert
-    validationCABundle: ""
-
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  defaultRevision: "1.30.2"
-  experimental:
-    stableValidationPolicy: false