clusterSpec:
  # "k8s-admin-prd-ase1" only resolved in the fleet because that name was
  # registered as an external cluster in the hub ArgoCD's cluster list.
  # There's no hub here — one ArgoCD, running on the cluster it manages —
  # so this has to be the built-in local-cluster alias instead.
  destination:
    server: ""
    name: "in-cluster"

argocdSpec:
  # Was argocd-admin (a separate hub namespace in the fleet's two-tier
  # setup). Single ArgoCD instance here, so Application objects live in
  # the same namespace as ArgoCD itself — see claude.md.
  namespace: argocd

teamSpec:
  devops:
    source:
      repoURL: http://gitea.192.168.1.7.nip.io/mukul/devops-infra-helm-charts.git
      targetRevision: main
      path: helm-templates
      valueFiles: ../../helm-overrides/k8s-admin-prd-ase1
    labels:
      bu: infra
      team: devops
      env: prd
      cluster: k8s-admin-prd-ase1

appSpec:
  - name: argocd
    nameOverride: argocd-admin-prd
    namespace: argocd
    chartDir: argo-cd
    valuesDir: argocd-admin-prd
  - name: gitea
    # Adopting the already-running standalone install (helm release
    # "gitea" in namespace "gitea", from deploy_gitea.sh) rather than
    # deploying a second one — nameOverride pins the rendered
    # Application's name (and therefore the Helm release name Argo
    # renders with) to match those existing object names exactly.
    nameOverride: gitea
    namespace: gitea
    chartDir: gitea
    valuesDir: gitea
    # NOT using the Application-wide `replace: true` here anymore — it
    # forces a full PUT of every resource this Application renders, and a
    # bound PVC's spec is immutable (volumeName/storageClassName get
    # filled in by the provisioner after binding; a PUT that omits them
    # looks like clearing them, which the API correctly refuses). The
    # Deployment-only fix now lives as a per-resource sync-option
    # annotation in helm-overrides/k8s-admin-prd-ase1/gitea/custom-values.yaml
    # (deployment.annotations), which only Replaces the Deployment.
  - name: vault
    # Adopting the running production-mode Vault (helm release "vault" in
    # namespace "vault", chart 0.34.1 — see helm-templates/vault/Chart.yaml).
    # It's already initialized and unsealed; this Application only manages
    # Vault's Deployment/config, never its data or seal state. Review the
    # first diff carefully before syncing — this is the highest-consequence
    # adoption in this repo so far.
    nameOverride: vault
    namespace: vault
    chartDir: vault
    valuesDir: vault
  - name: contour
    # Adopting the running ingress (helm release "contour" in namespace
    # "projectcontour", chart 0.7.0 — the OFFICIAL projectcontour chart,
    # not the Bitnami one that used to be wired up as helm-templates/contour
    # — see the note in that Chart.yaml and claude.md issue #4). This is
    # the ingress path for every other Application in this repo — review
    # the diff before syncing, same caution as vault.
    nameOverride: contour
    namespace: projectcontour
    chartDir: contour
    valuesDir: contour
  - name: external-secrets
    # Correction from an earlier version of this file: "no nameOverride
    # needed" was wrong. Without one, the Application (and therefore the
    # Helm release name the chart templates with) becomes
    # "external-secrets-admin-prd" — so the controller's ServiceAccount
    # actually ends up named external-secrets-admin-prd, not
    # external-secrets. secretstores/vault-backend.yaml's
    # serviceAccountRef assumes the plain name, and Vault's role was bound
    # to bound_service_account_names=external-secrets — both need this
    # pinned name to match.
    nameOverride: external-secrets
    namespace: external-secrets
    chartDir: external-secrets
    valuesDir: external-secrets
    # ClusterSecretStore's CRD (large embedded OpenAPI schema) exceeds the
    # 256KiB last-applied-configuration annotation limit on a normal
    # client-side apply. SSA sidesteps it entirely — see the note in
    # generic-argo-apps-chart's template.
    serverSideApply: true