From 18e7fd7ea363d0be3b49e456074ac2d806d90486 Mon Sep 17 00:00:00 2001
From: admin <admin@uzbutterfly.com>
Date: Wed, 24 Jun 2026 05:05:57 +0000
Subject: [PATCH] feat: add rancher to argocd with external secret

---
 apps/rancher.yaml                 | 24 ++++++++++++++++++++++++
 helm/rancher/values.yaml          |  2 +-
 k8s/external-secrets/rancher.yaml | 18 ++++++++++++++++++
 3 files changed, 43 insertions(+), 1 deletion(-)
 create mode 100644 apps/rancher.yaml
 create mode 100644 k8s/external-secrets/rancher.yaml

diff --git a/apps/rancher.yaml b/apps/rancher.yaml
new file mode 100644
index 0000000..0fcd782
--- /dev/null
+++ b/apps/rancher.yaml
@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: rancher
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    - repoURL: https://releases.rancher.com/server-charts/stable
+      chart: rancher
+      targetRevision: "2.14.2"
+      helm:
+        valueFiles:
+          - $values/helm/rancher/values.yaml
+    - repoURL: http://gitea-http.gitea.svc.cluster.local:3000/admin/k8s-manifests
+      targetRevision: HEAD
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cattle-system
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
diff --git a/helm/rancher/values.yaml b/helm/rancher/values.yaml
index f40abbc..6b86b09 100644
--- a/helm/rancher/values.yaml
+++ b/helm/rancher/values.yaml
@@ -1,2 +1,2 @@
-bootstrapPassword: CHANGEME
 hostname: rancher.uzbutterfly.com
+bootstrapPassword: ""
diff --git a/k8s/external-secrets/rancher.yaml b/k8s/external-secrets/rancher.yaml
new file mode 100644
index 0000000..baa1149
--- /dev/null
+++ b/k8s/external-secrets/rancher.yaml
@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: rancher-secret
+  namespace: cattle-system
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: rancher-bootstrap-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: bootstrapPassword
+      remoteRef:
+        key: secret/rancher
+        property: bootstrapPassword