---
id: w4/m1/t003
title: Argo Application for Kratos (pinned chart, values, identity schema)
worker: worker4
status: done
estimate: 30m
depends_on: [w4/m1/t002]
---

## Objective

Deploy Ory Kratos as a GitOps base component: one Argo `Application` over the pinned upstream `ory/kratos` Helm chart, values checked in, default identity schema (email + password to start), DSN and secrets referenced from the t002 Secrets — never inline.

## Context

- Pattern: one Argo Application per component in `deploy/gitops/base/` (see `zot.yaml`, `traefik.yaml`); pinned chart versions like `opensandbox-controller.yaml`; values under `deploy/gitops/base/values/`.
- Kratos needs: `dsn` (from Secret), `secrets.cookie` / `secrets.cipher` (from Secret), an identity schema (JSON), auto-migration on install (`kratos automigrate` job).
- Public + admin endpoints are separate listeners; only public gets exposed later (t005).

## Steps

1. Add `deploy/gitops/base/kratos.yaml` (Argo Application, pinned chart + version).
2. Add `deploy/gitops/base/values/kratos.values.yaml`: DSN/secret refs via `existingSecret`-style values, identity schema, automigration enabled, admin endpoint cluster-internal only.
3. Register in `base/kustomization.yaml`; add any local-overlay patches (single replica).
4. Apply to the mock cluster; confirm migration job completes and pods go Ready.

## Files

- `deploy/gitops/base/kratos.yaml` (new)
- `deploy/gitops/base/values/kratos.values.yaml` (new)
- `deploy/gitops/base/kustomization.yaml`
- `deploy/gitops/overlays/local/kustomization.yaml`

## Acceptance criteria

- [ ] Kratos pods Ready on the mock cluster; migrations applied to `kratos-db`.
- [ ] `kratos` admin API answers on its cluster-internal Service (`/admin/health/ready`).
- [ ] No secret values appear in committed values files.

## Out of scope

- Ingress/TLS (t005); social sign-in providers; customized self-service UI flows.
