# Authentik keeps uploaded icons and branding under /data. The PostgreSQL dump
# does not include these files, so this separate Longhorn volume is restored
# from the source VM's data/ directory before Authentik is enabled.
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: authentik-data
  namespace: {{ .Release.Namespace }}
  annotations:
    # Uploaded files are identity-service state. Never let Argo CD prune the
    # volume automatically because a template was renamed or removed.
    argocd.argoproj.io/sync-options: Prune=false
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 5Gi