# ------------------------------------------------------------------------------
# Platform: 1Password Connect Server
# Wave 2 — depends on ESO (wave 1) being healthy
#
# IMPORTANT — Bootstrap secret:
# Before this Application can sync successfully, the 1Password credentials
# file must be applied manually ONE TIME:
#
#   kubectl create namespace onepassword-connect
#   kubectl create secret generic op-credentials \
#     --from-file=1password-credentials.json \
#     -n onepassword-connect
#
# This is the ONLY secret that cannot flow through ESO (it IS the ESO backend).
# Store the credentials file securely in 1Password itself as a backup.
# ------------------------------------------------------------------------------
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: onepassword-connect
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "2"
spec:
  project: default
  source:
    repoURL: https://1password.github.io/connect-helm-charts
    chart: connect
    targetRevision: 1.16.0
    helm:
      valuesFile: values.yaml
  destination:
    server: https://kubernetes.default.svc
    namespace: onepassword-connect
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true