0101. Argo CD and Kokumi are no longer part of Ichor

Status: Accepted · Date: 2026-10-29 · Design section: Bootstrap, CNI · Supersedes in part: 0099

Decided: Argo CD and Kokumi are not requirements and Ichor no longer installs, publishes or manages either; the whole standard stack (the stack reconciler, the ichor-stack Jobs and RBAC, pkg/stack, the hidden ichor stack apply, the stack wait and Kokumi password print in ichor init, the stack network policies) is deleted, while Cilium stays Ichor's own Helm release run by the ichor-cni Job, and the CRD fields it left unused (TalosCluster.spec.gitops, TalosCluster.spec.cni.handover, IchorInstallation.spec.managementMode, spec.stack, status.stack) are removed, not deprecated, through the installer's explicit retired-field list; GitOps tools, Flux included, are permanently out of scope

Context

ADR 0099 made Argo CD and Kokumi the standard stack: ichor init always installed them, the controller published their bundles into Kokumi's in-cluster registry, and Argo CD synced from there. The user has decided that neither is a requirement. Storage, monitoring and any GitOps tool are the operator's to install, as the design said before ADR 0099. ADR 0099 also made Cilium the only CNI and Ichor's own Helm release; that part is wanted and untouched.

Decision

Removed:

• The stack reconciler in the IchorInstallation controller (internal/controller/stack.go, stack_job.go) and its wiring: StackEnabled, RegistryHost, the status.stack writes and the requeue they drove.
• internal/stackapply and the hidden command ichor stack apply; the ichor-stack Jobs.
• pkg/stack: the embedded Argo CD chart and Kokumi manifest, the bundle builder, the OCI push, and the bundle policies. The Makefile targets argocd-chart and kokumi-install. The dependencies that became unused (go mod tidy).
• The ichor-stack ServiceAccount and ClusterRole (config/rbac/ichor-stack, the chart's rbac/ichor-stack.yaml), the controller's rights on Kokumi orders and Argo CD applications, the stack CiliumNetworkPolicy, and the controller's egress to Kokumi's registry. TestStackRBAC became TestControllerRBACHoldsNoEscalation: the controller's ClusterRole still holds no escalation, CRD or workload-create rights.
• In ichor init: the wait for StackReady, the Kokumi admin password print, and spec.stack on the IchorInstallation it creates. The wait for CNIHandover stays (internal/cli/init_handover.go), as does the IchorInstallation.
• The Argo CD and Kokumi sections of README.md, docs/design/architecture.md and the ui-demo README.

Kept:

• Cilium as Ichor's Helm release: the inline bootstrap manifest, the ichor-cni Job in kube-system and its RBAC, spec.cni.cilium.values, upgrades through cni operations, the kube-proxy switch, the CNIHandover condition and ichor init waiting for it. Everything in ADR 0099 and its amendments about Cilium stands.
• IchorInstallation.spec.stack and status.stack were first kept deprecated; they are now removed (see "Retired CRD fields"). Nothing reads or writes them. The StackReady condition is no longer set; an installed IchorInstallation that carries a stale one keeps it until the object is rewritten, and nothing depends on it.
• The detection of Ichor's own CRs and Deployment being tracked by a user's Argo CD or Flux, and the argocd-cm read behind it, which concern a user's GitOps tool, not an Ichor-installed one. (The GitOps, Git-tracking and PR-mode code is handled separately; see the GitOps section.)

What remains of ADR 0099

ADR 0099 is superseded in part. These decisions stand: Cilium is the only CNI; it boots from the inline manifest and is then owned by Ichor as a Helm release run by an installer-style Job; the user's values layer lives on TalosCluster.spec.cni.cilium.values; ichor-system network policies (ADR 0100) are unchanged apart from losing the Kokumi egress rule and the stack policy. These do not: decisions about Kokumi, Argo CD, the in-cluster registry, Orders, bundles, spec.stack, ichor-stack Jobs and the stack's network policies.

Consequences

• Existing clusters that already run the stack keep their Argo CD and Kokumi; Ichor just stops managing them. Removing them is the operator's job.
• A new ichor init finishes after the Cilium hand-over and installs nothing else.
• The additive-CRD rule holds: no field was removed from any CRD.

GitOps

GitOps is no longer a requirement, so Ichor stops knowing about GitOps tools at all. The user may still run Argo CD or Flux over Ichor's custom resources; Ichor neither detects it nor reacts to it. This supersedes the tracked-detection bullet under "Kept" above: that code is gone too.

Removed:

• Detection of CRs tracked by Argo CD or Flux (pkg/gitopstracking, the argocd-cm read, the Flux inventory scan) and every refusal built on it: the tracked-write gate in internal/uiapi (machines, patches, discovery, install, operations, node actions, Cilium values), the same refusals in the CLI's in-process fallback, and the tracked-CR denial in the override webhook. The webhook keeps its other jobs: removing an ichor.maesh.dev/* finalizer, resetting a node, restoring etcd, the last-worker override, spec.authentication and secret-reference changes. It no longer exempts Argo CD or Flux service accounts by name; it still exempts Ichor's controller and the Kubernetes namespace and garbage collectors.
• Pull-request mode (pkg/prmode, pkg/gitops) and strict mode: no write opens a pull request, and approving a node always writes the TalosMachine. Override no longer means "write a tracked CR and open the matching pull request". It stays as the verb that guards the destructive operations.
• GitOpsService, proto/ichor/v1alpha1/gitops.proto, the external-links registry (ichorUI.links, ICHOR_LINK_*), ichorUI.argocdNamespace / ICHOR_ARGOCD_NAMESPACE and the CLI's --argocd-namespace.
• The UI GitOps page, its route, navigation entry and strings; the pull-request notice and override dialogs; the Cilium page's tracked-by banner and read-only state.
• The Argo CD health-check ConfigMap (ADR 0046): argocdHealth, templates/argocd, the Lua files and their test; and examples/argocd-application.yaml.
• RBAC: argocd-cm get, Flux kustomizations list and applications get for ichor-ui; argocd-cm get and Flux kustomizations list for the manager.
• The IchorInstallation ExternalSuggested condition and the controller's read of its own Deployment.

Retired CRD fields (a deliberate exception to the append-only rule, decided by the user: these fields are gone for good):

• TalosCluster.spec.gitops (mode, repository and everything under it) and its Go types and CEL rules.
• TalosCluster.spec.cni.handover and its enum (ADR 0099 had already made it unused: the hand-over is always to Ichor).
• IchorInstallation.spec.managementMode and its enum. ichor was the only behaviour.
• IchorInstallation.spec.stack and status.stack, with IchorStackSpec, IchorStackComponentSpec, IchorStackStatus, IchorStackComponentStatus and the promotion enum (ADR 0099 added them).

Kept and not retired: TalosCluster.spec.cni.custom and the flannel and custom values of spec.cni.preset. They stay deprecated and refused by the webhook and the controller.

The retired-field mechanism: internal/installer/crdcheck.go refuses an install whose target CRD would drop a property the installed CRD has (a downgrade). It now carries retiredFields, an explicit list of {crd, path} entries (the CRD name and the dotted property path from the object root, such as spec.gitops, each with a comment citing the ADR). The check lets exactly those paths disappear, on exactly that CRD, and keeps refusing every other removal. The rule: a field is retired only by naming it in that list, one ADR per removal; there is no wildcard and no per-version or prefix match. Enum value changes are not checked by the installer, so dropping an enum alongside its field needs no entry.

Stored objects: once the field is out of the schema the API server prunes it on the next write, and no validation or webhook rejects an object that still carries it (envtest TestStoredTalosClusterWithRetiredFieldsSurvivesTheCRDUpgrade and TestStoredIchorInstallationWithRetiredFieldsSurvivesTheCRDUpgrade create objects under the pre-removal CRDs, install the new ones and update the objects). The proto fields stay, deprecated, for wire compatibility.

Flux CD is permanently out of scope, like every GitOps tool. Ichor holds no Flux code, RBAC rule or wording.

Deprecated, kept (the append-only rule for wire formats):

• Proto fields, marked deprecated = true and never set: tracked_by (GetCiliumValuesResponse), pull_request_url and notice on the approve, reject, set-install, add-discovery, update-patch, delete-patch and create-operation responses, override on the approve, reject, set-install, add-discovery, update-patch and delete-patch requests (the server ignores it), opens_pull_request on PlanOperationResponse and management_mode on GetIchorInstallationResponse. override on node-action and etcd-restore requests is unchanged.

Superseded ADRs: 0015, 0028, 0037, 0038, 0044, 0046, 0051, 0056, 0062 in full; 0059 (decision 5 and the external mode) and 0065 (the tracked-write part; the verb and the destructive-operation checks stand) in part.

Consequences:

• A user who keeps Ichor's CRs in Git with Argo CD or Flux can still do so. Ichor writes them directly from the UI and CLI, and the user's tool may revert those writes. Ichor no longer warns about this.
• The UI backend and CLI have one write path, no Git token and no outbound call to a Git host.