apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: percona-everest
  namespace: argocd
spec:
  destination:
    namespace: everest-system
    server: {{ $.Values.spec.destination.server }}
  project: homelab
  source:
    chart: everest
    repoURL: https://percona.github.io/percona-helm-charts/
    targetRevision: 1.13.0
    helm:
      parameters:
      - name: dbNamespace.enabled
        value: "false"
      - name: upgrade.preflightChecks
        value: "false"

  syncPolicy:
    automated: 
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      - RespectIgnoreDifferences=true
      # To prevent issues with synchronising some CRDs.
      - ServerSideApply=true

  ignoreDifferences:
  # If `server.jwtKey` is not set, the chart will generates a random key.
  # As a result, the Secret will always be out of sync, since ArgoCD will
  # rerender it on each sync.
  - group: ""
    jsonPointers:
    - /data
    kind: Secret
    name: everest-jwt
    namespace: everest-system
  # If `server.initialAdminPassword` is not set, the chart will generates a random password.
  # As a result, the Secret will always be out of sync, since ArgoCD will
  # rerender it on each sync. Moreover, this Secret may be managed externally, for example, using `everestctl`.
  - group: ""
    jsonPointers:
    - /data
    kind: Secret
    name: everest-accounts
    namespace: everest-system
  # If OLM is deployed without cert-manager, the below TLS certificates are randomly generated.
  # As a result, the Secret will always be out of sync, since ArgoCD will
  # rerender it on each sync.
  - group: ""
    jsonPointers:
    - /data
    kind: Secret
    name: packageserver-service-cert
    namespace: everest-olm
  - group: apiregistration.k8s.io
    jqPathExpressions:
    - .spec.caBundle
    - .metadata.annotations
    kind: APIService
    name: v1.packages.operators.coreos.com
  # If `operator.webhook.certs` are not set explicitly, the chart will generate random certificates.
  # As a result, the TLS Secret and Mutating/Validating webhook configurations (caBundle) will always appear out of sync.
  - group: ""
    jsonPointers:
    - /data
    kind: Secret
    name: webhook-server-cert
    namespace: everest-system
  - group: admissionregistration.k8s.io
    jqPathExpressions:
    - .webhooks[].clientConfig.caBundle
    kind: MutatingWebhookConfiguration
    name: everest-operator-mutating-webhook-configuration
  - group: admissionregistration.k8s.io
    jqPathExpressions:
    - .webhooks[].clientConfig.caBundle
    kind: ValidatingWebhookConfiguration
    name: everest-operator-validating-webhook-configuration