# cert-manager, installed like MetalLB and Longhorn: an Application pointing
# at apps/cert-manager, a Helm chart that pulls in the upstream cert-manager
# chart plus this cluster's ClusterIssuers. Once this syncs, an Ingress
# anywhere in this repo can request a real, auto-renewing HTTPS certificate
# just by adding one annotation. See docs/12-cert-manager.md.
#
# Deliberately NO resources-finalizer.argocd.argoproj.io here, same
# reasoning as apps/longhorn.yaml. cert-manager's CRDs (Certificate,
# ClusterIssuer, Order, Challenge) are cluster-wide — deleting them cascades
# through Kubernetes' own garbage collector to delete every Certificate
# custom resource in the cluster, and each Certificate owns its resulting
# TLS Secret by default. Cascading this Application's deletion could
# silently delete every HTTPS certificate this cluster has, cluster-wide,
# not just cert-manager's own Pods. Removing this file from Git should be a
# rare, deliberate act, confirmed by hand.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: cert-manager
  namespace: argocd
spec:
  project: default

  source:
    repoURL: https://tea.ahmza.com/ahmza/k8s-starter-pack.git
    targetRevision: main
    path: apps/cert-manager

  destination:
    server: https://kubernetes.default.svc
    namespace: cert-manager

  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true