From 3e9a843e1bd712cce8b39ec752bcae63025a0b5c Mon Sep 17 00:00:00 2001
From: Ryan Blundon <ryan.blundon@protonmail.com>
Date: Sun, 17 May 2026 21:37:17 -0500
Subject: [PATCH] cert manager and 1p

---
 .../platform/cert-manager/application.yaml    | 23 ++++++++-----
 .../onepassword-connect/application.yaml      | 33 ++++++++-----------
 2 files changed, 29 insertions(+), 27 deletions(-)

diff --git a/cluster/platform/cert-manager/application.yaml b/cluster/platform/cert-manager/application.yaml
index aa0a294..91678d0 100644
--- a/cluster/platform/cert-manager/application.yaml
+++ b/cluster/platform/cert-manager/application.yaml
@@ -1,6 +1,7 @@
 # ------------------------------------------------------------------------------
 # Platform: cert-manager
-# Wave 3 — depends on ESO (wave 1) for Cloudflare token secret
+# Wave 3 — depends on ESO + 1Password Connect for Cloudflare token
+# Multi-source: Helm chart from upstream + ClusterIssuers + ExternalSecret
 # ------------------------------------------------------------------------------
 apiVersion: argoproj.io/v1alpha1
 kind: Application
@@ -11,13 +12,19 @@ metadata:
     argocd.argoproj.io/sync-wave: "3"
 spec:
   project: default
-  source:
-    repoURL: https://charts.jetstack.io
-    chart: cert-manager
-    targetRevision: v1.17.2
-    helm:
-      valueFiles:
-          - values.yaml
+  sources:
+    # Source 1: Helm chart from upstream
+    - repoURL: https://charts.jetstack.io
+      chart: cert-manager
+      targetRevision: v1.17.2
+      helm:
+        valueFiles:
+          - $values/cluster/platform/cert-manager/values.yaml
+    # Source 2: Repo — values ref + ExternalSecret + ClusterIssuers
+    - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+      targetRevision: main
+      path: cluster/platform/cert-manager
+      ref: values
   destination:
     server: https://kubernetes.default.svc
     namespace: cert-manager
diff --git a/cluster/platform/onepassword-connect/application.yaml b/cluster/platform/onepassword-connect/application.yaml
index 5bfe4e8..47b16eb 100644
--- a/cluster/platform/onepassword-connect/application.yaml
+++ b/cluster/platform/onepassword-connect/application.yaml
@@ -1,18 +1,7 @@
 # ------------------------------------------------------------------------------
 # Platform: 1Password Connect Server
 # Wave 2 — depends on ESO (wave 1) being healthy
-#
-# IMPORTANT — Bootstrap secret:
-# Before this Application can sync successfully, the 1Password credentials
-# file must be applied manually ONE TIME:
-#
-#   kubectl create namespace onepassword-connect
-#   kubectl create secret generic op-credentials \
-#     --from-file=1password-credentials.json \
-#     -n onepassword-connect
-#
-# This is the ONLY secret that cannot flow through ESO (it IS the ESO backend).
-# Store the credentials file securely in 1Password itself as a backup.
+# Multi-source: Helm chart from upstream + ClusterSecretStore manifest from repo
 # ------------------------------------------------------------------------------
 apiVersion: argoproj.io/v1alpha1
 kind: Application
@@ -23,13 +12,19 @@ metadata:
     argocd.argoproj.io/sync-wave: "2"
 spec:
   project: default
-  source:
-    repoURL: https://1password.github.io/connect-helm-charts
-    chart: connect
-    targetRevision: 1.16.0
-    helm:
-      valueFiles:
-          - values.yaml
+  sources:
+    # Source 1: Helm chart from upstream
+    - repoURL: https://1password.github.io/connect-helm-charts
+      chart: connect
+      targetRevision: 1.16.0
+      helm:
+        valueFiles:
+          - $values/cluster/platform/onepassword-connect/values.yaml
+    # Source 2: Repo — values ref + ClusterSecretStore manifest
+    - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+      targetRevision: main
+      path: cluster/platform/onepassword-connect
+      ref: values
   destination:
     server: https://kubernetes.default.svc
     namespace: onepassword-connect