Initial argo deployment

cluster/platform/external-secrets/application.yaml

@@ -0,0 +1,29 @@
+# ------------------------------------------------------------------------------
+# Platform: External Secrets Operator
+# Wave 1 — must be fully healthy before 1Password Connect (wave 2)
+# ------------------------------------------------------------------------------
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-secrets
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: default
+  source:
+    repoURL: https://charts.external-secrets.io
+    chart: external-secrets
+    targetRevision: 0.14.4
+    helm:
+      valuesFile: values.yaml
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-secrets
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

cluster/platform/external-secrets/values.yaml

@@ -0,0 +1,23 @@
+# ------------------------------------------------------------------------------
+# External Secrets Operator — Helm Values
+# Chart: https://charts.external-secrets.io
+# ------------------------------------------------------------------------------
+
+# Install CRDs as part of the chart (recommended for GitOps)
+installCRDs: true
+
+# Replica count — 1 is fine for homelab
+replicaCount: 1
+
+# Enable Prometheus metrics for cinderella-castle monitoring
+metrics:
+  service:
+    enabled: true
+
+# Webhook for secret validation
+webhook:
+  replicaCount: 1
+
+# Cert controller manages webhook certs
+certController:
+  replicaCount: 1