From 5e99408c1f0bc07982b389a19c369145165b50da Mon Sep 17 00:00:00 2001
From: Ryan Blundon <ryan.blundon@protonmail.com>
Date: Sun, 17 May 2026 21:33:24 -0500
Subject: [PATCH] change pattern for external secrets

---
 .../external-secrets/application.yaml         | 21 ++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/cluster/platform/external-secrets/application.yaml b/cluster/platform/external-secrets/application.yaml
index c7832b9..6412cb0 100644
--- a/cluster/platform/external-secrets/application.yaml
+++ b/cluster/platform/external-secrets/application.yaml
@@ -1,6 +1,7 @@
 # ------------------------------------------------------------------------------
 # Platform: External Secrets Operator
 # Wave 1 — must be fully healthy before 1Password Connect (wave 2)
+# Multi-source: Helm chart from upstream + manifests from repo
 # ------------------------------------------------------------------------------
 apiVersion: argoproj.io/v1alpha1
 kind: Application
@@ -11,13 +12,19 @@ metadata:
     argocd.argoproj.io/sync-wave: "1"
 spec:
   project: default
-  source:
-    repoURL: https://charts.external-secrets.io
-    chart: external-secrets
-    targetRevision: 0.14.4
-    helm:
-      valueFiles:
-          - values.yaml
+  sources:
+    # Source 1: Helm chart from upstream
+    - repoURL: https://charts.external-secrets.io
+      chart: external-secrets
+      targetRevision: 0.14.4
+      helm:
+        valueFiles:
+          - $values/cluster/platform/external-secrets/values.yaml
+    # Source 2: Repo — provides values file via $values ref
+    # No path here since external-secrets has no extra manifests
+    - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+      targetRevision: main
+      ref: values
   destination:
     server: https://kubernetes.default.svc
     namespace: external-secrets