# ------------------------------------------------------------------------------
# Platform: External Secrets Operator
# Wave 1 — must be fully healthy before 1Password Connect (wave 2)
# Multi-source: Helm chart from upstream + manifests from repo
# ------------------------------------------------------------------------------
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: external-secrets
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "1"
spec:
  project: default
  sources:
    # Source 1: Helm chart from upstream
    - repoURL: https://charts.external-secrets.io
      chart: external-secrets
      targetRevision: 0.14.4
      helm:
        valueFiles:
          - $values/cluster/platform/external-secrets/values.yaml
    # Source 2: Repo — provides values file via $values ref
    # No path here since external-secrets has no extra manifests
    - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
      targetRevision: main
      ref: values
  destination:
    server: https://kubernetes.default.svc
    namespace: external-secrets
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true