# TEMPORARY disaster-recovery application. This creates a short-lived
# administrative ServiceAccount so a lost kubeconfig can be replaced through
# the still-working Argo CD control plane. Remove this file and apps/recovery/
# immediately after access is restored; the finalizer then deletes everything.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: credential-recovery
  namespace: argocd
  finalizers:
    # Cascading deletion is essential here: it removes the temporary
    # cluster-admin binding rather than leaving privileged access behind.
    - resources-finalizer.argocd.argoproj.io
spec:
  project: default

  source:
    repoURL: https://tea.ahmza.com/ahmza.com/k8s-starter-pack.git
    targetRevision: main
    path: apps/recovery

  destination:
    server: https://kubernetes.default.svc
    namespace: credential-recovery

  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true