How to force ArgoCD to load cert/key (UI/https purpose) from custom volume mount

[squirrlien]

Using argocd-autopilot, then kustomization.yaml to adjust Argocd's install.yaml.
On the mother's world, I can't find a DECLARATIVE and SAFE way to load custom certificate and private key into the argocd-server pod for the ONLY main purpose to have the UI alias Web page to use it. To be terminated on the pod - NO INGRESS.
The idea is to just use the GCP Secret Manager Add-On which nicely mounts secrets to argocd-server, e.g. under /var/tls (because argocd doesn't allow me force it to mount under /app/config/tls).

Seems like argocd-server pod is sucking the cert/key directly from the K8s secret called: "argocd-server-tls" - not mounted anywhere based on the install.yaml

The documentation is either very poor or expects that there is no other way how to manage the ArgoCD UI/Web cert through the argocd-server-tls ONLY. Why is it not customizable that argocd would load the cert/key from some mounted volume?

From this whole declarative approach, I am stuck with some robust external K8s secret massage therapists or with the manual work of:
kubectl -n argocd create secret tls argocd-server-tls
--cert=your.crt.pem
--key=your.key.pem

[ChristianCiach]

There doesn't seem to be another way; Argo-CD only supports loading the TLS-certificate from a Secret:

argo-cd/util/settings/settings.go

Lines 1559 to 1580 in afcc71b

	cert, err := mgr.externalServerTLSCertificate()
	if err != nil {
	errs = append(errs, &incompleteSettingsError{message: fmt.Sprintf("could not read from secret %s/%s: %v", mgr.namespace, externalServerTLSSecretName, err)})
	} else {
	if cert != nil {
	settings.Certificate = cert
	settings.CertificateIsExternal = true
	log.Infof("Loading TLS configuration from secret %s/%s", mgr.namespace, externalServerTLSSecretName)
	} else {
	serverCert, certOk := argoCDSecret.Data[settingServerCertificate]
	serverKey, keyOk := argoCDSecret.Data[settingServerPrivateKey]
	if certOk && keyOk {
	cert, err := tls.X509KeyPair(serverCert, serverKey)
	if err != nil {
	errs = append(errs, &incompleteSettingsError{message: fmt.Sprintf("invalid x509 key pair %s/%s in secret: %s", settingServerCertificate, settingServerPrivateKey, err)})
	} else {
	settings.Certificate = &cert
	settings.CertificateIsExternal = false
	}
	}
	}
	}