# ============================================================================
# ArgoCD Application: OpenViking
# Wave: 8 (after Harbor at Wave 7)
# Deployment method: GitOps (Gitea -> ArgoCD)
# ============================================================================
#
# Multi-source: Helm chart from upstream VolcEngine + local values + manifests from repo
# Follows Harbor's pattern exactly (multi-source Application with local value overrides).
#
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: openviking
  namespace: argocd
  annotations:
    # Wave 8 (platform-level, apps-of-apps view): OpenViking Application syncs after Harbor (Wave 7)
    # NOTE: This annotation controls the Application's position in the apps-of-apps rollout,
    # NOT the ordering of resources within the Application. Internal resource ordering is
    # controlled by sync-wave annotations on individual resources (ExternalSecret, etc.).
    # argocd.argoproj.io/sync-wave: "8"  # Platform-level docs - NOT needed as annotation
    description: |
      OpenViking Platform Knowledge Infrastructure pilot deployment
      Pilot scope: Two corpora (hermes/ skills library, personal/homelab/)
      Two consumer profiles (Wong, Shuri) for before/after token comparison.
      
      CRITICAL CONSTRAINT: Vault (~/friday) is the canonical source of truth.
      OpenViking's index is a derived cache, rebuilt from vault source files.
      If index and vault ever diverge, vault wins and re-index runs.
      See inbox/ryan/2026-08-13-openviking-pilot-deployment-plan.md
spec:
  project: default

  sources:
    # Source 1: Helm chart from upstream VolcEngine/OpenViking repository
    - repoURL: https://github.com/volcengine/openviking.git
      targetRevision: main
      path: deploy/helm/openviking
      helm:
        valueFiles:
          # Local values override upstream defaults
          - $values/cluster/platform/openviking/values.yaml

    # Source 2: Gitea homelab repo — values + ExternalSecret + namespace + ingress manifests
    - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
      targetRevision: main
      path: cluster/platform/openviking
      ref: values
      directory:
        # Exclude the Application manifest itself (already in argocd)
        exclude: "application.yaml"

  destination:
    server: https://kubernetes.default.svc
    namespace: openviking

  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true
      # Important: do not prune ExternalSecrets on ArgoCD uninstall
      # (credentials live in 1Password, re-sync on pod restart)
      - PrunePropagationPolicy=background

# ============================================================================
# DEPLOYMENT GATE: DO NOT SYNC TO ARGOCD UNTIL
# ============================================================================
# 1. Wong's Phase 1 (t_32766900) is complete: ExternalSecret manifests exist in Gitea,
#    1Password vault items (openviking-root-api-key, openviking-embedding-api-key, openviking-vlm-api-key)
#    are provisioned and synced to the cluster.
#
# 2. Model staging (separate task): nomic-embed-text-v1.5-Q4_K_M.gguf has been pulled into
#    /opt/models/ on astro-orbiter and the router preset INI section appended + router restarted.
#    Verify: POST http://10.1.71.130:8002/v1/embeddings with model="nomic-embed-text-v1.5"
#    returns a 768-dim float vector.
#
# 3. Smoke test plan (below) documented and ready to execute post-sync.
#
# Contact: Peter Parker (Phase 2 owner) — check for blocker updates via kanban comment
# or by monitoring Wong's task (t_32766900) for completion.
# ============================================================================