apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: azhi-riotpiao
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: '8'
spec:
  project: homelab
  source:
    # Private GitHub. The read-only credential is Secret azhi-infra-github in
    # namespace argocd, created out-of-band.
    repoURL: https://github.com/ToyoGlobal/azhi-infra.git
    # The repository's default branch. It is not `main`: this repo's work
    # happens on the staging slice branch, and `main` is behind it.
    targetRevision: feat/azi-riotpiao-cnpg
    # One directory, because ArgoCD reads a single path per source. That
    # directory is a root kustomization over foundation, postgres and
    # azhi-server.
    path: k8s/overlays/azi-riotpiao
  destination:
    server: https://kubernetes.default.svc
    namespace: azi-riotpiao
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
    - CreateNamespace=true
    # The two Secrets this namespace needs are credentials, so they are created
    # by hand and NOT by this Application:
    #   acr-pull                 — the private Alibaba ACR pull credential
    #   azhi-riotpiao-app-env    — DB credentials, JWT secrets, AES key
    # A missing imagePullSecret fails the pod outright and a missing app-env
    # Secret leaves it in CreateContainerConfigError, which is the intended
    # loud failure rather than a pod that runs against unknown values.