# Wave 7 — Kong, the cluster's internal API gateway (namespace `api`).
#
# Sits between nginx and the backend services: nginx owns the edge and TLS,
# Kong owns routing policy, auth and rate limiting. Wave 7 puts it after the
# data/messaging tiers it fronts and before the wave-8 applications that
# publish routes into it.
#
# DB-less: routing config comes from Kubernetes objects (Ingress with
# `ingressClassName: kong`, plus KongPlugin/KongConsumer CRDs), so git remains
# the source of truth and there are no migration Jobs on upgrade.
#
# CRDs ship in the chart's crds/ directory; ArgoCD applies those by default
# (helm.skipCrds is left false).
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: kong
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "7"
spec:
  project: homelab
  revisionHistoryLimit: 3
  sources:
    - repoURL: https://charts.konghq.com
      chart: kong
      targetRevision: "3.4.1"
      helm:
        valueFiles:
          - $values/k8s/apps/api/kong-values.yaml
    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
      targetRevision: main
      ref: values
    # The nginx Ingress for api.riotpiao.com. Kept in this Application rather
    # than the central k8s/bootstrap/ingress/ingress.yaml because that one syncs
    # in wave 1, before namespace `api` exists.
    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
      targetRevision: main
      path: k8s/apps/api
  destination:
    server: https://kubernetes.default.svc
    namespace: api
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      # The chart's CRDs exceed the annotation size limit that client-side
      # apply relies on; server-side apply avoids the
      # "metadata.annotations: Too long" failure CRDs commonly hit.
      - ServerSideApply=true
    retry:
      limit: 3
      backoff:
        duration: 10s
        factor: 2
        maxDuration: 3m