apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: platform-addons
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "-5"
    argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
spec:
  goTemplate: true
  goTemplateOptions:
    - missingkey=error
  generators:
    - list:
        elements:
          - component: sealed-secrets
            cluster: dev-k3s
            server: https://kubernetes.default.svc
            namespace: kube-system
            repoURL: https://bitnami.github.io/sealed-secrets
            chart: sealed-secrets
            # renovate: datasource=helm depName=sealed-secrets registryUrl=https://bitnami.github.io/sealed-secrets
            revision: 2.17.9
            autoSync: "true"
            helmValues: |
              fullnameOverride: sealed-secrets-controller
              keyrenewperiod: 720h
              image:
                # renovate: datasource=docker depName=bitnami/sealed-secrets-controller
                repository: bitnami/sealed-secrets-controller
                tag: "0.33.1@sha256:e7fad65c2d2f47e48d9ca17408ed56961bfa6a6dd74ccd4a1a214664156534bc"
              resources:
                requests:
                  cpu: 50m
                  memory: 64Mi
                limits:
                  cpu: 250m
                  memory: 256Mi
          - component: vault-agent-injector
            cluster: dev-k3s
            server: https://kubernetes.default.svc
            namespace: vault
            repoURL: https://helm.releases.hashicorp.com
            chart: vault
            # renovate: datasource=helm depName=vault registryUrl=https://helm.releases.hashicorp.com
            revision: 0.32.0
            autoSync: "false"
            helmValues: |
              global:
                externalVaultAddr: http://vault.vault.svc.cluster.local:8200
                tlsDisable: true
              server:
                enabled: false
              injector:
                enabled: true
                authPath: auth/kubernetes
                image:
                  # renovate: datasource=docker depName=hashicorp/vault-k8s
                  repository: hashicorp/vault-k8s
                  tag: "1.7.2@sha256:ae3d307658b72a1cf35dab9bdf92c995d45cdc7183af0516857714b5bd0ba84d"
                webhook:
                  failurePolicy: Fail
                  namespaceSelector:
                    matchLabels:
                      vault-injection: enabled
                resources:
                  requests:
                    cpu: 100m
                    memory: 128Mi
                  limits:
                    cpu: 250m
                    memory: 256Mi
                agentImage:
                  # renovate: datasource=docker depName=hashicorp/vault
                  repository: hashicorp/vault
                  tag: "1.18.5@sha256:750bb37c1638fa194ab37053a81618c61bb0491ddec6fccac87c07a8e6cd8166"
  template:
    metadata:
      name: "{{ .component }}-{{ .cluster }}"
      annotations:
        argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
        project-gitops.io/auto-sync-gate: "{{ .autoSync }}"
      labels:
        project-gitops.io/cluster: "{{ .cluster }}"
        project-gitops.io/owner: platform
    spec:
      project: platform-addons
      source:
        repoURL: "{{ .repoURL }}"
        chart: "{{ .chart }}"
        targetRevision: "{{ .revision }}"
        helm:
          values: "{{ .helmValues }}"
      destination:
        server: "{{ .server }}"
        namespace: "{{ .namespace }}"
      syncPolicy:
        syncOptions:
          - CreateNamespace=true
          - Prune=confirm
          - PruneLast=true
          - FailOnSharedResource=true
        retry:
          limit: 5
          refresh: true
          backoff:
            duration: 5s
            factor: 2
            maxDuration: 3m
      revisionHistoryLimit: 5
  templatePatch: |
    {{- if eq .autoSync "true" }}
    spec:
      syncPolicy:
        automated:
          enabled: true
          prune: true
          selfHeal: true
    {{- end }}
  syncPolicy:
    applicationsSync: create-update
    preserveResourcesOnDeletion: true