apiVersion: traefik.io/v1alpha1
kind: ServersTransport
metadata:
  name: argocd-server-transport
  namespace: argocd
spec:
  insecureSkipVerify: true
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: argocd-server
  namespace: argocd
spec:
  entryPoints:
    - websecure
  routes:
    # 1. gRPC routing for Argo CD CLI and API clients
    - match: Host(`argocd.k8s.lab.cudanet.org`) && Headers(`Content-Type`, `application/grpc`)
      kind: Rule
      priority: 11
      services:
        - name: argocd-server
          port: 443
          scheme: https
          serversTransport: argocd-server-transport
    # 2. Standard Web UI traffic
    - match: Host(`argocd.k8s.lab.cudanet.org`)
      kind: Rule
      priority: 10
      services:
        - name: argocd-server
          port: 443
          scheme: https
          serversTransport: argocd-server-transport
  tls:
    secretName: argocd-tls-cert # Replace with your TLS Secret, or omit if using Traefik default cert / cert-resolver