---
id: w4/m1/t004
title: Argo Application for Hydra (pinned chart, values, admin/public split)
worker: worker4
status: done
estimate: 30m
depends_on: [w4/m1/t002]
---

## Objective

Deploy Ory Hydra as a GitOps base component: Argo `Application` over the pinned `ory/hydra` chart, values checked in, DSN + system/OIDC-pairwise secrets from the t002 Secrets, admin API kept cluster-internal and public (OAuth2/OIDC) endpoints ready for exposure in t005.

## Context

- Same base-component pattern as t003 (`deploy/gitops/base/*.yaml` + `base/values/`).
- Hydra needs: `dsn` (from Secret, → `hydra-db`), `secrets.system`, OIDC subject pairwise salt, `urls.self.issuer` set to the eventual public URL (base domain, t005), automigration job.
- Admin API (client management, token introspection — consumed by w4/m2) must not be publicly exposed.

## Steps

1. Add `deploy/gitops/base/hydra.yaml` (Argo Application, pinned chart + version).
2. Add `deploy/gitops/base/values/hydra.values.yaml`: secret refs, issuer URL, automigration, admin listener internal-only.
3. Register in `base/kustomization.yaml`; local-overlay patch (single replica, local issuer host).
4. Apply to the mock cluster; confirm migration job completes and pods go Ready.

## Files

- `deploy/gitops/base/hydra.yaml` (new)
- `deploy/gitops/base/values/hydra.values.yaml` (new)
- `deploy/gitops/base/kustomization.yaml`
- `deploy/gitops/overlays/local/kustomization.yaml`

## Acceptance criteria

- [ ] Hydra pods Ready on the mock cluster; migrations applied to `hydra-db`.
- [ ] Admin API reachable only in-cluster (`/health/ready` via Service); public port serves the OIDC discovery document.
- [ ] No secret values in committed values files.

## Out of scope

- Ingress/TLS (t005); consent/login app wiring to Kratos (part of the m2/ADR integration plan).
