# sops-secrets-operator, installed like MetalLB and Longhorn: an Application
# pointing at apps/sops-secrets-operator, a Helm chart that pulls in the
# upstream operator chart. Once this syncs, any SopsSecret custom resource
# committed anywhere in this repo gets decrypted into a real Kubernetes
# Secret automatically. See docs/10-secrets.md for the full explanation,
# including the one manual step this needs before it can decrypt anything.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: sops-secrets-operator
  namespace: argocd
  # Safe to cascade: this operator holds no persistent data of its own.
  # Deleting it stops decrypting SopsSecrets; the encrypted source files and
  # the age key stay intact.
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  project: default

  source:
    repoURL: https://tea.ahmza.com/ahmza/k8s-starter-pack.git
    targetRevision: main
    path: apps/sops-secrets-operator

  destination:
    server: https://kubernetes.default.svc
    namespace: sops

  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true