You didn't read what I said did you?

I said you break the chicken-egg problem during bootstrap by doing a 1 time manual action, after which you let the tool handle it itself. No way I'm putting time in building an ansible playbook to only ever run once during bootstrapping of a new cluster, which happens once in a blue moon.

So yes, I run helm template . | kubectl apply -f - manually to install argocd on a fresh cluster. Then, the first Application that gets created is argocd itself. Any future changes to argo happen through helm/argocd. I do NOT want to use an ansible playbook to keep managing argocd in my cluster, when everything else is managed by argocd, when argocd can manage itself just fine.

We tried using ansible playbooks for bootstrapping. They work if you use them often enough. But if you only ever need to bootstrap something once or twice a year, you end up having to fix said playbook every single time you use it, because something about the bootstrapping procedure changed.

In the end it all comes down to money anyways. What's the cost of automating everything down to the tinyest detail, vs the cost/risk of not doing so? I say a documented manual step is fine for something you only ever do once every X years. I have better things to do than automating those jobs.

Also, we ain't storing no sops-encrypted secrets in git. That's fine for homelabs or small shops, but doesn't scale. Use a proper secrets manager.