s3_pvc_appset.yaml

---
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: zitadel-s3-pvc-app-set
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "1"
spec:
  goTemplate: true
  # generator allows us to source specific values from an external k8s secret
  generators:
    - plugin:
        configMapRef:
          name: secret-var-plugin-generator
        input:
          parameters:
            secret_vars:
              - zitadel_s3_provider
              - zitadel_s3_backup_endpoint
              - zitadel_s3_backup_bucket
              - zitadel_s3_backup_region
              - zitadel_s3_pvc_capacity
  template:
    metadata:
      name: zitadel-s3-pvc
      annotations:
        argocd.argoproj.io/sync-wave: "1"
    spec:
      project: zitadel
      destination:
        server: "https://kubernetes.default.svc"
        namespace: zitadel
      syncPolicy:
        syncOptions:
          - ApplyOutOfSyncOnly=true
        automated:
          prune: true
          selfHeal: true
      source:
        repoURL: https://github.com/small-hack/argocd-apps.git
        path: s3_persistence_and_backups/
        targetRevision: main
        helm:
          valuesObject:
            provider: '{{ .zitadel_s3_provider }}'
            pvc_capacity: '{{ .zitadel_s3_pvc_capacity }}'

            # not in use yet
            k8up:
              backup_name: "zitadel-nightly-backup"

              # -- can be set to 's3' or 'local'
              backup_type: "s3"

              s3:
                bucket: '{{ .zitadel_s3_backup_bucket }}'
                endpoint: '{{ .zitadel_s3_backup_endpoint }}'
                accessKeyIDSecretRef:
                  name: 'backups-s3-credentials'
                  key: 'accessKey'
                  optional: false
                secretAccessKeySecretRef:
                  name: 'backups-s3-credentials'
                  key: 'secretKey'
                  optional: false

              repoPasswordSecretRef:
                name: 'backups-s3-credentials'
                key: 'resticRepoPass'

              prometheus_url: 'push-gateway.prometheus.svc:9091'

              podSecurityContext:
                runAsUser: 0

              schedules:
                backup: "47 15 * * *"
                check: "48 15 * * *"
                prune: "49 15 * * *"