Consolidate ArgoCD node pinning into chart global.affinity

[venkatamutyala]

What

Pin every ArgoCD pod to the glueops.dev/role: glueops-platform nodes using the chart's global.affinity preset instead of repeating a nodeSelector + nodeAffinity block on each component. Targets the deployed chart 9.x (verified on 9.3.7 and 9.7.1). Net −36 lines.

Change (single file: argocd.yaml.tpl)

• global: add

  affinity:
    podAntiAffinity: soft
    nodeAffinity:
      type: hard              # -> requiredDuringSchedulingIgnoredDuringExecution
      matchExpressions:
        - {key: glueops.dev/role, operator: In, values: [glueops-platform]}

  (global.tolerations already carried the glueops-platform toleration.)
• Removed the per-component nodeSelector + affinity from server, applicationSet, notifications, repoServer, and deleted the redisSecretInit block — they now inherit global.

Left overriding global on purpose

• controller — keeps its affinity (dedicated glueops-platform-argocd-app-controller pool preferred + glueops-platform fallback) and two-taint tolerations.
• redis-ha — subchart, not reachable by global; keeps nodeSelector + tolerations + additionalAffinities (also pins its helm-test pods).
• gatekeeper — raw extraObjects manifest; keeps its own nodeSelector + tolerations.

Why not global.nodeSelector

It would AND onto the controller (whose nodeSelector is empty) and exclude its dedicated pool — a nodeSelector can't express the OR the controller's nodeAffinity does. So pinning is via global.affinity.nodeAffinity.

Verification (helm template)

11/11 pod-producing workloads pinned, 0 unpinned on both 9.3.7 (deployed) and 9.7.1; controller keeps req=[app-controller, glueops-platform], pref=[app-controller], both tolerations. Independently reviewed by a Helm expert (approved).

Behavior notes

• server/applicationSet/notifications gain a soft own-pod host-spread (from the global preset) — preferred-only, good for HA.
• repoServer loses the moot weight:50 "spread off app-controller" term (controller lives on its own pool); own-pod spread preserved via the global soft preset.
• Existing pods won't migrate — requiredDuringSchedulingIgnoredDuringExecution is schedule-time only. After merge + Argo sync, kubectl -n glueops-core rollout restart the affected workloads so they reschedule. Ensure the glueops-platform pool has ≥3 nodes (redis-ha's required host anti-affinity).
• metrics.enabled stays per-component (there is no global.metrics). No redis metrics changes.

Follow-up (separate, not in this PR)

README.md still documents installing chart 5.50.0 while the cluster runs 9.3.7+ — worth a doc update.

🤖 Generated with Claude Code