# Longhorn — this repo's pre-installed storage layer. Same pattern as
# apps/metallb.yaml: an Application pointing at a Helm chart
# (apps/longhorn/) that pulls in the official upstream chart. Once this
# syncs, any app in this cluster can request persistent storage (a
# PersistentVolumeClaim) and actually get real, replicated storage backed
# by the dedicated disk each worker prepared with
# talos/patch-longhorn.yaml — see docs/06-longhorn.md.
#
# Longhorn needs privileged Pods (it manages block devices directly) and
# the `open-iscsi`/`util-linux-tools` Talos system extensions baked into
# your node image — both covered in docs/01-prerequisites.md and
# docs/02-talos-bootstrap.md. Skipping either means Longhorn's Pods will
# sit unhealthy no matter how correctly this Application syncs.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: longhorn
  namespace: argocd
spec:
  project: default

  source:
    repoURL: https://tea.ahmza.com/ahmza/k8s-starter-pack.git
    targetRevision: main
    path: apps/longhorn

  destination:
    server: https://kubernetes.default.svc
    namespace: longhorn-system

  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    # Longhorn's manager Pods need hostPath volumes and privileged mode to
    # manage block devices directly on each node. Kubernetes' baseline Pod
    # Security profile rejects both, so this namespace is explicitly opted
    # into the privileged profile—scoped only to longhorn-system.
    managedNamespaceMetadata:
      labels:
        pod-security.kubernetes.io/enforce: privileged
        pod-security.kubernetes.io/audit: privileged
        pod-security.kubernetes.io/warn: privileged
    syncOptions:
      - CreateNamespace=true