Initial argo deployment

cluster/platform/onepassword-connect/application.yaml

@@ -0,0 +1,41 @@
+# ------------------------------------------------------------------------------
+# Platform: 1Password Connect Server
+# Wave 2 — depends on ESO (wave 1) being healthy
+#
+# IMPORTANT — Bootstrap secret:
+# Before this Application can sync successfully, the 1Password credentials
+# file must be applied manually ONE TIME:
+#
+#   kubectl create namespace onepassword-connect
+#   kubectl create secret generic op-credentials \
+#     --from-file=1password-credentials.json \
+#     -n onepassword-connect
+#
+# This is the ONLY secret that cannot flow through ESO (it IS the ESO backend).
+# Store the credentials file securely in 1Password itself as a backup.
+# ------------------------------------------------------------------------------
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: onepassword-connect
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  project: default
+  source:
+    repoURL: https://1password.github.io/connect-helm-charts
+    chart: connect
+    targetRevision: 1.16.0
+    helm:
+      valuesFile: values.yaml
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: onepassword-connect
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true