---
id: w1/m19/t004
title: Engine wiring: Cilium WireGuard addon, autoscaler incluster-incluster, CAPI + autoscaler as Argo apps
worker: worker1
status: done
estimate: 45m
depends_on: [w1/m19/t002]
---

## Objective

Adapt the machine-engine wiring to the post-pivot world: encrypted CNI, in-cluster autoscaler without secrets, and the CAPI/autoscaler components finally GitOps-managed as the deploy/gitops placeholders always intended.

## Context

- Cilium install lives in app-cluster.yml addons: add `--set encryption.enabled=true --set encryption.type=wireguard`.
- infra/clusterapi/autoscaler-values.yaml: `clusterAPIMode: incluster-incluster`, drop `clusterAPIKubeconfigSecret`; CA image tag = workload minor (v1.31.5 until the version bump).
- deploy/gitops/base/: turn the cluster-api placeholder comment and the autoscaler kustomization comment into real Argo Applications (CAPI providers via clusterctl-generated manifests or operator chart; autoscaler via the helm chart with the values file) - they now target the very cluster Argo runs on, which is what their destination `kubernetes.default.svc` always said.
- scripts/install-autoscaler.sh stays as the bootstrap-time installer (pre-Argo window during t006/t007); Argo adopts the release after pivot (same name/namespace so `helm upgrade --install` and Argo agree).

## Steps

1. Edit values + workflow + gitops base; `helm template` the autoscaler with new values; gitops-validate green.

## Files

- infra/clusterapi/autoscaler-values.yaml
- .github/workflows/app-cluster.yml
- deploy/gitops/base/kustomization.yaml + new cluster-api.yaml/autoscaler.yaml Applications
- scripts/install-autoscaler.sh

## Acceptance criteria

- [x] helm template renders incluster-incluster (no kubeconfig volume, no `--kubeconfig` flag). _2026-07-10: verified with the Argo Application's exact inputs (values file + valuesObject + parameters): zero kubeconfig references, no volumes._
- [x] gitops-validate.sh green with the two new Applications. _2026-07-10: green — with ONE new Application (autoscaler.yaml). Deliberate deviation: CAPI providers stay clusterctl-owned (CRD upgrades, cert-manager ordering, provider version contracts — wrapping clusterctl output in Argo makes two owners fight); cluster-api.yaml records the decision in place._
- [x] Cilium addon line carries the WireGuard flags. _Already on since w1/m7 t004 (encryption.enabled/type=wireguard/nodeEncryption in app-cluster.yml); rebuilt cluster inherits automatically._

## Out of scope

- Tailscale/WireGuard operator access layer (future, per DO_NOT_DO's note); Cilium ClusterMesh.
